{"id":"CVE-2026-18256","kind":"vulnerability","aliases":["CVE-2026-18256"],"related":[],"title":"Mattermost: private team names exposed through public team search","description":"Mattermost versions 11.10.x <= 11.10.0, 11.7.x <= 11.7.9, 11.9.x <= 11.9.1, 11.8.x <= 11.8.5 fail to properly restrict private teams from public team search results, which allows an authenticated user without permission to list private teams to disclose the ID, name, and display name of private teams via a modified team search request. Mattermost Advisory ID: MMSA-2026-00748","summary":"Mattermost fails to hide private teams from public team search results. An authenticated user can use a modified team search request to list private team IDs, names and display names.","severity":"medium","cvss":4.3,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["chat","mattermost","package","self-hosted"],"not_affected_if":["fixed-version","managed-hosting"],"how_to_check":null,"fix":"Upgrade Mattermost to a release newer than the affected lines: 11.10.0 or later for 11.10.x, 11.7.9 or later for 11.7.x, 11.9.1 or later for 11.9.x, 11.8.5 or later for 11.8.x, as listed in MMSA-2026-00748.","status":"open","published_at":"2026-10-16T08:17:12+00:00","first_seen_at":"2026-10-23T21:57:12+00:00","triaged_at":"2026-10-25T04:41:08+00:00","updated_at":"2026-10-25T04:41:08+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-10-25T04:41:08Z","model":"claude-haiku-5-5","output":{"fix":"Upgrade Mattermost to a release newer than the affected lines: 11.10.0 or later for 11.10.x, 11.7.9 or later for 11.7.x, 11.9.1 or later for 11.9.x, 11.8.5 or later for 11.8.x, as listed in MMSA-2026-00748.","reach":"internet","title":"Mattermost: private team names exposed through public team search","impact":"low","summary":"Mattermost fails to hide private teams from public team search results. An authenticated user can use a modified team search request to list private team IDs, names and display names.","category":"package","nicknames":[],"who_cares":["mattermost","self-hosted","chat"],"confidence":0.6,"needs_auth":"yes","worst_case":"Authenticated users learn names and IDs of private teams","analyst_note":"Check the Mattermost advisory MMSA-2026-00748 for the exact fixed versions and whether a non-default setting is required.","how_to_check":"unknown","needs_analyst":true,"not_affected_if":["fixed-version","managed-hosting"],"who_is_affected":"Self-hosted or managed Mattermost servers on the listed affected versions where users can log in. The flaw discloses only metadata about private teams (ID, name, display name), not messages or files. Servers already on a fixed release are not affected.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.000586,"input_tokens":3401,"output_tokens":491,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-00748':110C '-18256':12A,15A '-2026':11A,14A,109C '11.10':54C '11.10.0':56C '11.7':57C '11.7.9':59C '11.8':63C '11.8.5':65C '11.9':60C '11.9.1':62C 'advisori':106C 'allow':78C 'authent':34B,80C 'chat':16B 'cve':10A,13A 'disclos':89C 'display':50B,94C 'expos':5A 'fail':23B,66C 'hide':25B 'host':21B 'id':47B,91C,107C 'list':44B,85C 'mattermost':1A,17B,22B,52C,105C 'mmsa':108C 'modifi':39B,101C 'name':4A,48B,51B,92C,95C 'packag':18B 'permiss':83C 'privat':2A,26B,45B,70C,86C,97C 'proper':68C 'public':7A,29B,73C 'request':42B,104C 'restrict':69C 'result':32B,76C 'search':9A,31B,41B,75C,103C 'self':20B 'self-host':19B 'team':3A,8A,27B,30B,40B,46B,71C,74C,87C,98C,102C 'use':37B 'user':35B,81C 'version':53C 'via':99C 'without':82C 'x':55C,58C,61C,64C","nicknames":[],"mitigations":[],"who_affected":"Self-hosted or managed Mattermost servers on the listed affected versions where users can log in. The flaw discloses only metadata about private teams (ID, name, display name), not messages or files. Servers already on a fixed release are not affected.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-16T08:17:12+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","cvss_by":"responsibledisclosure@mattermost.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-18256","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-18256","severity":null,"published_at":"2026-10-16T08:17:12+00:00","modified_at":"2026-10-16T19:23:18+00:00","first_seen_at":"2026-10-23T21:57:12+00:00","fetched_at":"2026-10-23T22:28:55+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}