PT-2026-48926 · Mattermost · Mattermost

0X7Oda7123 · CVE-2026-3433 · Published 2026-06-12 · Updated 2026-06-18

Positive Technologies (AI Summary)

CVSS v3.1

4.3

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions Mattermost versions prior to 11.6.2 Mattermost versions prior to 11.5.5 Mattermost versions prior to 10.11.17

Description An issue exists where role updated websocket event broadcasts are not restricted to members of the affected team or channel. This allows an authenticated attacker with guest-level access to observe permission scheme change notifications for private teams they are not a member of through the websocket connection.

Recommendations Update to version 11.6.2 or later. Update to version 11.5.5 or later. Update to version 10.11.17 or later.

Exploit

Fix

Information Disclosure

Weakness Enumeration

CWE-200

Related Identifiers

CVE-2026-3433

Affected Products

Mattermost

References · 7

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/3xxx/CVE-2026-3433.json · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2026-3433 · Security Note
• https://mattermost.com/security-updates · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2026-3433 · Vendor Advisory
• https://t.me/cveNotify/170357 · Telegram Post
• https://t.me/cveNotify/167489 · Telegram Post
• https://t.me/CVEtracker/56719 · Telegram Post