---
id: "CVE-2026-18256"
kind: "vulnerability"
aliases: ["CVE-2026-18256"]
title: "Mattermost: private team names exposed through public team search"
severity: "medium"
cvss: 4.3
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["chat", "mattermost", "package", "self-hosted"]
not_affected_if: ["fixed-version", "managed-hosting"]
published_at: "2026-10-16T08:17:12+00:00"
first_seen_at: "2026-10-23T21:57:12+00:00"
updated_at: "2026-10-25T04:41:08+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-18256", "first_seen_at": "2026-10-23T21:57:12+00:00"}]
---

# Mattermost: private team names exposed through public team search

Mattermost fails to hide private teams from public team search results. An authenticated user can use a modified team search request to list private team IDs, names and display names.

_Summary, check and fix written by a model from the sources; labelled as such._

## Fix

Upgrade Mattermost to a release newer than the affected lines: 11.10.0 or later for 11.10.x, 11.7.9 or later for 11.7.x, 11.9.1 or later for 11.9.x, 11.8.5 or later for 11.8.x, as listed in MMSA-2026-00748.

## Timeline

- 2026-10-23T21:57:12+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-18256

## From the sources

Mattermost versions 11.10.x <= 11.10.0, 11.7.x <= 11.7.9, 11.9.x <= 11.9.1, 11.8.x <= 11.8.5 fail to properly restrict private teams from public team search results, which allows an authenticated user without permission to list private teams to disclose the ID, name, and display name of private teams via a modified team search request. Mattermost Advisory ID: MMSA-2026-00748

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_