CVE-2026-24692
Fixed in a distro release EPSS <1%CVSS 4.3
Mattermost versions 11.3.x <= 11.3.0, 11.2.x <= 11.2.2, 10.11.x <= 10.11.10 fail to properly enforce read permissions in search API endpoints which allows guest users without read permissions to access posts and files in channels via search API requests. Mattermost Advisory ID: MMSA-2025-00554
Products: Mattermost
Fixed upstream
| Ecosystem | Package | Fixed in |
|---|---|---|
| Go | github.com/mattermost/mattermost-server | 5.3.2-0.20260107142155-0481bd1fb045 |
| Go | github.com/mattermost/mattermost-server | 10.11.11 |
| Go | github.com/mattermost/mattermost-server | 11.2.3 |
| Go | github.com/mattermost/mattermost-server | 11.3.1 |
| Go | github.com/mattermost/mattermost-server | 10.11.11+incompatible |
| Go | github.com/mattermost/mattermost-server | 11.2.3+incompatible |
| Go | github.com/mattermost/mattermost-server | 11.3.1+incompatible |
| Go | github.com/mattermost/mattermost-server/v5 | no fix |
| Go | github.com/mattermost/mattermost-server/v6 | no fix |
| Go | github.com/mattermost/mattermost/server/v8 | 8.0.0-20260107142155-0481bd1fb045 |
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| openSUSE Leap 15.6 | govulncheck-vulndb | 0.0.20260326T203309-150000.1.155.2 |
| openSUSE Leap 16.0 | govulncheck-vulndb | 0.0.20260723T184607-160000.1.1 |