CVE-2026-18256: Private team metadata disclosure via the team search API
Mattermost versions 11.10.x <= 11.10.0, 11.7.x <= 11.7.9, 11.9.x <= 11.9.1, 11.8.x <= 11.8.5 fail to properly restrict private teams from public team search results, which allows an authenticated user without permission to list private teams to disclose the ID, name, and display name of private teams via a modified team search request. Mattermost Advisory ID: MMSA-2026-00748
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Mattermostto a version that resolves this vulnerability.Fixed in 11.11.0 - Upgrade
Upgrade
Mattermostto a version that resolves this vulnerability.Fixed in 11.10.1 - Upgrade
Upgrade
Mattermostto a version that resolves this vulnerability.Fixed in 11.7.10 - Upgrade
Upgrade
Mattermostto a version that resolves this vulnerability.Fixed in 11.9.2 - Upgrade
Upgrade
Mattermostto a version that resolves this vulnerability.Fixed in 11.8.6
Event History
Frequently Asked Questions
Who can exploit this issue?
Any authenticated Mattermost user who does not have permission to list private teams can exploit it. The attacker must be able to send a modified team search request.
What information can be exposed?
The issue can disclose a private team's ID, name, and display name. The available information does not indicate exposure of team content or membership.
Are unauthenticated users affected?
No. The described attack requires an authenticated user with low privileges.
Which Mattermost releases are affected?
Affected releases are Mattermost 11.10.x through 11.10.0, 11.7.x through 11.7.9, 11.9.x through 11.9.1, and 11.8.x through 11.8.5.