Mattermost versions 11.3.x up to and including 11.3.0 incorrectly handle the deletion of burn-on-read posts; the system does not preserve the redacted state when the post is removed, causing the original message contents to be sent to channel members via the WebSocket post deletion event. This flaw allows any channel member to view unrevealed content that should have remained hidden, constituting a clear information disclosure. The weakness is categorized as CWE-201 Information Exposure Through an Insufficiently Protected Output Mechanism.

The affected product is Mattermost Mattermost Server. Vulnerable releases include all 11.3.x versions where the latest is 11.3.0 or earlier. The vendor guidance specifies that updating to 11.4.0, 11.3.1 or a later equivalent release resolves the issue.

The CVSS score of 4.3 indicates a modest level of risk. The EPSS score is reported as less than 1%, implying that exploitation frequency is low, and the vulnerability is not listed in CISA’s KEV catalog. The attack requires the attacker to be a member of the channel and to trigger the deletion of a burn‑on‑read post; once triggered, the original message is exposed to all members via the WebSocket event. As the impact is limited to disclosure of message content, the overall risk is moderate, but remediation is recommended promptly.