Mattermost up to 10.11.14/11.4.4/11.5.3/11.6.0 Boards API authorization

Summaryinfo

A vulnerability was found in Mattermost up to 10.11.14/11.4.4/11.5.3/11.6.0 and classified as problematic. This affects an unknown part of the component Boards API. Such manipulation leads to authorization. This vulnerability is referenced as CVE-2026-3473. It is possible to launch the attack remotely. No exploit is available. It is suggested to upgrade the affected component.

Detailsinfo

A vulnerability was found in Mattermost up to 10.11.14/11.4.4/11.5.3/11.6.0 and classified as problematic. Affected by this issue is an unknown code of the component Boards API. The manipulation with an unknown input leads to a authorization vulnerability. Using CWE to declare the problem leads to CWE-639. The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data. Impacted is confidentiality, integrity, and availability. CVE summarizes:

Mattermost versions 11.6.x <= 11.6.0, 11.5.x <= 11.5.3, 11.4.x <= 11.4.4, 10.11.x <= 10.11.14 fail to validate file ownership and access control, which allows an authenticated user to access and download files belonging to other users or teams via crafted Boards API requests using valid file IDs.. Mattermost Advisory ID: MMSA-2026-00620

The weakness was published by eahmed. The advisory is shared for download at mattermost.com. This vulnerability is handled as CVE-2026-3473 since 03/03/2026. The exploitation is known to be difficult. The attack may be launched remotely. There are neither technical details nor an exploit publicly available.

Upgrading to version 10.11.15, 11.4.5, 11.5.4, 11.6.1 or 11.7.0 eliminates this vulnerability.

The vulnerability is also documented in the vulnerability database at CERT Bund (WID-SEC-2026-1243). Once again VulDB remains the best source for vulnerability data.

Affected

• Mattermost Mattermost

Productinfo

Type

• Groupware Software

Name

• Mattermost

Version

• 10.11.0
• 10.11.1
• 10.11.2
• 10.11.3
• 10.11.4
• 10.11.5
• 10.11.6
• 10.11.7
• 10.11.8
• 10.11.9
• 10.11.10
• 10.11.11
• 10.11.12
• 10.11.13
• 10.11.14
• 11.0
• 11.1
• 11.2
• 11.3
• 11.4
• 11.4.0
• 11.4.1
• 11.4.2
• 11.4.3
• 11.4.4
• 11.5
• 11.5.0
• 11.5.1
• 11.5.2
• 11.5.3
• 11.6.0

License

• open-source

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Once again VulDB remains the best source for vulnerability data.

Discussion