CVE-2026-3524: Authorization Bypass in Mattermost Legal Hold Plugin Due to Missing Return After Permission Check
Mattermost Plugin Legal Hold versions <=1.1.4 fail to halt request processing after a failed authorization check in ServeHTTP which allows an authenticated attacker to access, create, download, and delete legal hold data via crafted API requests to the plugin's endpoints. Mattermost Advisory ID: MMSA-2026-00621
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Mattermost Legal Hold Pluginto a version that resolves this vulnerability.Fixed in 1.1.5
Event History
Frequently Asked Questions
What is the severity of CVE-2026-3524?
The severity of CVE-2026-3524 is considered high due to the potential for unauthorized access to sensitive data.
How do I fix CVE-2026-3524?
To fix CVE-2026-3524, upgrade the Mattermost Legal Hold plugin to version 1.1.5 or later, which addresses the authorization bypass vulnerability.
Who is affected by CVE-2026-3524?
CVE-2026-3524 affects users of Mattermost Legal Hold plugin versions 1.1.4 and earlier.
What types of attacks can be performed due to CVE-2026-3524?
An authenticated attacker can exploit CVE-2026-3524 to access, create, and download sensitive information without proper authorization.
Is there a workaround for CVE-2026-3524?
There is no known workaround for CVE-2026-3524; upgrading to the fixed version is the recommended solution.