{"id":"EUVD-2026-36498","enisaUuid":"2a5efb49-4c7b-3265-8d44-6fe1cff02dc6","description":"Mattermost versions 11.6.x \u003c\u003d 11.6.1, 11.5.x \u003c\u003d 11.5.4, 10.11.x \u003c\u003d 10.11.15, 10.11.x \u003c\u003d 10.11.16 fail to restrict role_updated websocket event broadcasts to members of the affected team or channel which allows an authenticated attacker with guest-level access to observe permission scheme change notifications for private teams they are not a member of via the websocket connection.. Mattermost Advisory ID: MMSA-2026-00616","datePublished":"Jun 12, 2026, 3:46:54 PM","dateUpdated":"Jun 12, 2026, 5:19:49 PM","baseScore":4.3,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","references":"https://mattermost.com/security-updates\n","aliases":"CVE-2026-3433\nGHSA-rp4v-qc77-phm4\n","assigner":"Mattermost","epss":0.18,"enisaIdProduct":[{"id":"7bd9e932-bd83-3f5d-b78d-4d8097edb247","product":{"name":"Mattermost","vendor":{"name":"Mattermost"}},"product_version":"10.11.0 ≤10.11.15"},{"id":"838ccc8c-94fa-3991-8a81-9dee5c5618bf","product":{"name":"Mattermost","vendor":{"name":"Mattermost"}},"product_version":"11.6.0 ≤11.6.1"},{"id":"c5a129d5-2971-3a50-a70d-1acb4733678e","product":{"name":"Mattermost","vendor":{"name":"Mattermost"}},"product_version":"10.11.0 ≤10.11.16"},{"id":"e99bc608-82c3-372a-8162-f639b40132d4","product":{"name":"Mattermost","vendor":{"name":"Mattermost"}},"product_version":"11.5.0 ≤11.5.4"}],"enisaIdVendor":[{"id":"a8b64864-3663-3296-affc-9d3219f1b731","vendor":{"name":"Mattermost"}}],"enisaIdVulnerability":[{"id":"2f294885-b6f2-3856-9db3-48cc5b87a21f","vulnerability":{"id":"GHSA-rp4v-qc77-phm4","description":"Mattermost doesn\u0027t restrict role_updated websocket event broadcasts to members of the affected team or channel","datePublished":"Jun 12, 2026, 6:31:59 PM","dateUpdated":"Aug 24, 2026, 9:30:50 PM","baseScore":0.0,"references":"https://nvd.nist.gov/vuln/detail/CVE-2026-3433\nhttps://github.com/mattermost/mattermost/pull/35497\nhttps://github.com/mattermost/mattermost/pull/36256\nhttps://github.com/mattermost/mattermost/pull/36257\nhttps://github.com/mattermost/mattermost/pull/36341\nhttps://github.com/mattermost/mattermost/commit/0a0ab0d54d899d308bd1352cc577036917500318\nhttps://github.com/mattermost/mattermost/commit/7425c6817bf244f976c729f8a73cecac8039a1e1\nhttps://github.com/mattermost/mattermost/commit/9408b98025d7364d7dfe7cdb28fcd109b1b595a6\nhttps://github.com/mattermost/mattermost/commit/a30a331a29b9766d46716d4252056d7b74e66da0\nhttps://github.com/mattermost/mattermost\nhttps://github.com/mattermost/mattermost/releases/tag/v10.11.16\nhttps://github.com/mattermost/mattermost/releases/tag/v11.5.5\nhttps://github.com/mattermost/mattermost/releases/tag/v11.6.2\nhttps://github.com/mattermost/mattermost/releases/tag/v11.7.0\nhttps://mattermost.com/security-updates\n","enisa_id":"EUVD-2026-36498\n","aliases":"GHSA-rp4v-qc77-phm4\nCVE-2026-3433\n","epss":0.0,"dataProcessed":"Nov 9, 2026, 3:49:06 PM","vulnerabilityProduct":[],"vulnerabilityVendor":[]}},{"id":"a46b58ce-b39b-325b-b417-4d79e311722c","vulnerability":{"id":"CVE-2026-3433","description":"Mattermost versions 11.6.x \u003c\u003d 11.6.1, 11.5.x \u003c\u003d 11.5.4, 10.11.x \u003c\u003d 10.11.15, 10.11.x \u003c\u003d 10.11.16 fail to restrict role_updated websocket event broadcasts to members of the affected team or channel which allows an authenticated attacker with guest-level access to observe permission scheme change notifications for private teams they are not a member of via the websocket connection.. Mattermost Advisory ID: MMSA-2026-00616","datePublished":"Jun 12, 2026, 3:46:54 PM","dateUpdated":"Jun 12, 2026, 5:19:49 PM","status":"PUBLISHED","baseScore":4.3,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","references":"https://mattermost.com/security-updates\n","enisa_id":"EUVD-2026-36498\n","assigner":"Mattermost","epss":0.18,"dataProcessed":"Nov 11, 2026, 7:22:07 AM","vulnerabilityProduct":[{"id":"566c8934-dbe5-31f2-a70f-88ac6637579f","product":{"name":"Mattermost","vendor":{"name":"Mattermost"}},"product_version":"11.6.0 ≤11.6.1"},{"id":"718541ec-5ed9-3847-85f1-d861043ed0bf","product":{"name":"Mattermost","vendor":{"name":"Mattermost"}},"product_version":"10.11.0 ≤10.11.16"},{"id":"ae69f7ca-8c74-37ac-a286-539658921817","product":{"name":"Mattermost","vendor":{"name":"Mattermost"}},"product_version":"11.5.0 ≤11.5.4"},{"id":"cb183644-cc12-3320-8b5a-4ca564a86b05","product":{"name":"Mattermost","vendor":{"name":"Mattermost"}},"product_version":"10.11.0 ≤10.11.15"}],"vulnerabilityVendor":[{"id":"34b08d67-bd24-3a17-bd2e-711472c15203","vendor":{"name":"Mattermost"}}]}}],"enisaIdAdvisory":[]}