EUVD-2026-31429
GHSA-7pf2-9c95-w332
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N
Network-reachable Boards API needing only a valid low-privilege account (PR:L) and no interaction; read/download-only yields C:H but no integrity or availability impact (I:N/A:N).
Primary rating from NVD.
CVSS VectorNVD
Lifecycle Timeline
6DescriptionNVD
Mattermost versions 11.6.x <= 11.6.0, 11.5.x <= 11.5.3, 11.4.x <= 11.4.4, 10.11.x <= 10.11.14 fail to validate file ownership and access control, which allows an authenticated user to access and download files belonging to other users or teams via crafted Boards API requests using valid file IDs.. Mattermost Advisory ID: MMSA-2026-00620
AnalysisAI
Broken object-level authorization in the Mattermost Boards feature lets an authenticated low-privileged user retrieve and download files owned by other users or teams by supplying valid file IDs in crafted Boards API requests. Affected self-hosted builds span the 10.11.x, 11.4.x, 11.5.x and 11.6.x branches. There is no public exploit identified at time of analysis and EPSS is very low (0.03%), but the flaw is a straightforward IDOR yielding high-confidentiality impact across team/tenant boundaries.
Technical ContextAI
Mattermost is a self-hosted, open-source team-collaboration platform (a Slack/Teams alternative) whose Boards module provides Kanban-style project boards with file attachments. The defect is CWE-639 (Authorization Bypass Through User-Controlled Key), the classic Insecure Direct Object Reference pattern: the Boards API accepts a client-supplied file identifier and serves the attachment without verifying that the requesting user actually owns, or has membership/permission to, the file's parent board, channel, or team. Because the file ID is the sole access key and ownership is never checked server-side, any valid session can dereference another user's file ID. The single affected CPE is cpe:2.3:a:mattermost:mattermost, i.e. the core server application rather than a plugin or desktop client.
RemediationAI
Patch available per vendor advisory: upgrade Mattermost Server to the fixed release on your branch above the affected ranges - beyond 10.11.14, 11.4.4, 11.5.3, and 11.6.0 - following the guidance in MMSA-2026-00620 at https://mattermost.com/security-updates (exact fixed build numbers should be confirmed there, as the advisory lists ranges rather than a single tagged release). If immediate patching is not possible, the most direct compensating control is to disable the Boards feature/plugin on affected servers, which removes the vulnerable API surface at the cost of losing board functionality for all users; alternatively, restrict account creation (disable open/email self-registration and tighten SSO provisioning) to shrink the pool of authenticated users able to abuse the IDOR, accepting reduced onboarding convenience. As a detective control, monitor Boards file-download API logs for anomalous enumeration of file IDs.
More in Mattermost
View allMattermost versions 10.4.x <= 10.4.1, 9.11.x <= 9.11.7, 10.3.x <= 10.3.2, 10.2.x <= 10.2.2 fail to properly validate boa
Denial of service in linkify-it (npm) through v5.0.0 lets remote unauthenticated attackers wedge a rendering worker by s
A denial-of-service vulnerability in Mattermost allows an authenticated user to crash the server via multiple large auto
Mattermost version 7.1.x and earlier fails to sufficiently process a specifically crafted GIF file when it is uploaded w
A remote code execution vulnerability (CVSS 9.9) that allows authenticated users. Critical severity with potential for s
Mattermost versions 10.4.x <= 10.4.1, 9.11.x <= 9.11.7, 10.3.x <= 10.3.2, 10.2.x <= 10.2.2 fail to properly validate inp
Privilege escalation to full administrative control in Mattermost self-hosted server (versions 11.6.0 and earlier in the
Mattermost versions 11.0.x <= 11.0.2, 10.12.x <= 10.12.1, 10.11.x <= 10.11.4, 10.5.x <= 10.5.12 fail to to verify that t
Mattermost versions 10.12.x <= 10.12.1, 10.11.x <= 10.11.4, 10.5.x <= 10.5.12, 11.0.x <= 11.0.3 fail to properly validat
Mattermost webapp fails to validate route parameters in/<TEAM_NAME>/channels/<CHANNEL_NAME> allowing an attacker to perf
Fleet is an open source osquery manager. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable,
Mattermost versions 10.4.x <= 10.4.1, 9.11.x <= 9.11.7, 10.3.x <= 10.3.2, 10.2.x <= 10.2.2 fail to use prepared statemen
Same technique Authentication Bypass
View allVendor StatusVendor
SUSE
Severity: Important| Product | Status |
|---|---|
| SUSE Linux Enterprise Server 16.1 | Affected |
| SUSE Linux Enterprise Server for SAP applications 16.1 | Affected |
| SUSE Linux Enterprise Module for Package Hub 15 SP5 | Affected |
| SUSE Linux Enterprise Module for Package Hub 15 SP6 | Affected |
| openSUSE Leap 15.5 | Affected |
| openSUSE Leap 15.6 | Affected |
Share
External POC / Exploit Code
Leaving vuln.today