GitHub Advisoryadvisory · Go
GHSA-4765-v66x-rqx7 Mattermost doesn't set permissions on downloaded bulk export
MEDIUM
Official page ↗
- Aliases
- CVE-2026-3113
- Ecosystem
- Go
- Packages
- github.com/mattermost/mattermost-server
- Severity
- Moderate
- CVSS vector
- CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N
- Weaknesses
- CWE-732
- Reviewed
- 2026-03-31
Affected packages
• Go github.com/mattermost/mattermost-server: >= 11.4.0-rc1, < 11.4.1 → fixed in 11.4.1
• Go github.com/mattermost/mattermost-server: >= 11.3.0-rc1, < 11.3.2 → fixed in 11.3.2
• Go github.com/mattermost/mattermost-server: >= 11.2.0-rc1, < 11.2.4 → fixed in 11.2.4
• Go github.com/mattermost/mattermost-server: >= 10.11.0-rc1, < 10.11.12 → fixed in 10.11.12
• Go github.com/mattermost/mattermost-server: >= 8.0.0-20260105080200-d27a2195068d, < 8.0.0-20260217110922-b7d4a1f1f59b → fixed in 8.0.0-20260217110922-b7d4a1f1f59b
Description
Mattermost versions 11.4.x <= 11.4.0, 11.3.x <= 11.3.1, 11.2.x <= 11.2.3, 10.11.x <= 10.11.11 fail to set permissions on downloaded bulk export which allows other local users on the server to be able to read contents of the bulk export. Mattermost Advisory ID: MMSA-2026-00593.
Related
Alias · CVE (1)
- CVE-2026-3113 Mattermost versions 11.4.x <= 11.4.0, 11.3.x <= 11.3.1, 11.2.x <= 11.2.3, 10.11.x <= 10.11.11 fail to set permissions on downloaded bulk… vulnerability
Weakness · CWE (1)
- CWE-732 Incorrect Permission Assignment for Critical Resource weakness