CVE-2026-3433 Details
Description
Mattermost versions 11.6.x <= 11.6.1, 11.5.x <= 11.5.4, 10.11.x <= 10.11.15, 10.11.x <= 10.11.16 fail to restrict role_updated websocket event broadcasts to members of the affected team or channel which allows an authenticated attacker with guest-level access to observe permission scheme change notifications for private teams they are not a member of via the websocket connection.. Mattermost Advisory ID: MMSA-2026-00616
A vulnerability exists in Mattermost versions 11.6.0 prior to 11.6.1, 11.5.0 prior to 11.5.4, and 10.11.0 prior to 10.11.16. The issue arises because the application fails to properly restrict the broadcasting of role update WebSocket events to only those members of the relevant team or channel. This flaw allows an authenticated attacker with guest-level access to intercept and observe notifications about changes in the permission scheme for private teams to which they do not belong, through the WebSocket connection.
Users can upgrade to Mattermost versions 11.7.0, 11.5.7, or 10.11.18 to address this vulnerability.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Jun 12, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://mattermost.com/security-updates | [email protected] | Vendor Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-200 | Exposure of Sensitive Information to an Unauthorized Actor | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| mattermost mattermost server | >= 10.11.0, < 10.11.17 >= 11.5.0, < 11.5.5 >= 11.6.0, < 11.6.2 |
CPE
Remediation
| |
Change History
4 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 18, 2026 | Initial Analysis | [email protected] |
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Jun 12, 2026 | New CVE Received | [email protected] |