GitHub Advisoryadvisory · Go

GHSA-5mr9-crcg-8wh2 Mattermost fails to use consistent error responses when handling the /mute command

MEDIUM Published 2026-03-16 Modified 2026-03-18 Official page ↗
Aliases
CVE-2026-21386
Ecosystem
Go
Packages
github.com/mattermost/mattermost/server/v8, github.com/mattermost/mattermost-server
Severity
Moderate
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Weaknesses
CWE-203
Reviewed
2026-03-18

Affected packages

• Go github.com/mattermost/mattermost/server/v8: < 8.0.0-20260130144323-5bb5261c72fa → fixed in 8.0.0-20260130144323-5bb5261c72fa • Go github.com/mattermost/mattermost-server: < 5.3.2-0.20260130144323-5bb5261c72fa → fixed in 5.3.2-0.20260130144323-5bb5261c72fa • Go github.com/mattermost/mattermost-server: >= 10.11.0-rc1, < 10.11.11 → fixed in 10.11.11 • Go github.com/mattermost/mattermost-server: >= 11.2.0-rc1, < 11.2.3 → fixed in 11.2.3 • Go github.com/mattermost/mattermost-server: >= 11.3.0-rc1, < 11.3.1 → fixed in 11.3.1

Description

Mattermost versions 11.3.x <= 11.3.0, 11.2.x <= 11.2.2, 10.11.x <= 10.11.10 fail to use consistent error responses when handling the /mute command which allows an authenticated team member to enumerate private channels they are not authorized to know about via differing error messages for nonexistent versus private channels. Mattermost Advisory ID: MMSA-2026-00588

Related

Alias · CVE (1)

  • CVE-2026-21386 Mattermost versions 11.3.x <= 11.3.0, 11.2.x <= 11.2.2, 10.11.x <= 10.11.10 fail to use consistent error responses when handling the /mute… vulnerability

Weakness · CWE (1)

  • CWE-203 Observable Discrepancy weakness

References