CVE-2026-3113
Medium
Low
Medium
High
Critical
5.0
CVSS Score
Vulnerability Description
Mattermost versions 11.4.x <= 11.4.0, 11.3.x <= 11.3.1, 11.2.x <= 11.2.3, 10.11.x <= 10.11.11 fail to set permissions on downloaded bulk export which allows other local users on the server to be able to read contents of the bulk export.. Mattermost Advisory ID: MMSA-2026-00593
CVSS Metrics
Common Vulnerability Scoring System
Vector String:
CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N
Attack Vector
L
Attack Complexity
L
Privileges Required
L
User Interaction
R
Scope
U
Confidentiality
H
Integrity
N
Availability
N
Known Affected Software
11 configuration(s) from 1 vendor(s)
mattermost_server
Version:
10.11.2
CPE:
cpe:2.3:a:mattermost:mattermost_server:10.11.2:-:*:*:*:*:*:*
mattermost_server
Version:
10.11.1
CPE:
cpe:2.3:a:mattermost:mattermost_server:10.11.1:-:*:*:*:*:*:*
mattermost_server
Version:
10.11.4
CPE:
cpe:2.3:a:mattermost:mattermost_server:10.11.4:-:*:*:*:*:*:*
mattermost_server
Version:
10.11.0
CPE:
cpe:2.3:a:mattermost:mattermost_server:10.11.0:-:*:*:*:*:*:*
mattermost_server
Version:
10.11.6
CPE:
cpe:2.3:a:mattermost:mattermost_server:10.11.6:*:*:*:*:*:*:*
mattermost_server
Version:
11.2.0
CPE:
cpe:2.3:a:mattermost:mattermost_server:11.2.0:rc1:*:*:*:*:*:*
mattermost_server
Version:
10.11.8
CPE:
cpe:2.3:a:mattermost:mattermost_server:10.11.8:*:*:*:*:*:*:*
mattermost_server
Version:
10.11.5
CPE:
cpe:2.3:a:mattermost:mattermost_server:10.11.5:*:*:*:*:*:*:*
mattermost_server
Version:
10.11.3
CPE:
cpe:2.3:a:mattermost:mattermost_server:10.11.3:*:*:*:*:*:*:*
mattermost_server
Version:
11.4.0
CPE:
cpe:2.3:a:mattermost:mattermost_server:11.4.0:*:*:*:*:*:*:*
mattermost_server
Version:
10.11.7
CPE:
cpe:2.3:a:mattermost:mattermost_server:10.11.7:*:*:*:*:*:*:*
This vulnerability affects 11 software configuration(s). Ensure you patch all affected systems.
References & Resources
Severity Details
5.0
out of 10.0
Medium
Weakness Type (CWE)
CWE-732
Incorrect Permission Assignment for Critical Resource
- Description
- The product specifies permissions for a security-critical resource in a way that allows that resource to be read or modified by unintended actors.
- Exploit Likelihood
- High
- Typical Severity
- High
- Abstraction Level
- Class
Key Information
- Published Date
- March 26, 2026
