{"cve":"CVE-2026-21386","nvd":{"published":"2026-03-16T15:16:20.927","modified":"2026-06-17T10:18:36.787","status":"Analyzed","description":"Mattermost versions 11.3.x <= 11.3.0, 11.2.x <= 11.2.2, 10.11.x <= 10.11.10 fail to use consistent error responses when handling the /mute command which allows an authenticated team member to enumerate private channels they are not authorized to know about via differing error messages for nonexistent versus private channels. Mattermost Advisory ID: MMSA-2026-00588","cvss_v4":null,"cvss_v3":{"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","score":4.3},"cwes":["CWE-203"],"references":["https://mattermost.com/security-updates"],"products":["mattermost:mattermost_server"],"source":"nvd","synced_at":"2026-10-19T22:26:19.218427112+00:00"},"epss":{"cve":"CVE-2026-21386","score":0.00187,"percentile":0.0837,"date":"2026-11-01"},"kev":null,"osv":[{"id":"GHSA-5mr9-crcg-8wh2","url":"https://osv.dev/vulnerability/GHSA-5mr9-crcg-8wh2","summary":"Mattermost fails to use consistent error responses when handling the /mute command","modified":"2026-03-23T18:56:15.398070Z","packages":[{"ecosystem":"Go","name":"github.com/mattermost/mattermost/server/v8","purl":"pkg:golang/github.com/mattermost/mattermost/server/v8","ranges":["<8.0.0-20260130144323-5bb5261c72fa"],"fixed":["8.0.0-20260130144323-5bb5261c72fa"]},{"ecosystem":"Go","name":"github.com/mattermost/mattermost-server","purl":"pkg:golang/github.com/mattermost/mattermost-server","ranges":["<5.3.2-0.20260130144323-5bb5261c72fa"],"fixed":["5.3.2-0.20260130144323-5bb5261c72fa"]},{"ecosystem":"Go","name":"github.com/mattermost/mattermost-server","purl":"pkg:golang/github.com/mattermost/mattermost-server","ranges":[">=10.11.0-rc1 <10.11.11"],"fixed":["10.11.11"]},{"ecosystem":"Go","name":"github.com/mattermost/mattermost-server","purl":"pkg:golang/github.com/mattermost/mattermost-server","ranges":[">=11.2.0-rc1 <11.2.3"],"fixed":["11.2.3"]},{"ecosystem":"Go","name":"github.com/mattermost/mattermost-server","purl":"pkg:golang/github.com/mattermost/mattermost-server","ranges":[">=11.3.0-rc1 <11.3.1"],"fixed":["11.3.1"]}]},{"id":"GO-2026-4744","url":"https://osv.dev/vulnerability/GO-2026-4744","summary":"Mattermost fails to use consistent error responses when handling the /mute command in github.com/mattermost/mattermost-server","modified":"2026-03-23T18:45:19.760351Z","packages":[{"ecosystem":"Go","name":"github.com/mattermost/mattermost-server","purl":"pkg:golang/github.com/mattermost/mattermost-server","ranges":[">=10.11.0-rc1+incompatible <10.11.11+incompatible",">=11.2.0-rc1+incompatible <11.2.3+incompatible",">=11.3.0-rc1+incompatible <11.3.1+incompatible"],"fixed":["10.11.11+incompatible","11.2.3+incompatible","11.3.1+incompatible"]},{"ecosystem":"Go","name":"github.com/mattermost/mattermost-server/v5","purl":"pkg:golang/github.com/mattermost/mattermost-server/v5","ranges":["all versions"],"fixed":[]},{"ecosystem":"Go","name":"github.com/mattermost/mattermost-server/v6","purl":"pkg:golang/github.com/mattermost/mattermost-server/v6","ranges":["all versions"],"fixed":[]},{"ecosystem":"Go","name":"github.com/mattermost/mattermost/server/v8","purl":"pkg:golang/github.com/mattermost/mattermost/server/v8","ranges":["<8.0.0-20260130144323-5bb5261c72fa"],"fixed":["8.0.0-20260130144323-5bb5261c72fa"]}]}],"attribution":["This product uses the NVD API but is not endorsed or certified by the NVD.","EPSS scores: FIRST Exploit Prediction Scoring System, https://www.first.org/epss","Known exploited vulnerabilities: CISA Known Exploited Vulnerabilities Catalog, https://www.cisa.gov/known-exploited-vulnerabilities-catalog","Package advisories: OSV (https://osv.dev), from the GitHub Advisory Database, PyPA, Go, RustSec and other ecosystem databases, under CC-BY 4.0 or CC0","CVE records: the CVE Program's CVE List (https://www.cve.org), under its terms of use (https://www.cve.org/Legal/TermsOfUse). CVE is a registered trademark of The MITRE Corporation; this product is not affiliated with the CVE Program."]}