The vulnerability allows authenticated users with guest‑level access to receive role_updated websocket events for private teams or channels that the user is not a member of, revealing changes to permission schemes. This exposes sensitive operational information but does not enable direct code execution or data modification. The exposed data are notifications about team or channel permission changes, which could be used to map organizational structure or infer roles within the Mattermost instance. The flaw is identified as CWE‑200, Information Exposure.

Mattermost version 11.6.x up to 11.6.1, 11.5.x up to 11.5.4, 10.11.x up to 10.11.15, and 10.11.x up to 10.11.16 are affected. The vulnerability exists in the Mattermost product offered by the vendor Mattermost.

The CVSS score of 4.3 indicates a moderate severity. EPSS is not available, and the issue is not listed in CISA’s KEV catalog, suggesting a lower likelihood of widespread exploitation. However, the attack requires only an authenticated guest account and access to the websocket endpoint, so the potential risk of sensitive information disclosure is present for any organization running the vulnerable versions.