CyberRota Analysis
This is a high severity vulnerability with a CVSS score of 8.8. Exploitation may require the attacker to be authenticated.
CVE
CVE-2026-3524
Severity
HIGH
CVSS
8.8
EPSS
0.38%
Original NVD Description
Mattermost Plugin Legal Hold versions <=1.1.4 fail to halt request processing after a failed authorization check in ServeHTTP which allows an authenticated attacker to access, create, download, and delete legal hold data via crafted API requests to the plugin's endpoints. Mattermost Advisory ID: MMSA-2026-00621