CVE-2026-29197: Medium severity Mattermost Mattermost Server vulnerability
In versions <8.4.0, <8.3.2, <8.2.2, <8.1.3, <8.0.4, <7.13.6, <7.12.7, <7.11.7, and <7.10.10, the endpoints /api/apps/logs and /api/apps/:id/logs have a typo in the required permission check, allowing authenticated users without the proper permissions to read apps-engine logs.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-29197?
CVE-2026-29197 is considered a critical vulnerability due to the potential for unauthorized access to sensitive application logs.
How do I fix CVE-2026-29197?
To fix CVE-2026-29197, update your Mattermost Server to a version greater than 8.4.0 or to any version that is not affected by this vulnerability.
What type of vulnerability is CVE-2026-29197?
CVE-2026-29197 is a permission check vulnerability that allows authenticated users to access logs they should not have permission to read.
Which versions are affected by CVE-2026-29197?
CVE-2026-29197 affects Mattermost Server versions less than 8.4.0, including 8.3.2, 8.2.2, 8.1.3, 8.0.4, 7.13.6, 7.12.7, 7.11.7, and 7.10.10.
Who is vulnerable to CVE-2026-29197?
Authenticated users on affected versions of Mattermost Server can exploit CVE-2026-29197 to gain unauthorized access to logs.