Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).
| Vendor | Product | Default status | Versions | ||||||||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| Mattermost | Mattermost | unaffected |
|
No data.
No data.
No data.
Project Subscriptions
No data.
No advisories yet.
Solution
Update Mattermost to versions 11.11.0, 11.10.1, 11.7.10, 11.9.2, 11.8.6 or higher.
Workaround
No workaround given by the vendor.
| Link | Providers |
|---|---|
| https://mattermost.com/security-updates |
|
Fri, 16 Oct 2026 07:30:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Description | Mattermost versions 11.10.x <= 11.10.0, 11.7.x <= 11.7.9, 11.9.x <= 11.9.1, 11.8.x <= 11.8.5 fail to properly restrict private teams from public team search results, which allows an authenticated user without permission to list private teams to disclose the ID, name, and display name of private teams via a modified team search request. Mattermost Advisory ID: MMSA-2026-00748 | |
| Title | Private team metadata disclosure via the team search API | |
| Weaknesses | CWE-863 | |
| References |
| |
| Metrics |
cvssV3_1
|
Projects
Sign in to view the affected projects.
MITRE
Status: PUBLISHED
Assigner: Mattermost
Published:
Updated: 2026-10-16T07:13:43.684Z
Reserved: 2026-07-29T16:21:51.519Z
Link: CVE-2026-18256
Vulnrichment
No data.
NVD
Status : Received
Published: 2026-10-16T08:17:12.863
Modified: 2026-10-16T08:17:12.863
Link: CVE-2026-18256
Redhat
No data.
OpenCVE Enrichment
No data.