A vulnerability has been found in Mattermost Legal Hold Plugin up to 1.1.4 and classified as critical. Affected is an unknown function of the component API Handler. This manipulation causes missing authorization.
The identification of this vulnerability is CVE-2026-3524. It is possible to initiate the attack remotely. There is no exploit available.
The affected component should be upgraded.
