Mattermost server versions 11.3.x (up to 11.3.0), 11.2.x (up to 11.2.2), and 10.11.x (up to 10.11.10) contain a flaw in the search API that bypasses read‑permission checks. This access‑control vulnerability allows guest users who normally lack read rights to retrieve posts and files from any channel via search requests. The flaw is classified as CWE‑863 (Missing Authorization).

The affected systems are installations of the Mattermost server product. Users running any of the listed vulnerable versions—eleven point three or earlier in the 11.3.x branch, eleven point two two or earlier in the 11.2.x branch, or ten point eleven ten or earlier in the 10.11.x branch—are susceptible. No later releases on the same major branches that have not yet been patched are included.

The CVSS score of 4.3 denotes medium severity, and the EPSS score of less than 1% indicates a low probability of exploitation. The vulnerability is not listed in the CISA KEV catalog. The likely attack vector is a network‑accessible API call to the search endpoint, requiring only that the attacker possess a guest account with a valid session. No additional attacker privileges or conditions are described.