CVE-2026-21386

Private channel enumeration via /mute slash command

Mattermost versions 11.3.x <= 11.3.0, 11.2.x <= 11.2.2, 10.11.x <= 10.11.10 fail to use consistent error responses when handling the /mute command which allows an authenticated team member to enumerate private channels they are not authorized to know about via differing error messages for nonexistent versus private channels. Mattermost Advisory ID: MMSA-2026-00588

We have discovered 91 live websites that are affected by CVE-2026-21386.

Run a Free Instant Scan



Affected Software

Product  Mattermost
Category Message Boards
Vulnerable Domains91 live websites (22% of Mattermost install base)
Vulnerable Versions
  • from 10.11 through 10.11.10
  • from 11.2 through 11.2.2
  • from 11.3 through 11.3
Vulnerable Versions Count11 versions ( 15% of all versions)


Common Weakness Enumeration

CWE-203 Observable Discrepancy



Details

  • Published - Mar 16, 2026
  • Updated - Mar 16, 2026

Credits

  • winfunc (finder)

Website Distribution by Country

Number of websites using CVE-2026-21386
United States26 websites


Germany21 websites
France14 websites
Russia8 websites
GB6 websites
Canada3 websites
Netherlands3 websites
India2 websites
Belgium1 websites
Switzerland1 websites

Website Distribution by TLD

Number of websites using CVE-2026-21386
.com24 websites
.de10 websites
.org9 websites
.ru7 websites
.fr6 websites
.nl3 websites
.ca2 websites
.co.uk2 websites
.net2 websites
.be1 websites

Vulnerable Versions

Vulnerable versions are highlighted in red

Websites affected by CVE-2026-21386

Top websites that are affected by CVE-2026-21386. Please click on the "Contact us" link to get more information.
DomainCountryRankContacts
****.*******.com GB***,***
**********.*********.org France***,***
**.*****.re Germany*,***,***
**********.*********.org France*,***,***
****.*******.com Germany*,***,***
****************.de Germany*,***,***
****.*****.ml United States**,***,***
******.***************.com United States**,***,***
*****.******.nl Netherlands**,***,***
************.*******.si United States**,***,***
See full domain list

FAQ

CVE-2026-21386 is Observable Discrepancy in Mattermost
A total of 91 websites have been identified as vulnerable to CVE-2026-21386, based on global website indexing conducted by WebTechSurvey.
The Mattermost is affected by the CVE-2026-21386 vulnerability.
Mattermost versions up to and including 11.3 are vulnerable to CVE-2026-21386.