GitHub Advisoryadvisory · Go

GHSA-cwfj-642j-gfh4 Mattermost fails to properly enforce read permissions in search API endpoints

MEDIUM Published 2026-03-16 Modified 2026-03-18 Official page ↗
Aliases
CVE-2026-24692
Ecosystem
Go
Packages
github.com/mattermost/mattermost/server/v8, github.com/mattermost/mattermost-server
Severity
Moderate
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Weaknesses
CWE-863
Reviewed
2026-03-18

Affected packages

• Go github.com/mattermost/mattermost/server/v8: < 8.0.0-20260107142155-0481bd1fb045 → fixed in 8.0.0-20260107142155-0481bd1fb045 • Go github.com/mattermost/mattermost-server: < 5.3.2-0.20260107142155-0481bd1fb045 → fixed in 5.3.2-0.20260107142155-0481bd1fb045 • Go github.com/mattermost/mattermost-server: >= 10.11.0-rc1, < 10.11.11 → fixed in 10.11.11 • Go github.com/mattermost/mattermost-server: >= 11.2.0-rc1, < 11.2.3 → fixed in 11.2.3 • Go github.com/mattermost/mattermost-server: >= 11.3.0-rc1, < 11.3.1 → fixed in 11.3.1

Description

Mattermost versions 11.3.x <= 11.3.0, 11.2.x <= 11.2.2, 10.11.x <= 10.11.10 fail to properly enforce read permissions in search API endpoints which allows guest users without read permissions to access posts and files in channels via search API requests. Mattermost Advisory ID: MMSA-2025-00554

Related

Alias · CVE (1)

  • CVE-2026-24692 Mattermost versions 11.3.x <= 11.3.0, 11.2.x <= 11.2.2, 10.11.x <= 10.11.10 fail to properly enforce read permissions in search API… vulnerability

Weakness · CWE (1)

  • CWE-863 Incorrect Authorization weakness

References