CVE-2026-24692CWE-863

Guest users can bypass read permissions via search API

Medium · published March 16, 2026

CVSS v3.1
4.3
EPSS
0%
Percentile
5.8
In the wild
Unconfirmed
What it is

Mattermost versions 11.3.x <= 11.3.0, 11.2.x <= 11.2.2, 10.11.x <= 10.11.10 fail to properly enforce read permissions in search API endpoints which allows guest users without read permissions to access posts and files in channels via search API requests. Mattermost Advisory ID: MMSA-2025-00554

The record
Technical detail
CVSS v3.1
4.3 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
CVSS v4.0
Not supplied
EPSS
0.00168 · 5.8th percentile
Weakness
CWE-863 · Incorrect Authorization
Published
2026-03-16T14:56Z
EPSS history
Timeline
  • 16 MAR 14:56Z
    Guest users can bypass read permissions via search API
    cvelistv5