CVE-2026-3115 MEDIUM

CVE-2026-3115: Guest users can view group member IDs without respecting view restrictions

Vendor Mattermost
Product Mattermost
Weakness CWE-863 · Incorrect authorization
Published March 26, 2026
Last update March 26, 2026
View on NVD All CVEs

CVSS base score

4.3/10
Attack vector Network
Attack complexity Low
Privileges required Low
User interaction None
Confidentiality Low
Integrity None

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

What the vulnerability does

01Description

Mattermost versions 11.2.x <= 11.2.2, 10.11.x <= 10.11.10, 11.4.x <= 11.4.0, 11.3.x <= 11.3.1 fail to apply view restrictions when retrieving group member IDs, which allows authenticated guest users to enumerate user IDs outside their allowed visibility scope via the group retrieval endpoint.. Mattermost Advisory ID: MMSA-2026-00594

Key dates

02Disclosure timeline

March 26, 2026 CVE published
March 26, 2026 Record updated

Related vulnerabilities

04Related CVE

CVE-2026-41191 FreeScout's signature only mailbox permission allows unauthorized mailbox chat setting changes CVE-2025-48044 Authorization bypass when bypass policy condition evaluates to true CVE-2024-52584 Autolab has vulnerable submission endpoints CVE-2026-26012 vaultwarden has Full Cipher Enumeration Ignoring Organization Collection Permissions CVE-2026-35586 Authorization Bypass for SSL Certificate/Key Configuration Due to Option Name Mismatch in pyload-ng