FKIE_CVE-2026-4274

Vulnerability from fkie_nvd - Published: 2026-03-26 11:16 - Updated: 2026-03-26 18:48
Severity ?
5.4 (Medium) - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N
Summary
Mattermost versions 11.2.x <= 11.2.2, 10.11.x <= 10.11.10, 11.4.x <= 11.4.0, 11.3.x <= 11.3.1 fail to restrict team-level access when processing membership sync from a remote cluster, which allows a malicious remote cluster to grant a user access to an entire private team instead of only the shared channel via sending crafted membership sync messages that trigger team membership assignment. Mattermost Advisory ID: MMSA-2026-00574
References
responsibledisclosure@mattermost.comhttps://mattermost.com/security-updatesVendor Advisory
Impacted products
Vendor Product Version
mattermost mattermost_server *
mattermost mattermost_server *
mattermost mattermost_server *
mattermost mattermost_server *
To clipboard 

{
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:mattermost:mattermost_server:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "B6E5F368-358C-429B-8F04-3C8DF4A71A91",
              "versionEndExcluding": "10.11.11",
              "versionStartIncluding": "10.11.0",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:mattermost:mattermost_server:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "7F64C167-943D-4F3F-9374-BCC8DECB3881",
              "versionEndExcluding": "11.2.3",
              "versionStartIncluding": "11.2.0",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:mattermost:mattermost_server:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "805ECFFC-82FD-4754-AF95-32167E1D41CB",
              "versionEndExcluding": "11.3.2",
              "versionStartIncluding": "11.3.0",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:mattermost:mattermost_server:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "839BC7B7-28DF-4125-937A-8B0D2D6893C2",
              "versionEndExcluding": "11.4.1",
              "versionStartIncluding": "11.4.0",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Mattermost versions 11.2.x \u003c= 11.2.2, 10.11.x \u003c= 10.11.10, 11.4.x \u003c= 11.4.0, 11.3.x \u003c= 11.3.1 fail to restrict team-level access when processing membership sync from a remote cluster, which allows a malicious remote cluster to grant a user access to an entire private team instead of only the shared channel via sending crafted membership sync messages that trigger team membership assignment. Mattermost Advisory ID: MMSA-2026-00574"
    },
    {
      "lang": "es",
      "value": "Versiones de Mattermost 11.2.x hasta 11.2.2, 10.11.x hasta 10.11.10, 11.4.x hasta 11.4.0, 11.3.x hasta 11.3.1 no restringen el acceso a nivel de equipo al procesar la sincronizaci\u00f3n de membres\u00eda desde un cl\u00faster remoto, lo que permite a un cl\u00faster remoto malicioso otorgar a un usuario acceso a un equipo privado completo en lugar de solo al canal compartido mediante el env\u00edo de mensajes de sincronizaci\u00f3n de membres\u00eda manipulados que desencadenan la asignaci\u00f3n de membres\u00eda de equipo. ID de Aviso de Mattermost: MMSA-2026-00574"
    }
  ],
  "id": "CVE-2026-4274",
  "lastModified": "2026-03-26T18:48:39.737",
  "metrics": {
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "NONE",
          "baseScore": 5.4,
          "baseSeverity": "MEDIUM",
          "confidentialityImpact": "LOW",
          "integrityImpact": "LOW",
          "privilegesRequired": "LOW",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N",
          "version": "3.1"
        },
        "exploitabilityScore": 2.8,
        "impactScore": 2.5,
        "source": "responsibledisclosure@mattermost.com",
        "type": "Secondary"
      }
    ]
  },
  "published": "2026-03-26T11:16:21.257",
  "references": [
    {
      "source": "responsibledisclosure@mattermost.com",
      "tags": [
        "Vendor Advisory"
      ],
      "url": "https://mattermost.com/security-updates"
    }
  ],
  "sourceIdentifier": "responsibledisclosure@mattermost.com",
  "vulnStatus": "Analyzed",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-863"
        }
      ],
      "source": "responsibledisclosure@mattermost.com",
      "type": "Secondary"
    }
  ]
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Detection rules are retrieved from Rulezet.