CVE-2026-3524

HIGH EPSS 29.7%

Published Apr 6, 20262mo ago · Modified Jun 17, 20262w ago

8.8 CVSS 3.1

High

Published Apr 6, 2026 2mo ago

Last Modified Jun 17, 2026 2w ago

Description

Mattermost Plugin Legal Hold versions <=1.1.4 fail to halt request processing after a failed authorization check in ServeHTTP which allows an authenticated attacker to access, create, download, and delete legal hold data via crafted API requests to the plugin's endpoints. Mattermost Advisory ID: MMSA-2026-00621

CVSS Details

Base Score

8.8

Exploitability

2.8

Impact

5.9

Vector string

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Attack Vector Network

Attack Complexity Low

Privileges Required Low

User Interaction None

Scope Unchanged

Confidentiality High

Integrity High

Availability High

Threat Intelligence

EPSS Exploit Probability

29.7% percentile

Exploit & Patch Status

No Known Exploit

No Patch Available

Weaknesses 1

CWE-862 Missing Authorization Authorization

References 1

mattermost.com https://mattermost.com/security-updates

Remediation

No remediation data recorded yet

Check vendor advisories and the NVD entry for patch availability.