CVE-2026-3433

Summary

Mattermost versions 11.6.x <= 11.6.1, 11.5.x <= 11.5.4, 10.11.x <= 10.11.15, 10.11.x <= 10.11.16 fail to restrict role_updated websocket event broadcasts to members of the affected team or channel which allows an authenticated attacker with guest-level access to observe permission scheme change notifications for private teams they are not a member of via the websocket connection.. Mattermost Advisory ID: MMSA-2026-00616

Affected Software

VendorProductVersion RangeStatus
MattermostMattermost11.6.0 <= 11.6.1affected
MattermostMattermost11.5.0 <= 11.5.4affected
MattermostMattermost10.11.0 <= 10.11.15affected
MattermostMattermost10.11.0 <= 10.11.16affected
MattermostMattermost11.7.0unaffected
MattermostMattermost11.6.2unaffected
MattermostMattermost11.5.5unaffected
MattermostMattermost10.11.16unaffected
MattermostMattermost10.11.17unaffected

Weaknesses

  • CWE-200: CWE-200 Exposure of Sensitive Information to an Unauthorized Actor

ADP Enrichment

CISA ADP Vulnrichment

  • SSVC:
  • Exploitation: none
    • Automatable: no
    • Technical Impact: partial

References