CVE-2026-3433— Mattermost fails to scope role_updated websocket events to authorized team and channel members
Quick assessment
Affected
Mattermost Mattermost
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
Mattermost是美国Mattermost公司开源的一个开源协作平台。 Mattermost存在信息泄露漏洞，该漏洞源于未能限制role_updated websocket事件广播至受影响的团队或频道成员，可能导致经过身份验证的具有访客级访问权限的攻击者通过websocket连接观察到其未加入的私有团队的权限方案更改通知。以下版本受到影响：11.6.1及之前的11.6.x版本、11.5.4及之前的11.5.x版本、10.11.15及之前的10.11.x版本和10.11.16及之前的10.11.x版本。
Possible ATT&CK Techniques 1 AI
T1530 · Data from Cloud StorageAffected Version Matrix 9
| Vendor | Product | Version Range | Status |
|---|---|---|---|
| Mattermost | Mattermost | 11.6.0≤ 11.6.1 |
affected |
11.5.0≤ 11.5.4 |
affected | ||
10.11.0≤ 10.11.15 |
affected | ||
10.11.0≤ 10.11.16 |
affected | ||
11.7.0 |
unaffected | ||
11.6.2 |
unaffected | ||
11.5.5 |
unaffected | ||
10.11.16 |
unaffected | ||
| … +1 more rows | |||
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-3433
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Mattermost fails to scope role_updated websocket events to authorized team and channel members
Source: CVE Program / CVE List V5
Vulnerability Description
Mattermost versions 11.6.x <= 11.6.1, 11.5.x <= 11.5.4, 10.11.x <= 10.11.15, 10.11.x <= 10.11.16 fail to restrict role_updated websocket event broadcasts to members of the affected team or channel which allows an authenticated attacker with guest-level access to observe permission scheme change notifications for private teams they are not a member of via the websocket connection.. Mattermost Advisory ID: MMSA-2026-00616
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Source: CVE Program / CVE List V5
Vulnerability Type
信息暴露
Source: CVE Program / CVE List V5
Vulnerability Title
Mattermost 信息泄露漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
Mattermost是美国Mattermost公司开源的一个开源协作平台。 Mattermost存在信息泄露漏洞，该漏洞源于未能限制role_updated websocket事件广播至受影响的团队或频道成员，可能导致经过身份验证的具有访客级访问权限的攻击者通过websocket连接观察到其未加入的私有团队的权限方案更改通知。以下版本受到影响：11.6.1及之前的11.6.x版本、11.5.4及之前的11.5.x版本、10.11.15及之前的10.11.x版本和10.11.16及之前的10.11.x版本。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| Mattermost | Mattermost | 11.6.0 ~ 11.6.1 | - |
|
II. Public POCs for CVE-2026-3433
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-3433
请登录查看更多情报信息。
Same Patch Batch · Mattermost · 2026-06-12 · 7 CVEs total
| CVE-2026-7387 | 8.8 HIGH | Mattermost group syncable endpoints allow privilege escalation via scheme_admin |
| CVE-2026-6961 | 7.6 HIGH | CVE-2026-6961: Path traversal via unsanitized FileInfo.Name in Mattermost federation sync |
| CVE-2026-6739 | 6.7 MEDIUM | Mattermost: Delegated admins could patch protected default system roles |
| CVE-2026-7184 | 6.5 MEDIUM | Mattermost Remote Cluster PATCH API Leaks Authentication Tokens |
| CVE-2026-6046 | 5.3 MEDIUM | Plugin bot username conflict allows user account to be used as bot identity in Mattermost |
| CVE-2026-6689 | 4.3 MEDIUM | *Missing* {{invite_user}} *permission check on team creation allows unprivileged users to |
IV. Related Vulnerabilities
Same product: Mattermost
-
CVE-2026-75587
Plaintext pre-auth secret exposure via Desktop App diagnosti -
CVE-2026-9693
Mattermost thread memberships persist after team removal, ex -
CVE-2026-9859
Mattermost Boards plugin didn’t enforce role-based authoriza -
CVE-2026-9816
Insufficient server-side validation of board member role fie -
CVE-2026-10080
Boards plugin panics on WebSocket command with non-string fi
Same vendor: Mattermost
-
CVE-2026-75587
Plaintext pre-auth secret exposure via Desktop App diagnosti -
CVE-2026-9693
Mattermost thread memberships persist after team removal, ex -
CVE-2026-9859
Mattermost Boards plugin didn’t enforce role-based authoriza -
CVE-2026-9816
Insufficient server-side validation of board member role fie -
CVE-2026-10080
Boards plugin panics on WebSocket command with non-string fi
Same weakness: CWE-200
-
CVE-2026-59256
WWBN AVideo Unbound Token Authorization Bypass via Gallery -
CVE-2026-56380
AVideo feed/index.php Exposure of Channel Owner Email Addres -
CVE-2026-48050
Arc: Unauthenticated access to Go debug pprof endpoints leak -
CVE-2026-34948
Combodo iTop: Access control bypass via OQL joins -
CVE-2026-53497
CrossWatch: Unauthenticated /api/app-auth/status endpoint le
V. Comments for CVE-2026-3433
No comments yet