CVE-2026-1629

Mattermost versions 10.11.x <= 10.11.10 Fail to invalidate cached permalink preview data when a user loses channel access which allows the user to continue viewing private channel content via previously cached permalink previews until cache reset or relogin.. Mattermost Advisory ID: MMSA-2026-00580

Score

CVSS 3.1 4.3 Medium

Status

Analyzed - responsibledisclosure@mattermost.com

Published

2026-03-16

Last modified

2026-03-17

Weaknesses

CWE-672

Affected products

• Mattermost (Mattermost)
• Mattermost Server (Mattermost)

References

• https://mattermost.com/security-updates