CVE-2026-4265 - Guest user can upload files without permission across teams

Back Back to CVE browser

MEDIUM

Guest user can upload files without permission across teams

Published Mar 16, 2026

4.3

MEDIUM

CVSS 3.1

EPSS 0.36%

Description

Mattermost versions 11.3.x <= 11.3.0, 11.2.x <= 11.2.2, 10.11.x <= 10.11.10 fail to validate team-specific upload_file permissions which allows a guest user to post files in channels where they lack upload_file permission via uploading files in a team where they have permission and reusing the file metadata in a POST request to a different team. Mattermost Advisory ID: MMSA-2025-00553

Affected products

Vendor Mattermost Product Mattermost Default
unaffected
- Version
  10.11.0
  Status
  affected
  Constraints
  <=10.11.10
- Version
  11.2.0
  Status
  affected
  Constraints
  <=11.2.2
- Version
  11.3.0
  Status
  affected
  Constraints
  <=11.3.0
- Version
  10.11.11
  Status
  unaffected
  Constraints
  -
- Version
  11.2.3
  Status
  unaffected
  Constraints
  -
- Version
  11.3.1
  Status
  unaffected
  Constraints
  -
- Version
  11.4.0
  Status
  unaffected
  Constraints
  -

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

Mattermost

unaffected

Version	Status	Constraints
10.11.0	affected	<=10.11.10
11.2.0	affected	<=11.2.2
11.3.0	affected	<=11.3.0
10.11.11	unaffected	-
11.2.3	unaffected	-
11.3.1	unaffected	-
11.4.0	unaffected	-

github.com/mattermost/mattermost/server/v8

Go

Introduced 0 Fixed 8.0.0-20260107144005-c7f6efdfb035
github.com/mattermost/mattermost-server/v5

Go

Introduced 0 Fixed not fixed
github.com/mattermost/mattermost-server/v6

Go

Introduced 0 Fixed not fixed
github.com/mattermost/mattermost-server

Go

Introduced 11.2.0-rc1+incompatible Fixed 11.2.3+incompatible
github.com/mattermost/mattermost-server

Go

Introduced 11.3.0-rc1+incompatible Fixed 11.3.1+incompatible
github.com/mattermost/mattermost-server

Go

Introduced 10.11.0-rc1+incompatible Fixed 10.11.11+incompatible

Ecosystem	Package	Introduced	Fixed
Go	github.com/mattermost/mattermost/server/v8	0	8.0.0-20260107144005-c7f6efdfb035
Go	github.com/mattermost/mattermost-server/v5	0	not fixed
Go	github.com/mattermost/mattermost-server/v6	0	not fixed
Go	github.com/mattermost/mattermost-server	11.2.0-rc1+incompatible	11.2.3+incompatible
Go	github.com/mattermost/mattermost-server	11.3.0-rc1+incompatible	11.3.1+incompatible
Go	github.com/mattermost/mattermost-server	10.11.0-rc1+incompatible	10.11.11+incompatible

Remediation

Vendor solution

Update Mattermost to versions 11.4.0, 11.3.1, 11.2.3, 10.11.11 or higher.

Weaknesses (1)

CWE-863

Incorrect Authorization

References (5)

https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-12425
Advisory
https://github.com/advisories/GHSA-xpvf-6qcc-9jqc
Advisory
https://github.com/mattermost/mattermost/commit/c7f6efdfb035490f494b3177996ee5f4b278c988
https://mattermost.com/security-updates
vendor-advisoryVendor Advisory
https://nvd.nist.gov/vuln/detail/CVE-2026-4265

Link	Providers	Tags
https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-12425		Advisory
https://github.com/advisories/GHSA-xpvf-6qcc-9jqc		Advisory
https://github.com/mattermost/mattermost/commit/c7f6efdfb035490f494b3177996ee5f4b278c988
https://mattermost.com/security-updates		vendor-advisoryVendor Advisory
https://nvd.nist.gov/vuln/detail/CVE-2026-4265