Is CVE-2026-3433 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-3433 being exploited in the wild.

How severe is CVE-2026-3433?

Medium severity, with a CVSS score of 4.3, published 12 June 2026.

Which products and versions are affected?

github.com/mattermost/mattermost-server (Go) SEMVER:introduced=10.11.0+incompatible,fixed=10.11.17+incompatible,introduced=11.5.0+incompatible,fixed=11.5.5+incompatible,introduced=11.6.0+incompatible,fixed=11.6.1+incompatible, SEMVER:introduced=11.6.0,fixed=11.6.1; github.com/mattermost/mattermost-server/v5 (Go) SEMVER:introduced=0; github.com/mattermost/mattermost-server/v6 (Go) SEMVER:introduced=0; github.com/mattermost/mattermost/server/v8 (Go) SEMVER:introduced=8.0.0-20250731163400-5b955468ea1e,fixed=8.0.0-20260504071740-9408b98025d7; and 1 more.

Is there a fix for CVE-2026-3433?

Yes. github.com/mattermost/mattermost-server (Go): upgrade to 11.6.1, 11.6.1+incompatible or later; github.com/mattermost/mattermost/server/v8 (Go): upgrade to 8.0.0-20260504071740-9408b98025d7 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-3433 attacked?

It is attacked over the network, in a hosted service.

Am I affected by CVE-2026-3433?

Check whether you run github.com/mattermost/mattermost-server (Go), github.com/mattermost/mattermost-server/v5 (Go), github.com/mattermost/mattermost-server/v6 (Go) or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-3433: Mattermost information disclosure in role_updated WebSocket events

CVE-2026-3433 · Severity: medium · CVSS 4.3 · Published 2026-06-12

Mattermost, a widely-used team collaboration and messaging platform, fails to restrict websocket event broadcasts when permission schemes change. An authenticated attacker with basic guest-level access can observe permission scheme updates for private teams or channels they do not belong to, potentially learning about organizational permission changes they should not see. This information disclosure could aid in understanding organizational structure and permissions to plan further attacks.

Technologies: github.com/mattermost/mattermost-server (Go), github.com/mattermost/mattermost-server/v5 (Go), github.com/mattermost/mattermost-server/v6 (Go), github.com/mattermost/mattermost/server/v8 (Go), Mattermost Server. Vendors: Go, Mattermost.

Quick answers

Is CVE-2026-3433 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-3433 being exploited in the wild.
How severe is CVE-2026-3433?: Medium severity, with a CVSS score of 4.3, published 12 June 2026.
Which products and versions are affected?: github.com/mattermost/mattermost-server (Go) SEMVER:introduced=10.11.0+incompatible,fixed=10.11.17+incompatible,introduced=11.5.0+incompatible,fixed=11.5.5+incompatible,introduced=11.6.0+incompatible,fixed=11.6.1+incompatible, SEMVER:introduced=11.6.0,fixed=11.6.1; github.com/mattermost/mattermost-server/v5 (Go) SEMVER:introduced=0; github.com/mattermost/mattermost-server/v6 (Go) SEMVER:introduced=0; github.com/mattermost/mattermost/server/v8 (Go) SEMVER:introduced=8.0.0-20250731163400-5b955468ea1e,fixed=8.0.0-20260504071740-9408b98025d7; and 1 more.
Is there a fix for CVE-2026-3433?: Yes. github.com/mattermost/mattermost-server (Go): upgrade to 11.6.1, 11.6.1+incompatible or later; github.com/mattermost/mattermost/server/v8 (Go): upgrade to 8.0.0-20260504071740-9408b98025d7 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-3433 attacked?: It is attacked over the network, in a hosted service.
Am I affected by CVE-2026-3433?: Check whether you run github.com/mattermost/mattermost-server (Go), github.com/mattermost/mattermost-server/v5 (Go), github.com/mattermost/mattermost-server/v6 (Go) or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

github.com/mattermost/mattermost-server (Go): upgrade to 11.6.1, 11.6.1+incompatible or later
```
go get github.com/mattermost/mattermost-server@v11.6.1+incompatible
```
github.com/mattermost/mattermost/server/v8 (Go): upgrade to 8.0.0-20260504071740-9408b98025d7 or later
```
go get github.com/mattermost/mattermost/server/v8@v8.0.0-20260504071740-9408b98025d7
```

Technical details

The vulnerability exists in the role_updated websocket event handler, which broadcasts permission scheme change notifications globally without restricting them to team or channel members. An authenticated attacker with guest-level privileges can connect to the websocket and receive these events even for private teams and channels they are not a member of. The root cause is an authorization bypass in the event scoping logic. The fix (PR #35497) properly scopes role_updated events: built-in and unowned roles broadcast globally, team-scheme roles emit per-team, and channel-scheme roles emit per-channel to authorized members only. Patched versions include 11.6.2, 11.5.5, 10.11.17, and later.

Affected products

Mattermost Mattermost Server 11.6.0 to 11.6.1, 11.5.0 to 11.5.4, 10.11.0 to 10.11.15, 8.0.0-20250731163400-5b955468ea1e to 8.0.0-20260504071740-9408b98025d7

Identifiers

CVE-2026-3433
GHSA-rp4v-qc77-phm4
GO-2026-6286

Timeline

2026-06-12: disclosed: Publicly disclosed via GitHub Advisory Database
2026: patched: Patched in versions 11.6.2, 11.5.5, 10.11.17, and 11.7.0

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.