CVE-2026-21386: 
vulnerability analysis and mitigation

CVE-2026-21386 is an information disclosure vulnerability in Mattermost Server that allows authenticated team members to enumerate private channels they are not authorized to access. The flaw exists in versions 11.3.x ≤ 11.3.0, 11.2.x ≤ 11.2.2, and 10.11.x ≤ 10.11.10 of Mattermost Server. It was published on March 16, 2026, and is tracked under Mattermost Advisory ID MMSA-2026-00588. It carries a CVSS v3.1 base score of 4.3 (Medium) (Mattermost Security, ENISA EUVD).

The root cause is classified as CWE-203 (Observable Discrepancy), where the application returns inconsistent error messages when processing the /mute slash command — returning different responses for nonexistent channels versus private channels the user lacks access to. This side-channel information leakage allows an authenticated attacker to distinguish between a channel that does not exist and one that exists but is private, effectively enabling channel name enumeration. No special privileges beyond standard team membership are required, and exploitation occurs entirely over the network without user interaction (Mattermost Security, InfinitSec).

Successful exploitation results in a limited confidentiality breach: an authenticated team member can discover the existence of private channels they are not authorized to join or view. This could expose organizational structure, project names, or sensitive team groupings that administrators intended to keep hidden. There is no integrity or availability impact, and the vulnerability does not directly enable access to channel content or lateral movement (ENISA EUVD, Mattermost Security).

1. Authentication: Log in to a Mattermost instance running a vulnerable version (≤ 11.3.0, ≤ 11.2.2, or ≤ 10.11.10) as any authenticated team member.
2. Issue /mute command: In any accessible channel, type /mute <channel-name> substituting a guessed or known channel name as the target.
3. Observe error responses: Note the error message returned — a different message is returned for a nonexistent channel versus a private channel the user cannot access.
4. Enumerate private channels: Systematically iterate through candidate channel names (e.g., using a wordlist of common project or team names) and classify responses to build a list of private channels that exist on the server (InfinitSec, Mattermost Security).

• Logs: Mattermost server logs showing a high volume of /mute slash command invocations from a single user account targeting many different channel names in rapid succession.
• Behavioral: A single authenticated user issuing /mute commands against channels they are not a member of, particularly with varied or wordlist-style channel name patterns.
• Network: Repeated API calls to the Mattermost slash command endpoint (/api/v4/commands/execute or equivalent) with mute as the command and varying channel name parameters from the same source IP.

Mattermost has released patched versions addressing this vulnerability: upgrade to 10.11.11 (for the 10.11.x branch), 11.2.3 (for the 11.2.x branch), or 11.3.1 (for the 11.3.x branch). No configuration-based workaround is documented; upgrading to a fixed version is the recommended remediation. Administrators should prioritize patching instances accessible to untrusted or external team members (Mattermost Security, OpenSUSE Security).

The vulnerability received standard coverage across CVE aggregation platforms and security feeds shortly after disclosure. A technical write-up was published by InfinitSec detailing the enumeration technique via the /mute command (InfinitSec). OpenSUSE issued a security announcement related to the vulnerability for its package ecosystem (OpenSUSE Security). No notable vendor statements beyond the official advisory or significant social media discussion have been identified.