Mattermost doesn't restrict role_updated websocket event broadcasts to members of the affected team or channel

Mattermost versions 11.6.x <= 11.6.1, 11.5.x <= 11.5.4, 10.11.x <= 10.11.15, 10.11.x <= 10.11.16 fail to restrict role_updated websocket event broadcasts to members of the affected team or channel, which allows an authenticated attacker with guest-level access to observe permission scheme change notifications for private teams they are not a member of via the websocket connection. Mattermost Advisory ID: MMSA-2026-00616

References

• https://nvd.nist.gov/vuln/detail/CVE-2026-3433

• https://mattermost.com/security-updates

• mattermost/mattermost#35497

• mattermost/mattermost#36256

• mattermost/mattermost#36257

• mattermost/mattermost#36341

• mattermost/mattermost@0a0ab0d

• mattermost/mattermost@7425c68

• mattermost/mattermost@9408b98

• mattermost/mattermost@a30a331

• https://github.com/mattermost/mattermost/releases/tag/v10.11.16

• https://github.com/mattermost/mattermost/releases/tag/v11.5.5

• https://github.com/mattermost/mattermost/releases/tag/v11.6.2

• https://github.com/mattermost/mattermost/releases/tag/v11.7.0