CVE-2026-3115: Mattermost Auth Bypass Vulnerability

CVE-2026-3115 Overview

CVE-2026-3115 is an authorization bypass vulnerability in Mattermost that fails to apply view restrictions when retrieving group member IDs. This weakness allows authenticated guest users to enumerate user IDs outside their allowed visibility scope via the group retrieval endpoint, potentially exposing sensitive user information to unauthorized parties.

Critical Impact

Authenticated guest users can enumerate user IDs beyond their authorized visibility scope, enabling reconnaissance and potential targeted attacks against users who should be hidden from guest access.

Affected Products

• Mattermost 11.2.x versions <= 11.2.2
• Mattermost 10.11.x versions <= 10.11.10
• Mattermost 11.4.x versions <= 11.4.0
• Mattermost 11.3.x versions <= 11.3.1

Discovery Timeline

• 2026-03-26 - CVE CVE-2026-3115 published to NVD
• 2026-03-26 - Last updated in NVD database

Technical Details for CVE-2026-3115

Vulnerability Analysis

This vulnerability is classified under CWE-863 (Incorrect Authorization), which occurs when software does not perform or incorrectly performs an authorization check when an actor attempts to access a resource or perform an action. In this case, Mattermost's group retrieval endpoint fails to enforce proper view restrictions for guest users when returning group member IDs.

The flaw enables authenticated guest users to bypass intended visibility controls and enumerate user IDs that should be restricted from their view. Guest accounts in Mattermost are typically configured with limited permissions and restricted visibility to protect sensitive organizational information. This vulnerability undermines those security boundaries.

Root Cause

The root cause is improper authorization logic in the group member ID retrieval functionality. When processing requests to the group retrieval endpoint, the application fails to apply the appropriate view restrictions that should limit guest users from accessing user IDs outside their authorized scope. The authorization check is either missing or improperly implemented for this specific endpoint.

Attack Vector

The attack is network-based and requires low privileges (authenticated guest account) with no user interaction needed. An attacker with valid guest credentials can exploit this vulnerability by:

1. Authenticating to the Mattermost instance as a guest user
2. Making API requests to the group retrieval endpoint
3. Extracting user IDs from the response that should be hidden from guest visibility
4. Using the enumerated user IDs for reconnaissance or further attacks

The exploitation mechanism involves sending crafted requests to the group retrieval endpoint. The vulnerable endpoint returns group member IDs without properly checking if the requesting guest user should have visibility into those specific users. This allows guest users to build a list of user IDs across the organization, even for users they should not be able to see.

Detection Methods for CVE-2026-3115

Indicators of Compromise

• Unusual API request patterns from guest accounts to group retrieval endpoints
• High-volume queries to group membership endpoints from single guest sessions
• Guest user accounts accessing groups or channels they are not members of
• Anomalous enumeration behavior in API access logs

Detection Strategies

• Monitor API access logs for guest users making excessive calls to group-related endpoints
• Implement rate limiting alerts for group member retrieval requests
• Review authentication logs for guest accounts with suspicious activity patterns
• Deploy API anomaly detection to identify enumeration attempts

Monitoring Recommendations

• Enable detailed logging for all group retrieval API endpoints
• Set up alerts for guest users accessing group membership data at abnormal rates
• Implement user behavior analytics to detect reconnaissance patterns
• Review audit logs regularly for unauthorized data access attempts

How to Mitigate CVE-2026-3115

Immediate Actions Required

• Upgrade Mattermost to patched versions immediately
• Review guest account permissions and restrict unnecessary group access
• Audit logs for evidence of exploitation attempts
• Consider temporarily restricting guest access to group features until patched

Patch Information

Mattermost has released security updates to address this vulnerability. Organizations should upgrade to versions beyond the affected ranges:

• Upgrade 11.2.x installations to versions later than 11.2.2
• Upgrade 10.11.x installations to versions later than 10.11.10
• Upgrade 11.4.x installations to versions later than 11.4.0
• Upgrade 11.3.x installations to versions later than 11.3.1

For detailed patch information and download links, refer to the Mattermost Security Updates page.

Workarounds

• Restrict guest account creation until patches can be applied
• Implement network-level restrictions to limit guest API access
• Use API gateway rules to block or monitor group retrieval endpoint access from guest accounts
• Review and tighten guest user visibility settings in Mattermost configuration

# Configuration example
# Restrict guest permissions in Mattermost config.json
# Locate the GuestAccountsSettings section and review visibility settings

# Example: Disable guest account access temporarily
sudo mmctl config set GuestAccountsSettings.Enable false

# After applying patches, re-enable with proper restrictions
sudo mmctl config set GuestAccountsSettings.Enable true
sudo mmctl config set GuestAccountsSettings.RestrictCreationToDomains "trusted-domain.com"