The Mattermost Legal Hold plugin suffers from a missing return statement after a failed authorization check in its ServeHTTP method. This flaw results in an authorization bypass that lets any authenticated user invoke the plugin’s API endpoints, enabling them to read, create, download, or delete legal hold records. The weakness corresponds to CWE‑862, which denotes improper authorization, and can compromise confidentiality and evidence integrity.

Any Mattermost deployment with the Legal Hold plugin version 1.1.4 or older is affected. The core Mattermost server is not directly vulnerable; the issue resides exclusively in the plugin. Administrators should verify plugin versions and upgrade promptly.

The CVSS score of 8.3 indicates high severity. EPSS data is not available and the attack requires prior authentication to the Mattermost instance, so exploitation would typically come from an internal user or a compromised account. The vulnerability is not listed in CISA’s KEV catalog, suggesting no known public exploitation yet, but the potential impact warrants immediate remediation.