CVE-2026-3433
published 2026-06-12CVE-2026-3433: Mattermost versions 11.6.x <= 11.6.1, 11.5.x <= 11.5.4, 10.11.x <= 10.11.15, 10.11.x <= 10.11.16 fail to restrict role_updated websocket event broadcasts to…
PriorityP423medium4.3CVSS 3.1
AVNACLPRLUINSUCLINAN
EPSS
0.18%
7.7th percentile
Mattermost versions 11.6.x <= 11.6.1, 11.5.x <= 11.5.4, 10.11.x <= 10.11.15, 10.11.x <= 10.11.16 fail to restrict role_updated websocket event broadcasts to members of the affected team or channel which allows an authenticated attacker with guest-level access to observe permission scheme change notifications for private teams they are not a member of via the websocket connection.. Mattermost Advisory ID: MMSA-2026-00616
Affected
7 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| github.com | mattermost_mattermost-server | >= 10.11.0 < 10.11.17 | 10.11.17 |
| github.com | mattermost_mattermost-server | >= 11.5.0 < 11.5.5 | 11.5.5 |
| github.com | mattermost_mattermost-server | >= 11.6.0 < 11.6.1 | 11.6.1 |
| github.com | mattermost_mattermost_server_v8 | >= 8.0.0-20250731163400-5b955468ea1e < 8.0.0-20260504071740-9408b98025d7 | 8.0.0-20260504071740-9408b98025d7 |
| mattermost | mattermost | 10.11.0 – 10.11.15 | — |
| mattermost | mattermost | 11.5.0 – 11.5.4 | — |
| mattermost | mattermost | 11.6.0 – 11.6.1 | — |
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
Mattermost versions 11.6.x <= 11.6.1, 11.5.x <= 11.5.4, 10.11.x <= 10.11.15, 10.11.x <= 10.11.16 fail to restrict role_updated websocket event broadcasts to members of the affected team or channel whi
ghsa_unreviewed·2026-06-12
CVE-2026-3433 [MEDIUM] CWE-200 Mattermost versions 11.6.x <= 11.6.1, 11.5.x <= 11.5.4, 10.11.x <= 10.11.15, 10.11.x <= 10.11.16 fail to restrict role_updated websocket event broadcasts to members of the affected team or channel whi
Mattermost versions 11.6.x <= 11.6.1, 11.5.x <= 11.5.4, 10.11.x <= 10.11.15, 10.11.x <= 10.11.16 fail to restrict role_updated websocket event broadcasts to members of the affected team or channel which allows an authenticated attacker with guest-level access to observe permission scheme change notifications for private teams they are not a member of via the websocket connection.. Mattermost Advisory ID: MMSA-2026-00616
GHSA
Mattermost doesn't restrict role_updated websocket event broadcasts to members of the affected team or channel
ghsa·2026-06-12
CVE-2026-3433 [MEDIUM] CWE-200 Mattermost doesn't restrict role_updated websocket event broadcasts to members of the affected team or channel
Mattermost doesn't restrict role_updated websocket event broadcasts to members of the affected team or channel
Mattermost versions 11.6.x <= 11.6.1, 11.5.x <= 11.5.4, 10.11.x <= 10.11.15, 10.11.x <= 10.11.16 fail to restrict role_updated websocket event broadcasts to members of the affected team or channel, which allows an authenticated attacker with guest-level access to observe permission scheme change notifications for private teams they are not a member of via the websocket connection. Mattermost Advisory ID: MMSA-2026-00616
VulDB
Mattermost up to 11.6.x Websocket Connection information disclosure
vuldb·2026-06-12·CVSS 4.3
CVE-2026-3433 [MEDIUM] Mattermost up to 11.6.x Websocket Connection information disclosure
A vulnerability categorized as problematic has been discovered in Mattermost up to 10.11.15/10.11.16/11.5.4/11.6.1/11.6.x. Affected is an unknown function of the component Websocket Connection Handler. The manipulation results in information disclosure.
This vulnerability is cataloged as CVE-2026-3433. The attack may be launched remotely. There is no exploit available.
It is advisable to upgrade the affected component.
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
2026-06-12
Published