CVE-2026-21386

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-21386
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-21386.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-21386
Aliases
Downstream
Related
Published
2026-03-16T15:16:20.927Z
Modified
2026-04-10T05:38:28.365418Z
Severity
  • 4.3 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N CVSS Calculator
Summary
[none]
Details

Mattermost versions 11.3.x <= 11.3.0, 11.2.x <= 11.2.2, 10.11.x <= 10.11.10 fail to use consistent error responses when handling the /mute command which allows an authenticated team member to enumerate private channels they are not authorized to know about via differing error messages for nonexistent versus private channels. Mattermost Advisory ID: MMSA-2026-00588

References

Affected packages

Git / github.com/mattermost/mattermost-server

Affected ranges

Type
GIT
Repo
https://github.com/mattermost/mattermost-server
Events
Introduced
5b955468ea1ea8b56c0fb10feb258a36a767d7bb
Fixed
fddd4a70bcb32eaff394a2fa5399efcd1b2ae251
Introduced
ab7b138824c61fe1fe815243d7e2a914dec49c8b
Fixed
005521aa79666e6960bc3302f6172b810f6bff3a
Introduced
d27a2195068ddfa3ce17cf470f9739e4edb94b83
Fixed
4082c3dcf285e4d1a386d2ef37f14f39dc5a0094
Database specific 
{
    "versions": [
        {
            "introduced": "10.11.0"
        },
        {
            "fixed": "10.11.11"
        },
        {
            "introduced": "11.2.0"
        },
        {
            "fixed": "11.2.3"
        },
        {
            "introduced": "11.3.0"
        },
        {
            "fixed": "11.3.1"
        }
    ]
}

Affected versions

@mattermost/client@10.*
@mattermost/client@10.11.0
@mattermost/client@11.*
@mattermost/client@11.3.0
@mattermost/types@10.*
@mattermost/types@10.11.0
@mattermost/types@11.*
@mattermost/types@11.3.0
mattermost-redux@10.*
mattermost-redux@10.11.0
mattermost-redux@11.*
mattermost-redux@11.3.0
v10.*
v10.11.0
v10.11.0-rc3
v10.11.1
v10.11.1-rc1
v10.11.10
v10.11.11-rc1
v10.11.2
v10.11.2-rc1
v10.11.2-rc2
v10.11.3
v10.11.4
v10.11.4-rc1
v10.11.4-rc2
v10.11.4-rc3
v10.11.5
v10.11.6
v10.11.7
v10.11.8
v10.11.9
v10.11.9-rc1
v11.*
v11.2.0
v11.2.1
v11.2.1-rc1
v11.2.2
v11.3.0
v11.3.0-rc3
v11.3.0-rc4
v11.3.1-rc1

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-21386.json"