VULNERABILITY INTELLIGENCE

CVE-2026-24692

CVSS score4.3 MEDIUM

EPSS probability0.17%

CISA KEVNot currently listed

Published2026-03-16

Last modified2026-06-17

Description

Mattermost versions 11.3.x <= 11.3.0, 11.2.x <= 11.2.2, 10.11.x <= 10.11.10 fail to properly enforce read permissions in search API endpoints which allows guest users without read permissions to access posts and files in channels via search API requests. Mattermost Advisory ID: MMSA-2025-00554