CVE-2026-18256
Received Received - Intake

Information Disclosure in Mattermost Private Teams

Publication date: 2026-10-16

Last updated on: 2026-10-16

Assigner: Mattermost, Inc.

Description
Mattermost versions 11.10.x <= 11.10.0, 11.7.x <= 11.7.9, 11.9.x <= 11.9.1, 11.8.x <= 11.8.5 fail to properly restrict private teams from public team search results, which allows an authenticated user without permission to list private teams to disclose the ID, name, and display name of private teams via a modified team search request. Mattermost Advisory ID: MMSA-2026-00748

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-16
Last Modified
2026-10-16
Generated
2026-10-16
AI Q&A
2026-10-16
EPSS Evaluated
N/A
NVD
CVE-2026-18256
EUVD
EUVD-2026-102749

Affected Vendors & Products

Showing 4 associated CPEs
Vendor Product Version / Range
Mattermost Mattermost 11.10.0
Mattermost Mattermost 11.7.0
Mattermost Mattermost 11.9.0
Mattermost Mattermost 11.8.0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-863 The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

Mattermost versions between 11.7.0 and 11.10.0 have a flaw where private teams can be listed in search results even for users without permission. This allows authenticated users to view the ID, name, and display name of private teams by sending a modified search request.

Detection Guidance

To detect this vulnerability, check Mattermost server logs for unusual team search requests that return private team details. Look for authenticated users querying team endpoints without proper permissions. Verify if private team IDs, names, or display names are exposed in search results.

Impact Analysis

An attacker with valid credentials could discover sensitive team names or IDs that should remain private. This could lead to unauthorized access to team information or aid in further attacks by mapping private team structures.

Compliance Impact

This vulnerability may violate data protection requirements under GDPR or HIPAA by exposing private team information to unauthorized users. It could lead to non-compliance with privacy controls and potential data breaches.

Mitigation Strategies

Upgrade Mattermost to a patched version (11.10.1 or later, 11.7.10 or later, 11.8.6 or later, 11.9.2 or later). Apply the latest security patches immediately. Review team search permissions to ensure private teams are not exposed in search results.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-18256. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart