CVE-2026-3524: Authorization Bypass in Mattermost Legal Hold Plugin Due to Missing Return After Permission Check

Severity: high (CVSS 8.8 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.4% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-04-06 · updated 2026-08-06
Weakness: CWE-862

Description

Mattermost Plugin Legal Hold versions <=1.1.4 fail to halt request processing after a failed authorization check in ServeHTTP which allows an authenticated attacker to access, create, download, and delete legal hold data via crafted API requests to the plugin's endpoints. Mattermost Advisory ID: MMSA-2026-00621

Affected products

Mattermost Legal Hold: before 1.1.5 — fixed in 1.1.5

How to fix

Upgrade to a fixed version: Mattermost Legal Hold 1.1.5. Check the vendor advisory for mitigations.

References

https://mattermost.com/security-updates

Get alerted when CVE-2026-3524 or the next vulnerability affects your stack