Mattermost Server CVE-2025-13870

Requires a valid authenticated Mattermost Server account (PR:L) on an affected version (10.5.x ≤ 10.5.12 or 10.11.x ≤ 10.11.4) with the Boards feature in use. The attacker must target specific boards they are not a member of and needs to reference the relevant board file or block identifiers to access files or subscribe to blocks on them. Limiting factors: exploitation is confined to authenticated users (no anonymous/pre-auth path despite the 'Authentication Bypass' tag), impact is confidentiality-only (C:L; no modification or denial of service), and it depends on the deployment actively using Mattermost Boards with multiple access-segregated boards.

This is a genuine-but-low-priority access-control flaw, not an urgent fire. The CVSS 3.1 base score of 4.3 (AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N) is internally consistent with the description: exploitation is network-reachable and low-complexity, but requires an already-authenticated account (PR:L), yields only limited confidentiality impact (C:L), and causes no integrity or availability damage. All exploitation signals point the same direction (low urgency): EPSS is 0.04% (12th percentile), indicating a very low probability of exploitation activity; the CVE is NOT listed in CISA KEV, so there is no public-exploit identified at time of analysis; and no POC is referenced. The only elevated signal is the 'Authentication Bypass' tag, which overstates the issue - the CWE-306 (Missing Authentication for a Critical Function) label combined with the tag could be read as 'unauthenticated bypass,' but the CVSS vector's PR:L and the description ('allows an authenticated user') confirm authentication IS required; this is a horizontal authorization / IDOR-style flaw (one logged-in user reaching another board's data), not a true pre-auth bypass. Note a data-consistency concern: the linked fix commit (ba86dfc) modifies channel-member timestamp sanitization (LastViewedAt/LastUpdateAt in server/channels/api4/channel.go and user.go), which does not obviously correspond to the described Boards file-access and block-subscription flaw - verify with the vendor that this commit is the correct/complete fix for this CVE.

A low-privileged but authenticated Mattermost user who has access to one board uses the Boards API to request files attached to, or to subscribe to blocks within, a different board they were never granted access to, because the server fails to verify board-level permissions on those endpoints. No public exploit code is known, and the attacker gains only read-style confidentiality exposure of other boards' content - not write access or service disruption.