Non évaluée
Guest users can bypass read permissions via search API
CVE-2026-24692
Première détection SecPulse
Description d'origine La description telle que publiée par la source (souvent en anglais).
Mattermost versions 11.3.x <= 11.3.0, 11.2.x <= 11.2.2, 10.11.x <= 10.11.10 fail to properly enforce read permissions in search API endpoints which allows guest users without read permissions to access posts and files in channels via search API requests. Mattermost Advisory ID: MMSA-2025-00554
Source: OSV.dev (Open Source Vulnerabilities) NVD GitHub Advisory OSV
Références
- advisory github.com
- advisory mattermost.com
- advisory nvd.nist.gov