CVE-2026-3524highCWE-862

Authorization Bypass in Mattermost Legal Hold Plugin Due to Missing Return After Permission Check

21Vexday Risk Score

Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.

ssvc Trackcvss 8.3epss 0.4%

probabilidade de exploração

0.4%top 68% das CVEs

exploração observada

nãonenhuma fonte reporta

Mattermost Plugin Legal Hold versions <=1.1.4 fail to halt request processing after a failed authorization check in ServeHTTP which allows an authenticated attacker to access, create, download, and delete legal hold data via crafted API requests to the plugin's endpoints. Mattermost Advisory ID: MMSA-2026-00621

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Produtos afetados

Mattermost · Mattermost

Referências

https://mattermost.com/security-updates