CVE-2026-2578

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2026-2578
Mattermost versions 11.3.x <= 11.3.0 fail to preserve the redacted state of burn-on-read posts during deletion which allows channel members to access unrevealed burn-on-read message contents via the WebSocket post deletion event.. Mattermost Advisory ID: MMSA-2026-00579

4.3 /10

CVSS v3 : MEDIUM

V3 Legend

Vector :

Exploitability : 2.8 / Impact : 1.4

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact LOW

Integrity Impact NONE

Availability Impact NONE

Scope UNCHANGED

References
Link Resource
https://mattermost.com/security-updates Vendor Advisory
Configurations

Configuration 1 (hide)

cpe:2.3:a:mattermost:mattermost_server:*:*:*:*:*:*:*:*
History

18 Mar 2026, 17:42

Type Values Removed Values Added
References () https://mattermost.com/security-updates - () https://mattermost.com/security-updates - Vendor Advisory
Summary
  • (es) Mattermost versiones 11.3.x &lt;= 11.3.0 no logran preservar el estado redactado de las publicaciones de autodestrucción tras lectura durante la eliminación, lo que permite a los miembros del canal acceder al contenido no revelado de los mensajes de autodestrucción tras lectura a través del evento de eliminación de publicación de WebSocket. ID de Aviso de Mattermost: MMSA-2026-00579
CPE cpe:2.3:a:mattermost:mattermost_server:*:*:*:*:*:*:*:*
First Time Mattermost
Mattermost mattermost Server

16 Mar 2026, 14:19

Type Values Removed Values Added
New CVE
Information

Published : 2026-03-16 14:19

Updated : 2026-03-18 17:42

NVD link : CVE-2026-2578

Mitre link : CVE-2026-2578

CVE.ORG link : CVE-2026-2578

JSON object : View

Products Affected

mattermost

  • mattermost_server
CWE
CWE-201

Insertion of Sensitive Information Into Sent Data