CVE-2026-1629 — Permalink Preview Information Disclosure After Permission Revocation

CVE-2026-1629

Permalink Preview Information Disclosure After Permission Revocation PUBLISHED

Description (CNA)

Mattermost versions 10.11.x <= 10.11.10 Fail to invalidate cached permalink preview data when a user loses channel access which allows the user to continue viewing private channel content via previously cached permalink previews until cache reset or relogin.. Mattermost Advisory ID: MMSA-2026-00580

Affected (CNA)

Vendor / product	Versions
Mattermost / Mattermost	affected 10.11.0 through 10.11.10; unaffected 11.4.0; unaffected 10.11.11

CWE

CWE-672

References

https://mattermost.com/security-updates

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.