CVE-2026-3524

ALTO 8.8CVE-2026-3524 · Published 06/04/2026 · updated 06/08/2026

In breve

CVE-2026-3524 è una vulnerabilità ALTO (CVSS 8.8) che riguarda legal hold (mattermost).
Probabilità di sfruttamento nei prossimi 30 giorni (EPSS): 0.38%, superiore al 31.8% delle vulnerabilità.
Correzione: aggiornare a 1.1.5 o successiva.

Package	Affected versions	Patched versions
legal hold mattermost	`< 1.1.5`	`1.1.5`

Description

Mattermost Plugin Legal Hold versions <=1.1.4 fail to halt request processing after a failed authorization check in ServeHTTP which allows an authenticated attacker to access, create, download, and delete legal hold data via crafted API requests to the plugin's endpoints. Mattermost Advisory ID: MMSA-2026-00621

References

mattermost.com/security-updates · Vendor Advisory

Altre vulnerabilità di legal hold

Vedi tutto →

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free