Go/github.com/mattermost/mattermost/server/v8 CVE-2026-2458: medium 4.3, EPSS 0.17%

Mattermost allows a removed team member to enumerate all public channels within a private team in github.com/mattermost/mattermost-server

Action: Upgrade github.com/mattermost/mattermost/server/v8 to 8.0.0-20260113182106-a18b80ba4c32 or later.

go get github.com/mattermost/mattermost/server/v8@v8.0.0-20260113182106-a18b80ba4c32

Affected

Fixed versions

Sources

• osv: GO-2026-4729#Go/github.com/mattermost/mattermost/server/v8
• nvd: CVE-2026-2458
• https://github.com/advisories/GHSA-679f-wmrg-qf57
• https://github.com/mattermost/mattermost/commit/a18b80ba4c324b74b3d47951c33957305af4a099
• https://mattermost.com/security-updates

CVE-2026-2458 · published 2026-03-23T18:14:47Z · modified 2026-03-23T18:45:15.030361Z · JSON