{"resultsPerPage":1,"startIndex":0,"totalResults":1,"format":"NVD_CVE","version":"2.0","timestamp":"2026-09-29T22:01:58.785","vulnerabilities":[{"cve":{"id":"CVE-2026-3115","sourceIdentifier":"responsibledisclosure@mattermost.com","published":"2026-03-26T17:16:42.660","lastModified":"2026-06-17T10:43:04.240","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"Mattermost versions 11.2.x <= 11.2.2, 10.11.x <= 10.11.10, 11.4.x <= 11.4.0, 11.3.x <= 11.3.1 fail to apply view restrictions when retrieving group member IDs, which allows authenticated guest users to enumerate user IDs outside their allowed visibility scope via the group retrieval endpoint.. Mattermost Advisory ID: MMSA-2026-00594"},{"lang":"es","value":"Las versiones de Mattermost 11.2.x &lt;= 11.2.2, 10.11.x &lt;= 10.11.10, 11.4.x &lt;= 11.4.0, 11.3.x &lt;= 11.3.1 no aplican las restricciones de visualización al recuperar los IDs de miembros de grupo, lo que permite a los usuarios invitados autenticados enumerar los IDs de usuario fuera de su ámbito de visibilidad permitido a través del endpoint de recuperación de grupo. ID de Aviso de Mattermost: MMSA-2026-00594"}],"affected":[{"source":"responsibledisclosure@mattermost.com","affectedData":[{"vendor":"Mattermost","product":"Mattermost","defaultStatus":"unaffected","versions":[{"version":"11.2.0","lessThanOrEqual":"11.2.2","versionType":"semver","status":"affected"},{"version":"10.11.0","lessThanOrEqual":"10.11.10","versionType":"semver","status":"affected"},{"version":"11.4.0","lessThanOrEqual":"11.4.0","versionType":"semver","status":"affected"},{"version":"11.3.0","lessThanOrEqual":"11.3.1","versionType":"semver","status":"affected"},{"version":"11.5.0","status":"unaffected"},{"version":"11.2.3","status":"unaffected"},{"version":"10.11.11","status":"unaffected"},{"version":"11.4.1","status":"unaffected"},{"version":"11.3.2","status":"unaffected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"responsibledisclosure@mattermost.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","baseScore":4.3,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"NONE","availabilityImpact":"NONE"},"exploitabilityScore":2.8,"impactScore":1.4}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-03-26T17:37:24.982329Z","id":"CVE-2026-3115","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"responsibledisclosure@mattermost.com","type":"Secondary","description":[{"lang":"en","value":"CWE-863"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:mattermost:mattermost_server:*:*:*:*:*:*:*:*","versionStartIncluding":"10.11.0","versionEndExcluding":"10.11.11","matchCriteriaId":"B6E5F368-358C-429B-8F04-3C8DF4A71A91"},{"vulnerable":true,"criteria":"cpe:2.3:a:mattermost:mattermost_server:*:*:*:*:*:*:*:*","versionStartIncluding":"11.2.0","versionEndExcluding":"11.2.3","matchCriteriaId":"7F64C167-943D-4F3F-9374-BCC8DECB3881"},{"vulnerable":true,"criteria":"cpe:2.3:a:mattermost:mattermost_server:*:*:*:*:*:*:*:*","versionStartIncluding":"11.3.0","versionEndExcluding":"11.3.2","matchCriteriaId":"805ECFFC-82FD-4754-AF95-32167E1D41CB"},{"vulnerable":true,"criteria":"cpe:2.3:a:mattermost:mattermost_server:11.4.0:*:*:*:*:*:*:*","matchCriteriaId":"7B6A1FE2-D980-4755-A838-190A53A4D62B"}]}]}],"references":[{"url":"https://mattermost.com/security-updates","source":"responsibledisclosure@mattermost.com","tags":["Vendor Advisory"]}]}}]}