Live › vulnerability › CVE-2026-18256
Go to dashboardMattermost fails to hide private teams from public team search results. An authenticated user can use a modified team search request to list private team IDs, names and display names.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Self-hosted or managed Mattermost servers on the listed affected versions where users can log in. The flaw discloses only metadata about private teams (ID, name, display name), not messages or files. Servers already on a fixed release are not affected.
No product ranges from the sources yet.
Unknown from the sources.
Upgrade Mattermost to a release newer than the affected lines: 11.10.0 or later for 11.10.x, 11.7.9 or later for 11.7.x, 11.9.1 or later for 11.9.x, 11.8.5 or later for 11.8.x, as listed in MMSA-2026-00748.
Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Mattermost versions 11.10.x <= 11.10.0, 11.7.x <= 11.7.9, 11.9.x <= 11.9.1, 11.8.x <= 11.8.5 fail to properly restrict private teams from public team search results, which allows an authenticated user without permission to list private teams to disclose the ID, name, and display name of private teams via a modified team search request. Mattermost Advisory ID: MMSA-2026-00748
This page as .md · .json · in your agent: get_signal("CVE-2026-18256")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.