CVE-2026-24692: Guest users can bypass read permissions via search API
Mattermost versions 11.3.x <= 11.3.0, 11.2.x <= 11.2.2, 10.11.x <= 10.11.10 fail to properly enforce read permissions in search API endpoints which allows guest users without read permissions to access posts and files in channels via search API requests. Mattermost Advisory ID: MMSA-2025-00554
Affected Software
Remediation
Information
Event History
Frequently Asked Questions
What is the severity of CVE-2026-24692?
CVE-2026-24692 is rated as a high-severity vulnerability due to the potential for guest users to bypass read permissions.
How do I fix CVE-2026-24692?
To fix CVE-2026-24692, upgrade to Mattermost versions 11.3.1 or later, 11.2.3 or later, or 10.11.11 or later.
Which versions of Mattermost are affected by CVE-2026-24692?
CVE-2026-24692 affects Mattermost versions 11.3.0, 11.2.2, and 10.11.10 or earlier.
What kind of access do guest users gain through CVE-2026-24692?
Through CVE-2026-24692, guest users can access posts and files in channels that they typically do not have read permissions for.
Is CVE-2026-24692 a security risk for all Mattermost deployments?
Yes, CVE-2026-24692 represents a security risk for all Mattermost deployments that include vulnerable versions.