Executive brief
Mattermost, a widely-used team collaboration and messaging platform, fails to restrict websocket event broadcasts when permission schemes change. An authenticated attacker with basic guest-level access can observe permission scheme updates for private teams or channels they do not belong to, potentially learning about organizational permission changes they should not see. This information disclosure could aid in understanding organizational structure and permissions to plan further attacks.
Technical details
The vulnerability exists in the role_updated websocket event handler, which broadcasts permission scheme change notifications globally without restricting them to team or channel members. An authenticated attacker with guest-level privileges can connect to the websocket and receive these events even for private teams and channels they are not a member of. The root cause is an authorization bypass in the event scoping logic. The fix (PR #35497) properly scopes role_updated events: built-in and unowned roles broadcast globally, team-scheme roles emit per-team, and channel-scheme roles emit per-channel to authorized members only. Patched versions include 11.6.2, 11.5.5, 10.11.17, and later.
Affected products
- Mattermost Mattermost Server 11.6.0 to 11.6.1, 11.5.0 to 11.5.4, 10.11.0 to 10.11.15, 8.0.0-20250731163400-5b955468ea1e to 8.0.0-20260504071740-9408b98025d7
Timeline
- 2026-06-12: disclosed: Publicly disclosed via GitHub Advisory Database
- 2026: patched: Patched in versions 11.6.2, 11.5.5, 10.11.17, and 11.7.0