CVE-2026-24692: Mattermost fails to properly enforce read permissions in search API endpoints

March 16, 2026 (updated March 18, 2026)

Mattermost versions 11.3.x <= 11.3.0, 11.2.x <= 11.2.2, 10.11.x <= 10.11.10 fail to properly enforce read permissions in search API endpoints which allows guest users without read permissions to access posts and files in channels via search API requests. Mattermost Advisory ID: MMSA-2025-00554

References

github.com/advisories/GHSA-cwfj-642j-gfh4
github.com/mattermost/mattermost
github.com/mattermost/mattermost/commit/0481bd1fb04584db97eca45fd58ebd06c8200df4
mattermost.com/security-updates
nvd.nist.gov/vuln/detail/CVE-2026-24692

Code Behaviors & Features

Detect and mitigate CVE-2026-24692 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Learn more about Dependency Scanning →