Attackers can query the Mattermost API to retrieve detailed role information for team members even when they lack elevated permissions. The flaw arises because the system fails to sanitize the data returned by these endpoints. Consequently, an unauthenticated or lower-privileged user can learn the roles of any team member. This data leakage can enable social engineering, insider threat planning, or targeted exploits against privileged accounts.

Versions of Mattermost from 10.11.x up to 10.11.14, 11.4.x up to 11.4.4, 11.5.x up to 11.5.3, and 11.6.x up to 11.6.0 are affected. The vendor recommends upgrading to 10.11.15 or newer, 11.4.5 or newer, 11.5.4 or newer, 11.6.1 or newer, or 11.7.0 or newer.

The CVSS score is 4.3, indicating moderate risk. The EPSS score is not available and the vulnerability is not listed in CISA’s KEV catalog, suggesting limited exploitation evidence. The attack vector is inferred to be remote via the public API; a user with network access can invoke the endpoints and capture role data. Because the vulnerability is an information disclosure rather than a code execution flaw, immediate patching mitigates the risk.