What is CVE-2026-3115?

CVE-2026-3115 is a medium-severity vulnerability in Mattermost, classified under Incorrect Authorization. CVSS score: 4.3/10. Published 2026-03-26.

How severe is CVE-2026-3115?

Medium severity. CVSS v3 base score is 4.3 out of 10.

Auth bypass in Mattermost

CVE-2026-3115

Mattermost versions 11.2.x <= 11.2.2, 10.11.x <= 10.11.10, 11.4.x <= 11.4.0, 11.3.x <= 11.3.1 fail to apply view restrictions when retrieving group member IDs, which allows authenticated guest users to enumerate user IDs outside their allowed visibility scope via the group retrieval endpoint.. Mattermost Advisory ID: MMSA-2026-00594

Vulnerability class: Broken Access Control

EPSS: 0.002 (14.1th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 4.3 (Medium). Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N.

Affected products

Mattermost — versions 11.2.0, 10.11.0, 11.4.0
Mattermost Mattermost_server — versions 11.4.0

Weakness classification (CWE)

CWE-863 — Incorrect Authorization

References

responsibledisclosure@mattermost.com (vendor-advisory, Vendor Advisory)

Frequently asked questions

What is CVE-2026-3115?: CVE-2026-3115 is a medium-severity vulnerability in Mattermost, classified under Incorrect Authorization. CVSS score: 4.3/10. Published 2026-03-26.
How severe is CVE-2026-3115?: Medium severity. CVSS v3 base score is 4.3 out of 10.