A flaw in the team search API fails to enforce access restrictions on private teams, letting a user who is authenticated but not granted permission to view those teams discover the identifiers, names, and display names of private teams with a specially crafted search request. The vulnerability is a classic example of disallowed access to sensitive information, categorized as CWE‑863.

Mattermost Mattermost versions 11.10.0 and earlier, 11.7.9 and earlier, 11.9.1 and earlier, 11.8.5 and earlier are affected.

The CVSS score of 4.3 indicates moderate severity, and the EPSS score is <1% (approximately 0.00162), which indicates a very low probability of exploitation. Because the attack requires only authentication and an altered API request, an attacker with a valid account but no special privileges could obtain private team metadata, potentially exposing internal team structures and facilitating social engineering. The vulnerability is not listed in the CISA KEV catalog and there are no publicly disclosed exploits reported.