CVE-2026-2458: Mattermost Server Info Disclosure Flaw

CVE-2026-2458 Overview

CVE-2026-2458 is a missing authorization vulnerability [CWE-862] in Mattermost Server. The flaw allows a user who has been removed from a team to enumerate all public channels within that private team. The issue resides in the channel search API endpoint, which fails to properly validate team membership before returning results. Mattermost tracks this issue under advisory MMSA-2025-00568.

The vulnerability affects Mattermost versions 11.3.x <= 11.3.0, 11.2.x <= 11.2.2, and 10.11.x <= 10.11.10. Exploitation requires low-privilege authenticated access and produces a confidentiality impact limited to channel metadata disclosure.

Critical Impact
Removed team members can continue to enumerate public channels in a private Mattermost team through the channel search API, exposing organizational structure and project information.

Affected Products

Mattermost Server 11.3.x up to and including 11.3.0
Mattermost Server 11.2.x up to and including 11.2.2
Mattermost Server 10.11.x up to and including 10.11.10

Discovery Timeline

2026-03-16 - CVE-2026-2458 published to NVD
2026-03-18 - Last updated in NVD database

Technical Details for CVE-2026-2458

Vulnerability Analysis

The vulnerability is a Broken Access Control flaw classified under [CWE-862] Missing Authorization. Mattermost organizes collaboration into teams, and private teams restrict visibility of their channels to current team members. The channel search API endpoint enforces authentication but does not re-validate team membership when handling search queries against a team's channel list.

As a result, a user who was previously a member of a private team retains the ability to query that team's public channels through the search endpoint. Although the user cannot view channel contents, the names, identifiers, and metadata of public channels remain enumerable. This breaks the expected confidentiality boundary that team removal should establish.

The impact is limited to disclosure of channel information rather than messages or files. There is no integrity or availability impact, and no exploit is currently public.

Root Cause

The root cause is an authorization check omission in the channel search code path. Membership validation occurs at team join and channel list rendering but not on the search endpoint, leaving the search handler reliant on stale authorization state.

Attack Vector

An attacker must hold valid Mattermost credentials and have previously been a member of the targeted private team. After removal, the attacker issues authenticated requests to the channel search API for that team and receives the list of matching public channels. No user interaction or elevated privileges are required.

No verified exploit code is available. Refer to the Mattermost Security Updates advisory for technical details.

Detection Methods for CVE-2026-2458

Indicators of Compromise

Authenticated channel search API calls originating from user accounts that were recently removed from the targeted team.
Repeated channel search queries against a single team identifier within short time windows, indicating enumeration behavior.
Access patterns where a user account queries team resources after team membership revocation events appear in audit logs.

Detection Strategies

Correlate Mattermost audit log events for team member removal with subsequent API access to channel search endpoints by the same user.
Alert on anomalous volumes of channel search requests per user per team, particularly from accounts without current membership in that team.
Review web server and reverse proxy logs for repeated requests to channel search routes followed by short-interval pagination patterns.

Monitoring Recommendations

Forward Mattermost application and audit logs to a centralized SIEM for correlation with identity lifecycle events.
Establish a baseline of channel search API usage per user and flag deviations exceeding that baseline.
Monitor for any post-offboarding API activity on Mattermost from users whose roles have changed, including team removals.

How to Mitigate CVE-2026-2458

Immediate Actions Required

Upgrade Mattermost Server to a version released after 11.3.0, 11.2.2, or 10.11.10 on the respective release branches.
Audit recent team membership changes and review channel search API logs for activity by removed users.
Rotate or revoke session tokens for users who have been removed from sensitive private teams.

Patch Information

Mattermost has released fixed versions on the 11.3.x, 11.2.x, and 10.11.x branches. Administrators should consult the Mattermost Security Updates page for the exact patched version numbers and apply updates following the documented upgrade procedure.

Workarounds

Where immediate upgrade is not possible, deactivate user accounts rather than only removing them from teams to terminate API access.
Restrict access to the Mattermost API at the network or reverse proxy layer for users who have been offboarded.
Convert highly sensitive public channels within private teams to private channels to limit exposure through search.

bash

# Configuration example: verify current Mattermost server version before patching
mattermost version

# After upgrading, confirm the new version is on a fixed release branch
curl -s https://<mattermost-host>/api/v4/system/ping?get_server_status=true