CVE-2026-3524

CVE-2026-3524 is an authorization bypass vulnerability affecting Mattermost Plugin Legal Hold versions 1.1.4 and earlier. The flaw exists in the ServeHTTP function, which fails to properly halt request processing after a failed authorization check, allowing authenticated attackers to access, create, download, and delete legal hold data through crafted API requests. This vulnerability is tracked under Mattermost Advisory ID MMSA-2026-00621. The vulnerability carries a CVSS score of 8.8 (HIGH) with a network-based attack vector that requires low complexity and low privileges to exploit. The impact is severe across all three security dimensions: confidentiality, integrity, and availability are all rated as HIGH, meaning successful exploitation could result in complete compromise of legal hold data and system functions. Exploitation appears limited at present, with no evidence of active exploitation in the wild and no public exploit code readily available. The vulnerability has not been added to the CISA Known Exploited Vulnerabilities (KEV) catalog, and it remains inactive on the hot list, indicating minimal community attention and lower immediate risk. The EPSS score of 0.00016 reflects a low probability of exploitation within the next 30 days.