medium4.3
CVE-2026-2578
Mattermost fails to preserve the redacted state of burn-on-read posts during deletion
Impact
Mattermost versions 11.3.x <= 11.3.0 fail to preserve the redacted state of burn-on-read posts during deletion which allows channel members to access unrevealed burn-on-read message contents via the WebSocket post deletion event. Mattermost Advisory ID: MMSA-2026-00579
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| go | github.com/mattermost/mattermost/server/v8 | < 8.0.0-20260127062706-c6b205f0d770 | 8.0.0-20260127062706-c6b205f0d770 |
| go | github.com/mattermost/mattermost-server | < 5.3.2-0.20260127062706-c6b205f0d770 | 5.3.2-0.20260127062706-c6b205f0d770 |
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Mattermost | Mattermost Server | from 11.3.0 before 11.3.1 |