CVE-2026-3524
Analyzed Analyzed - Analysis Complete

Authorization Bypass in Mattermost Legal Hold Plugin Allows Data Access

Publication date: 2026-04-06

Last updated on: 2026-08-06

Assigner: Mattermost, Inc.

Description
Mattermost Plugin Legal Hold versions <=1.1.4 fail to halt request processing after a failed authorization check in ServeHTTP which allows an authenticated attacker to access, create, download, and delete legal hold data via crafted API requests to the plugin's endpoints. Mattermost Advisory ID: MMSA-2026-00621

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-04-06
Last Modified
2026-08-06
Generated
2026-08-15
AI Q&A
2026-04-06
EPSS Evaluated
2026-08-14
NVD
CVE-2026-3524
EUVD
EUVD-2026-19231

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
mattermost legal_hold to 1.1.5 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-862 The product does not perform an authorization check when an actor attempts to access a resource or perform an action.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

Mattermost Plugin Legal Hold versions up to 1.1.4 have a vulnerability where the plugin fails to stop processing requests after an authorization check fails in the ServeHTTP function.

This flaw allows an authenticated attacker to bypass authorization controls and perform unauthorized actions such as accessing, creating, downloading, and deleting legal hold data by sending specially crafted API requests to the plugin's endpoints.

Impact Analysis

This vulnerability can have severe impacts as it allows an authenticated attacker to gain unauthorized access and control over sensitive legal hold data.

  • Access sensitive legal hold information without proper authorization.
  • Create or modify legal hold data, potentially corrupting or falsifying records.
  • Download confidential legal hold data, leading to data leakage.
  • Delete legal hold data, which could result in loss of critical evidence or records.

Overall, this can compromise the integrity, confidentiality, and availability of legal hold data.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-3524. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart