CVE-2026-18256 — Private team metadata disclosure via the team search API

Description (CNA)

Mattermost versions 11.10.x <= 11.10.0, 11.7.x <= 11.7.9, 11.9.x <= 11.9.1, 11.8.x <= 11.8.5 fail to properly restrict private teams from public team search results, which allows an authenticated user without permission to list private teams to disclose the ID, name, and display name of private teams via a modified team search request. Mattermost Advisory ID: MMSA-2026-00748

Affected (CNA)

Vendor / product	Versions
Mattermost / Mattermost	affected 11.10.0 through 11.10.0; affected 11.7.0 through 11.7.9; affected 11.9.0 through 11.9.1; affected 11.8.0 through 11.8.5; unaffected 11.11.0; unaffected 11.10.1; unaffected 11.7.10; unaffected 11.9.2; unaffected 11.8.6

CWE

CWE-863

References

https://mattermost.com/security-updates

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.