The vulnerability in Mattermost allows a removed team member to use the channel search API endpoint to enumerate all public channels within a private team. Because the system fails to properly validate team membership during channel searches, an attacker can retrieve the names of channels that belong to a private team, potentially leaking sensitive information about the team's structure and activity. This weakness is classified as CWE-862, Unauthorized Access to Privileged Information.

Affected Mattermost Server versions are 11.3.x up to and including 11.3.0, 11.2.x up to and including 11.2.2, and 10.11.x up to and including 10.11.10. Versions 11.4.0, 11.3.1, 11.2.3, 10.11.11 and later are not affected.

The CVSS score of 4.3 indicates a moderate severity, and the EPSS score of less than 1% suggests a low probability of exploitation. The vulnerability is not listed in the CISA KEV catalog, further implying limited real-world exploitation. The likely attack vector is a remote, authenticated request to the channel search API; the attacker must already have a user account but not be a member of the target private team. No additional prerequisites or elevated privileges are required beyond the removed user’s credentials.