CVE-2026-3524 HIGH

CVE-2026-3524: Authorization Bypass in Mattermost Legal Hold Plugin Due to Missing Return After Permission Check

Vendor Mattermost
Product Mattermost
Weakness CWE-862 · Missing authorization
Published April 6, 2026
Last update April 7, 2026
View on NVD All CVEs

CVSS base score

8.3/10
Attack vector Network
Attack complexity Low
Privileges required Low
User interaction None
Confidentiality High
Integrity High

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

What the vulnerability does

01Description

Mattermost Plugin Legal Hold versions <=1.1.4 fail to halt request processing after a failed authorization check in ServeHTTP which allows an authenticated attacker to access, create, download, and delete legal hold data via crafted API requests to the plugin's endpoints. Mattermost Advisory ID: MMSA-2026-00621

Key dates

02Disclosure timeline

April 6, 2026 CVE published
April 7, 2026 Record updated

Related vulnerabilities

04Related CVE

CVE-2026-12122 Kirki <= 6.0.11 - Missing Authorization to Unauthenticated Sensitive Information Exposure via kirki_post_apis_nopriv AJAX Action CVE-2026-12113 Appointment Booking Calendar <= 1.4.02 - Missing Authorization to Authenticated (Contributor+) Sensitive Information Disclosure CVE-2026-57746 WordPress Booked plugin <= 3.0.0 - Broken Access Control vulnerability CVE-2026-57355 WordPress Classified Listing plugin <= 5.4.2 - Broken Access Control vulnerability CVE-2026-57730 WordPress Flatsome theme <= 3.20.5 - Broken Access Control vulnerability