4.3

CVE-2026-3433: mattermost

CVSS: 4.3v3.1MediumAnalyzed
AliasesGHSA-rp4v-qc77-phm4GO-2026-6286
Published 12-06-2026Last modified 12-06-2026
Open JSON

Vulnerability summary

CVE-2026-3433 is a medium (CVSS 4.3) vulnerability in mattermost. EPSS estimates a 0.30% chance of exploitation in the next 30 days, higher than 21.6% of scored vulnerabilities.

Overall risk
17/100
0100
Low · default modelHow is this calculated?
CVSS score
4.3/10
010
Medium · v3.1 (CVE.org)
EPSS score
0.30%
0%100%
Low · +0.12 pp in 30 days
KEVNot listedIn no KEV catalog
RansomwareNone recordedNo known use recorded
Public exploits0No public exploits recorded

Advisory lineage

Upstream 0 · Downstream 2 · Related 2
OPENSUSE-SU-2026:21761-1SUSE-SU-2026:23625-1

Timeline

  1. 12-06-2026
    PublishedVulnerability first disclosed.
  2. 12-06-2026
    Last modifiedVulnerability information updated.

Description

Mattermost versions 11.6.x <= 11.6.1, 11.5.x <= 11.5.4, 10.11.x <= 10.11.15, 10.11.x <= 10.11.16 fail to restrict role_updated websocket event broadcasts to members of the affected team or channel which allows an authenticated attacker with guest-level access to observe permission scheme change notifications for private teams they are not a member of via the websocket connection.. Mattermost Advisory ID: MMSA-2026-00616

CVSS metrics

3 scores · 3 sources · 1 version

EPSS trend

Probability

0.30%

Chance of exploitation in the next 30 days

Percentile

22%

Versus all other CVEs

30-day change

+0.12 pp

From 0.18% on 21-09-2026

21-09-202621-10-2026
EPSS score
0.30%

Known exploited

Compare KEV catalogs

Not in any of the 3 tracked catalogs.

Public exploits

0 found

No public exploits indexed.

Weaknesses

CWE · root cause

Affected systems

Github.com/mattermost/mattermost-server2 products
  • v5All versions (No fix recorded)
  • v6All versions (No fix recorded)
Mattermost2 products
  • mattermost≥ 11.6.0, ≤ 11.6.1 | ≥ 11.5.0, ≤ 11.5.4 | ≥ 10.11.0, ≤ 10.11.15 | ≥ 10.11.0, ≤ 10.11.16
  • mattermost_server≥ 10.11.0, < 10.11.17 | ≥ 11.5.0, < 11.5.5 | ≥ 11.6.0, < 11.6.2
Github.com/mattermost1 product
  • mattermost-server≥ 11.6.0, < 11.6.1 | ≥ 11.5.0, < 11.5.5 | ≥ 10.11.0, < 10.11.17 | ≥ 11.6.0+incompatible, < 11.6.1+incompatible
Github.com/mattermost/mattermost/server1 product
  • v8≥ 8.0.0-20250731163400-5b955468ea1e, < 8.0.0-20260504071740-9408b98025d7

4 vendors · 6 products

References

16 links
Show all 16 references