CVE-2026-3433: Mattermost Server Info Disclosure Flaw

CVE-2026-3433 Overview

CVE-2026-3433 is an information disclosure vulnerability in Mattermost Server. The flaw resides in the role_updated websocket event broadcast logic, which fails to restrict notifications to legitimate team or channel members. An authenticated attacker holding guest-level access can observe permission scheme change notifications for private teams they do not belong to. The issue is tracked under Mattermost Advisory ID MMSA-2026-00616 and is classified under [CWE-200] Exposure of Sensitive Information to an Unauthorized Actor. The vulnerability affects multiple Mattermost release branches and requires only a low-privileged authenticated session over the network to exploit.

Critical Impact
Guest-level authenticated users can passively collect permission scheme change events for private teams and channels they are not members of, exposing internal access control activity.

Affected Products

Mattermost Server 11.6.x through 11.6.1
Mattermost Server 11.5.x through 11.5.4
Mattermost Server 10.11.x through 10.11.15 and 10.11.16

Discovery Timeline

2026-06-12 - CVE-2026-3433 published to NVD
2026-06-18 - Last updated in NVD database

Technical Details for CVE-2026-3433

Vulnerability Analysis

Mattermost uses websocket connections to push real-time events to connected clients. The role_updated event signals that a permission scheme tied to a team or channel role has been modified. The server is expected to scope these broadcasts so that only members of the affected team or channel receive the notification. In the affected versions, the broadcast filter fails to enforce this membership boundary. As a result, any authenticated user with an active websocket session, including guest accounts, receives role_updated events for private teams and channels regardless of membership.

The disclosed information is metadata about permission changes rather than message content. However, this still leaks the existence of private teams, the timing of administrative role changes, and indicators of internal restructuring activity. The vulnerability falls under [CWE-200] Information Exposure.

Root Cause

The root cause is a missing authorization check on the server-side broadcast routing for the role_updated websocket event. Mattermost's event dispatcher relies on broadcast scope filters such as team ID and channel ID to determine recipients. For this specific event type, the filter was either absent or evaluated against an overly permissive audience, causing the server to fan out the notification to all connected websocket clients rather than the membership set.

Attack Vector

The attack vector is network-based and requires guest-level authentication. An attacker establishes a standard websocket connection to the Mattermost server using legitimate credentials. The attacker then passively listens for inbound role_updated events. When an administrator updates the permission scheme of any team or channel on the server, the event payload is delivered to the attacker's socket. No user interaction is required, and no special tooling beyond a Mattermost client or scripted websocket consumer is needed. The attack does not modify data and does not affect availability, but it provides ongoing visibility into administrative changes across tenants the attacker should not see.

No public proof-of-concept exploit is currently available, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog.

Detection Methods for CVE-2026-3433

Indicators of Compromise

Guest accounts maintaining unusually long-lived websocket sessions with no corresponding channel activity.
Websocket clients receiving role_updated events that reference team or channel IDs the user is not a member of.
Audit log entries showing permission scheme changes correlated in time with guest-account websocket traffic spikes.

Detection Strategies

Inspect server-side websocket dispatch logs for role_updated events and correlate recipient user IDs against team and channel membership tables.
Review Mattermost audit logs for guest accounts that exhibit broad connectivity patterns inconsistent with their assigned teams.
Apply network monitoring to identify automated websocket consumers establishing persistent sessions from low-privileged accounts.

Monitoring Recommendations

Enable verbose audit logging for permission scheme and role update operations to support post-incident correlation.
Track the volume of websocket events delivered per session and alert on outliers among guest-tier accounts.
Forward Mattermost logs to a centralized SIEM and build queries that flag role_updated deliveries crossing team membership boundaries.

How to Mitigate CVE-2026-3433

Immediate Actions Required

Upgrade Mattermost Server to a fixed release above 11.6.1, 11.5.4, or 10.11.16 as published in the Mattermost security updates page.
Audit existing guest accounts and remove any that are no longer required, reducing the population of accounts able to trigger this exposure.
Review recent permission scheme changes for private teams and assess whether the metadata leak materially affects ongoing engagements.

Patch Information

Mattermost has issued fixes via its standard security release cycle. Refer to the Mattermost Security Updates page for the exact patched versions tied to advisory MMSA-2026-00616 and apply the upgrade path that matches your deployed release branch.

Workarounds

Restrict the use of guest accounts on servers hosting sensitive private teams until the patch is applied.
Limit network access to the Mattermost websocket endpoint so that only trusted users can establish event subscriptions.
Defer non-urgent permission scheme changes on private teams until the server has been upgraded to a fixed version.

bash

# Verify the installed Mattermost Server version before and after patching
mattermost version

# Example upgrade pattern (adjust to your deployment method)
sudo systemctl stop mattermost
sudo cp -r /opt/mattermost /opt/mattermost-backup-$(date +%F)
# Replace binaries with the patched release per Mattermost upgrade guide
sudo systemctl start mattermost