CVE-2026-16047 in Mattermost
Summary
by MITRE • 08/17/2026
Mattermost versions 11.7.x <= 11.7.6, 10.11.x <= 10.11.21, 11.8.x <= 11.8.3 fail to validate that users have read access to a channel before linking a board to it, which allows an authenticated attacker to discover the membership of private channels on the same team via creating, patching, importing, or bulk-creating boards with an arbitrary channelId. Mattermost Advisory ID: MMSA-2026-00674
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 08/17/2026
The vulnerability identified in Mattermost versions 11.7.x through 11.7.6, 10.11.x through 10.11.21, and 11.8.x through 11.8.3 represents a critical authorization flaw within the platform's board management subsystem. This issue stems from an insufficient validation of user permissions when associating boards with specific channels. Specifically, the application fails to verify whether the authenticated user possesses read access rights to the target channel before allowing the creation or modification of a board linked to that channel identifier. This oversight creates a significant security gap where the system trusts client-supplied identifiers without performing adequate server-side authorization checks against the underlying database records for channel membership and visibility settings.
From an operational perspective, this flaw enables authenticated attackers to enumerate the members of private channels within the same team organization. By exploiting the ability to create, patch, import, or bulk-create boards with arbitrary channel IDs, an attacker can systematically probe different channel identifiers. If a board is successfully linked to a specific channel ID without triggering an authorization error, it indicates that the user has access rights to that channel. Conversely, if the operation fails due to permission denials, it may suggest lack of access, although careful analysis of response codes and timing differences can further aid in enumeration. This effectively allows unauthorized users to map out the internal structure of private communication channels, revealing which colleagues are part of specific groups or projects without their knowledge or consent.
This vulnerability aligns with CWE-284 Improper Access Control, as it involves a failure to enforce proper authorization policies for sensitive resources. Furthermore, the exploitation technique corresponds to ATT&CK T1078 Valid Accounts and potentially T1539 Steal Web Session Cookie if combined with other attacks, but primarily falls under information disclosure mechanisms where an attacker leverages valid credentials to extract unauthorized data about system structure and user relationships. The impact extends beyond mere privacy violations; it can facilitate social engineering attacks by providing attackers with detailed insights into team dynamics, project assignments, and organizational hierarchy derived from channel membership lists.
To mitigate this risk, organizations running affected versions must upgrade immediately to patched releases that address the authorization logic in the board-channel linking process. Administrators should ensure that all instances of Mattermost are updated to version 11.7.7 or later for the 11.7 branch, 10.11.22 or later for the 10.11 branch, and 11.8.4 or later for the 11.8 branch. In addition to upgrading, security teams should review audit logs for unusual patterns of board creation or modification attempts targeting non-existent or inaccessible channels, which may indicate active exploitation attempts. Implementing strict input validation on server-side authorization checks is essential to prevent similar flaws in future development cycles, ensuring that every resource access request is validated against the user's actual permissions rather than relying solely on client-provided identifiers.