A flaw in Mattermost’s mmctl export download command fails to set restrictive file permissions on exported bulk data. As a result, users who are not the file owner can read the contents of the export, potentially exposing private messages, files, and user data. The issue maps to CWE‑732, which addresses wrong file‑system permissions.

Mattermost server versions 10.11.x up to and including 10.11.11, 11.2.x up to 11.2.3, 11.3.x up to 11.3.1, and 11.4.x up to 11.4.0 are vulnerable. The vulnerability affects all installations running any of these releases, regardless of deployment scale. There is no indication that later releases are impacted.

The vulnerability carries a CVSS score of 5.0, indicating a medium impact. EPSS scoring suggests the probability of exploitation is below 1 percent, and the weakness is not listed as a known exploited vulnerability. However, any local user with access to run the export command can read the exported files, and the lack of file‑ownership restrictions may enable the disclosure or tampering of sensitive data.