CVE-2026-3433: Mattermost Websocket Authorization Bypass Leaks Permission Changes to Guest Users

Technical summary

The vulnerability stems from insufficient authorization checks on the role_updated websocket event in affected Mattermost Server versions. When permission schemes or roles are modified within a team or channel, the websocket broadcast mechanism fails to validate whether the receiving client is a member of that team or channel before transmitting the event payload. An authenticated user with guest-level privileges can maintain an active websocket connection and passively receive role_updated notifications for private teams and channels outside their scope, allowing reconnaissance of permission structure changes and team membership inferences.

Business impact

Organizations using Mattermost for secure team collaboration face an information leakage risk where permission and role changes—potentially sensitive indicators of organizational restructuring, access policy shifts, or security incident responses—become visible to guest users. In regulated environments, this may complicate compliance audits by creating an unintended information disclosure channel. The impact is moderate because the exposure requires active websocket monitoring and does not enable direct privilege escalation, but the unintended visibility into access controls undermines the premise of team and channel isolation in multi-tenant deployments.

Affected systems

Mattermost Server versions 11.6.x up to and including 11.6.1; 11.5.x up to and including 11.5.4; and 10.11.x up to and including 10.11.16 are vulnerable. Organizations running these versions with guest user accounts enabled should treat remediation as urgent. Verify your running version in Mattermost's System Console under About Mattermost.

Exploitability

Exploitation requires valid authentication credentials—even guest-level access is sufficient. No user interaction or advanced techniques are needed; an attacker simply maintains an authenticated websocket connection and passively observes broadcasted events. The attack surface is limited to users or service accounts with network access to the Mattermost deployment and valid login credentials, making it an insider or compromised-credential risk rather than an unauthenticated remote vulnerability. The CVSS score of 4.3 reflects the requirement for prior authentication and the limited scope of the information disclosed.

Remediation

Upgrade to patched versions provided by Mattermost. Verify against the official Mattermost security advisory (MMSA-2026-00616) for exact patch version numbers for your branch. In the interim, restrict guest user account creation and monitor active websocket connections for suspicious patterns. Consider implementing network-level controls to limit guest account access to Mattermost if operationally feasible during the patch window.

Patch guidance

Consult Mattermost's official security advisory (MMSA-2026-00616) for the specific patched version numbers applicable to your deployment branch. Typically, updates are made available through Mattermost's release channels and can be deployed via the standard upgrade process. Test patches in a non-production environment first to ensure compatibility with your configuration. Because this affects multiple version branches (10.11.x, 11.5.x, 11.6.x), confirm which branch your deployment uses and apply the corresponding patch version listed in the advisory.

Detection guidance

Monitor websocket connection logs for guest user accounts accessing role_updated events or observing permission changes outside their authorized scope. Correlate websocket event logs with team and channel membership data to identify anomalous patterns. If your Mattermost deployment includes detailed audit logging, search for role_updated events and cross-reference the receiving client identity against team roster to detect unauthorized recipients. Security information and event management (SIEM) integration with Mattermost audit logs can automate this detection.

Why prioritize this

While the CVSS score is moderate (4.3), organizations should prioritize this for patching because the vulnerability involves unintended visibility into permission structures and organizational access controls—information that guest users should never observe. The attack requires only valid credentials (no zero-day exploitation) and affects a clear user class (guests), making it a straightforward remediation target. The risk is heightened in deployments where guest accounts are widely provisioned or where permission changes are frequent indicators of security incidents.

Risk score, explained

The CVSS 3.1 score of 4.3 is justified by: (1) network-accessible attack vector (AV:N); (2) low attack complexity requiring only a valid connection (AC:L); (3) low privilege requirement (PR:L—guest-level authentication suffices); (4) no user interaction needed (UI:N); (5) unchanged scope (S:U); but (6) limited confidentiality impact (C:L) because only metadata about permission changes, not sensitive application data, is leaked; (7) no integrity or availability impact. The moderate severity reflects that while the breach is confidential in nature, it does not enable privilege escalation, data exfiltration, or service disruption.

Frequently asked questions