CVE-2024-1949
LowCVSS 2.6Summary
A race condition in Mattermost versions 8.1.x before 8.1.9, and 9.4.x before 9.4.2 allows an authenticated attacker to gain unauthorized access to individual posts' contents via carefully timed post creation while another user deletes posts.
Risk Assessment
An authenticated attacker can read post contents they should not have access to, potentially leading to leakage of confidential information.
Recommendation
Update Mattermost to version 8.1.9 or 9.4.2 (or later). Restrict the ability for users to delete posts if possible.
Other vulnerabilities in Mattermost
See all- CVE-2026-2455Medium
Mattermost versions 11.3.x <= 11.3.0, 11.2.x <= 11.2.2, 10.11.x <= 10.11.10 fail to canonicalize IPv4-mapped IPv6 addresses before reserved IP validation, allowing an attacker to perform SSRF attacks against internal services via IPv4-mapped IPv6 literals such as [::ffff:127.0.0.1].
- CVE-2026-24692Medium
Mattermost versions 11.3.x <= 11.3.0, 11.2.x <= 11.2.2, and 10.11.x <= 10.11.10 failed to properly enforce read permissions in search API endpoints. Guest users without read permissions could access posts and files in channels via search API requests.
- CVE-2026-22545Low
Mattermost versions 10.11.x <= 10.11.10 fail to validate the user's authentication method when processing an account auth type switch. An authenticated attacker can change the account password without confirmation by falsely claiming a different auth provider.
- CVE-2026-21386Medium
Mattermost versions 11.3.x <= 11.3.0, 11.2.x <= 11.2.2, 10.11.x <= 10.11.10 fail to use consistent error responses when handling the /mute command. An authenticated team member can enumerate private channels they are not authorized to know about via differing error messages for nonexistent versus private channels.
- CVE-2026-4265Medium
Mattermost versions 11.3.x <= 11.3.0, 11.2.x <= 11.2.2, 10.11.x <= 10.11.10 fail to validate team-specific upload_file permissions, allowing a guest user to post files in channels where they lack upload_file permission by uploading files in a team where they have permission and reusing the file metadata in a POST request to a different team.
- CVE-2026-2578Medium
Mattermost versions 11.3.x <= 11.3.0 fail to preserve the redacted state of burn-on-read posts during deletion, allowing channel members to access unrevealed burn-on-read message contents via the WebSocket post deletion event. Advisory ID: MMSA-2026-00579.
- CVE-2026-2463Medium
Mattermost versions 11.3.x <= 11.3.0, 11.2.x <= 11.2.2, 10.11.x <= 10.11.10 fail to filter invite IDs based on user permissions, allowing regular users to bypass access control restrictions and register unauthorized accounts via leaked invite IDs during team creation.
- CVE-2026-2458Medium
Mattermost versions 11.3.x <= 11.3.0, 11.2.x <= 11.2.2, and 10.11.x <= 10.11.10 fail to properly validate team membership when searching channels, allowing a removed team member to enumerate all public channels within a private team via the channel search API endpoint.
- CVE-2026-2457Medium
Mattermost versions 11.3.x <= 11.3.0, 11.2.x <= 11.2.2, and 10.11.x <= 10.11.10 fail to sanitize client-supplied post metadata. An authenticated attacker can spoof permalink embeds impersonating other users via crafted PUT requests to the post update API endpoint.
- CVE-2026-2456Medium
Mattermost versions 11.3.x <= 11.3.0, 11.2.x <= 11.2.2, 10.11.x <= 10.11.10 fail to limit the size of responses from integration action endpoints. An authenticated attacker can cause server memory exhaustion and denial of service via a malicious integration server returning an arbitrarily large response when a user clicks an interactive message button.
Original NVD description (English source)
A race condition in Mattermost versions 8.1.x before 8.1.9, and 9.4.x before 9.4.2 allows an authenticated attacker to gain unauthorized access to individual posts' contents via carefully timed post creation while another user deletes posts.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS