CVE-2026-2458

Summary

Mattermost allows a removed team member to enumerate all public channels within a private team in github.com/mattermost/mattermost-server

Severity

medium

EPSS

0.2% (p6)

Also known as

GHSA-679f-wmrg-qf57, GHSA-679f-wmrg-qf57#github.com/mattermost/mattermost-server, GHSA-679f-wmrg-qf57#github.com/mattermost/mattermost/server/v8, GO-2026-4729, GO-2026-4729#github.com/mattermost/mattermost-server, GO-2026-4729#github.com/mattermost/mattermost-server/v5, GO-2026-4729#github.com/mattermost/mattermost-server/v6, GO-2026-4729#github.com/mattermost/mattermost/server/v8

Published

2026-03-23

References

• https://github.com/advisories/GHSA-679f-wmrg-qf57
• https://nvd.nist.gov/vuln/detail/CVE-2026-2458
• https://github.com/mattermost/mattermost/commit/a18b80ba4c324b74b3d47951c33957305af4a099

Related advisories

• CVE-2026-6346 — high · Go/github.com/mattermost/mattermost-server
• CVE-2026-6347 — high · Go/github.com/mattermost/mattermost-server
• CVE-2026-6339 — medium · Go/github.com/mattermost/mattermost-server
• CVE-2026-5163 — medium · Go/github.com/mattermost/mattermost-server
• CVE-2026-28732 — medium · Go/github.com/mattermost/mattermost-server
• CVE-2026-6345 — medium · Go/github.com/mattermost/mattermost-server
• CVE-2026-6340 — medium · Go/github.com/mattermost/mattermost-server
• CVE-2026-3637 — medium · Go/github.com/mattermost/mattermost-server

Is your project exposed to this? Stateward checks every dependency on every pull request and flags it only if your code actually reaches it.

Summarize with AI

ChatGPTClaudePerplexity