CVE-2026-21386
published 2026-03-16CVE-2026-21386: Mattermost versions 11.3.x <= 11.3.0, 11.2.x <= 11.2.2, 10.11.x <= 10.11.10 fail to use consistent error responses when handling the /mute command which allows…
PriorityP421medium4.3CVSS 3.1
AVNACLPRLUINSUCLINAN
EPSS
0.18%
8.3th percentile
Mattermost versions 11.3.x <= 11.3.0, 11.2.x <= 11.2.2, 10.11.x <= 10.11.10 fail to use consistent error responses when handling the /mute command which allows an authenticated team member to enumerate private channels they are not authorized to know about via differing error messages for nonexistent versus private channels. Mattermost Advisory ID: MMSA-2026-00588
Affected
14 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| github.com | mattermost_mattermost-server | >= 0 < 5.3.2-0.20260130144323-5bb5261c72fa | 5.3.2-0.20260130144323-5bb5261c72fa |
| github.com | mattermost_mattermost-server | >= 10.11.0-rc1 < 10.11.11 | 10.11.11 |
| github.com | mattermost_mattermost-server | >= 10.11.0-rc1+incompatible < 10.11.11+incompatible | 10.11.11+incompatible |
| github.com | mattermost_mattermost-server | >= 11.2.0-rc1 < 11.2.3 | 11.2.3 |
| github.com | mattermost_mattermost-server | >= 11.2.0-rc1+incompatible < 11.2.3+incompatible | 11.2.3+incompatible |
| github.com | mattermost_mattermost-server | >= 11.3.0-rc1 < 11.3.1 | 11.3.1 |
| github.com | mattermost_mattermost-server | >= 11.3.0-rc1+incompatible < 11.3.1+incompatible | 11.3.1+incompatible |
| github.com | mattermost_mattermost_server_v8 | >= 0 < 8.0.0-20260130144323-5bb5261c72fa | 8.0.0-20260130144323-5bb5261c72fa |
| mattermost | mattermost | 10.11.0 – 10.11.10 | — |
| mattermost | mattermost | 11.2.0 – 11.2.2 | — |
| mattermost | mattermost | 11.3.0 – 11.3.0 | — |
| mattermost | mattermost_server | >= 10.11.0 < 10.11.11 | 10.11.11 |
| mattermost | mattermost_server | >= 11.2.0 < 11.2.3 | 11.2.3 |
| mattermost | mattermost_server | >= 11.3.0 < 11.3.1 | 11.3.1 |
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
OSV
Mattermost fails to use consistent error responses when handling the /mute command in github.com/mattermost/mattermost-server
osv·2026-03-23
CVE-2026-21386 Mattermost fails to use consistent error responses when handling the /mute command in github.com/mattermost/mattermost-server
Mattermost fails to use consistent error responses when handling the /mute command in github.com/mattermost/mattermost-server
Mattermost fails to use consistent error responses when handling the /mute command in github.com/mattermost/mattermost-server.
NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions.
(If this is causing false-positive reports from vulnerability scanners, please suggest an edit to the report.)
The additional affected modules and versions are: github.com/mattermost/mattermost-server/v5 before v5.3.2-0.20260130144323-5bb5261c72fa.
OSV
Mattermost fails to use consistent error responses when handling the /mute command
osv·2026-03-16
CVE-2026-21386 [MEDIUM] Mattermost fails to use consistent error responses when handling the /mute command
Mattermost fails to use consistent error responses when handling the /mute command
Mattermost versions 11.3.x <= 11.3.0, 11.2.x <= 11.2.2, 10.11.x <= 10.11.10 fail to use consistent error responses when handling the /mute command which allows an authenticated team member to enumerate private channels they are not authorized to know about via differing error messages for nonexistent versus private channels. Mattermost Advisory ID: MMSA-2026-00588
GHSA
Mattermost fails to use consistent error responses when handling the /mute command
ghsa·2026-03-16
CVE-2026-21386 [MEDIUM] CWE-203 Mattermost fails to use consistent error responses when handling the /mute command
Mattermost fails to use consistent error responses when handling the /mute command
Mattermost versions 11.3.x <= 11.3.0, 11.2.x <= 11.2.2, 10.11.x <= 10.11.10 fail to use consistent error responses when handling the /mute command which allows an authenticated team member to enumerate private channels they are not authorized to know about via differing error messages for nonexistent versus private channels. Mattermost Advisory ID: MMSA-2026-00588
No detection rules found.
No public exploits indexed.
2026-03-16
Published