CVE-2026-3113CWE-732

mmctl export download command doesn’t restrict permissions to created file to file owner

Medium · published March 26, 2026

CVSS v3.1
5.0
EPSS
0%
Percentile
2.2
In the wild
Unconfirmed
What it is

Mattermost versions 11.4.x <= 11.4.0, 11.3.x <= 11.3.1, 11.2.x <= 11.2.3, 10.11.x <= 10.11.11 fail to set permissions on downloaded bulk export which allows other local users on the server to be able to read contents of the bulk export.. Mattermost Advisory ID: MMSA-2026-00593

The record
Technical detail
CVSS v3.1
5.0 · MEDIUM
Vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N
CVSS v4.0
Not supplied
EPSS
0.00128 · 2.2th percentile
Weakness
CWE-732 · Incorrect Permission Assignment for Critical Resource
Published
2026-03-26T16:18Z
EPSS history
Timeline
  • 26 MAR 16:18Z
    mmctl export download command doesn’t restrict permissions to created file to file owner
    cvelistv5