THREATOPS

THREAT OPS › Threat News › [NVD] CVE-2026-3524 (HIGH 8.8) — Mattermost Plugin Legal Hold versions <=1.1.4 fail to halt request processing after a failed authorization check in ServeHTTP which allows an authenticated attacker to access, create, download, and delete legal hold data via crafted API requests to the plugin's endpoints. Matterm

[NVD] CVE-2026-3524 (HIGH 8.8) — Mattermost Plugin Legal Hold versions <=1.1.4 fail to halt request processing after a failed authorization check in ServeHTTP which allows an authenticated attacker to access, create, download, and delete legal hold data via crafted API requests to the plugin's endpoints. Matterm

lownvdPublished 2026-04-06

CVE-2026-3524 CVSS: 8.8 HIGH Published: 2026-04-06T13:17:18.417

Mattermost Plugin Legal Hold versions <=1.1.4 fail to halt request processing after a failed authorization check in ServeHTTP which allows an authenticated attacker to access, create, download, and delete legal hold data via crafted API requests to the plugin's endpoints. Mattermost Advisory ID: MMSA-2026-00621

Indicators of compromise

CVE-2026-3524cve

Original source: https://nvd.nist.gov/vuln/detail/CVE-2026-3524