CVE-2026-18256mediumCWE-863

CVE-2026-18256: medium-severity vulnerability in Mattermost

Private team metadata disclosure via the team search API

Published

Follow this CVE+ Monitor Mattermost

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

13Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 4.3epss 0.2%
Mattermost versions 11.10.x <= 11.10.0, 11.7.x <= 11.7.9, 11.9.x <= 11.9.1, 11.8.x <= 11.8.5 fail to properly restrict private teams from public team search results, which allows an authenticated user without permission to list private teams to disclose the ID, name, and display name of private teams via a modified team search request. Mattermost Advisory ID: MMSA-2026-00748
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Affected products
Mattermost · Mattermost
Related CVEs — Mattermost

In the same product, most dangerous first.

CVE-2025-25279CRITICALArbitrary file read in Mattermost Boards via import & export board archiveEPSS 24.2%CVE-2021-37859HIGHReflected XSS in OAuth FlowEPSS 3.3%CVE-2022-3257LOWServer-side Denial of Service while processing a specifically crafted GIF fileEPSS 1.3%CVE-2022-4044MEDIUMAuthenticated user could send multiple requests containing a large Auto Responder Message payload and can crash a Mattermost serverEPSS 1.1%CVE-2022-3147LOWServer-side Denial of Service while processing a specifically crafted JPEG fileEPSS 1.0%CVE-2025-4981CRITICALPath Traversal Leading to RCE by Any Authenticated Mattermost UserEPSS 1.0%