Signal is active with 2 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
Mattermost versions 11.2.x <= 11.2.2, 10.11.x <= 10.11.10, 11.4.x <= 11.4.0, 11.3.x <= 11.3.1 fail to apply view restrictions when retrieving group member IDs, which allows authenticated guest users to enumerate user IDs outside their allowed visibility scope via the group retrieval endpoint.. Mattermost Advisory ID: MMSA-2026-00594
Priority
LOW
Exploitation
NONE
PoC
NONE
Patch
NONE
Momentum
NONE
If you run products in this scope, you should treat this CVE as relevant to your environment.
1 version affected across 1 product
CVE-2026-3115 Mattermost versions 11.2.x <= 11.2.2, 10.11.x <= 10.11.10, 11.4.x <= 11.4.0, 11.3.x <= 11.3.1 fail to apply view restrictions when retrieving group member IDs, which al… https://www.cve.org/CVERecord?id=CVE-2026-3115
Post summary
The CVE describes a failure in Mattermost to enforce view restrictions when retrieving group member IDs, potentially exposing sensitive data.
🚨*CVE* CVE-2026-3115 Mattermost versions 11.2.x <= 11.2.2, 10.11.x <= 10.11.10, 11.4.x <= 11.4.0, 11.3.x <= 11.3.1 fail to apply view restrictions when retrieving group member IDs, which al… https://www.cve.org/CVERecord?id=CVE-2026-3115 ----- Traducción: CVE-2026-3115 Mat… http://infoflow.cloud`
Post summary
A notice about a newly disclosed Mattermost vulnerability that fails to enforce view restrictions on group member ID retrieval, with no exploit or patch details, and no indication of active exploitation.
2 of 2 entries
| Part | Vendor | Product | Version | Target SW | Target HW |
|---|---|---|---|---|---|
| App | mattermost | mattermost_server | - | - | - |
| App | mattermost | mattermost_server | 11.4.0 | - | - |