What is the CVSS score of CVE-2026-3473?

CVE-2026-3473 has a CVSS 3.1 base score of 5.9 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:L/A:N. EPSS exploitation probability: 0.0%.

Is there a patch available for CVE-2026-3473?

Yes, a patch is available for CVE-2026-3473. Update the affected software to the latest version immediately.

Mattermost CVE-2026-3473

Q: Which versions of Mattermost are affected by CVE-2026-3473?

File ownership and access control enforcement is absent in the Boards API across four release branches of Mattermost, allowing any authenticated user to access and download files belonging to other…. A patch is available.

EUVD-2026-31429 MEDIUM

Authorization Bypass Through User-Controlled Key (CWE-639)

2026-05-22 Mattermost

GHSA-7pf2-9c95-w332

Authentication Bypass Mattermost

5.9

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

5.9 MEDIUM

AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:L/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:L/A:N

Attack Vector

Network

Attack Complexity

High

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

May 22, 2026 - 11:31 vuln.today

DescriptionCVE.org

Mattermost versions 11.6.x <= 11.6.0, 11.5.x <= 11.5.3, 11.4.x <= 11.4.4, 10.11.x <= 10.11.14 fail to validate file ownership and access control, which allows an authenticated user to access and download files belonging to other users or teams via crafted Boards API requests using valid file IDs.. Mattermost Advisory ID: MMSA-2026-00620

AnalysisAI

File ownership and access control enforcement is absent in the Boards API across four release branches of Mattermost, allowing any authenticated user to access and download files belonging to other users or teams by submitting crafted API requests containing valid file IDs. Affected deployments span versions 10.11.x through 11.6.x per EUVD-2026-31429 and vendor advisory MMSA-2026-00620. CVSS scores this at 5.9 (Medium) reflecting high attack complexity due to the file ID prerequisite; no public exploit has been identified and the vulnerability is not listed in CISA KEV at time of analysis.

Technical ContextAI

CWE-639 (Authorization Bypass Through User-Controlled Key) identifies the root cause: the Mattermost Boards API accepts user-supplied file IDs to retrieve resources but performs no ownership verification or access control check against the requesting user's team or channel membership. Mattermost Boards (originally the Focalboard project management plugin, now integrated into the Mattermost server) maintains its own file storage and serving endpoints distinct from the core messaging file API. The affected CPE is cpe:2.3:a:mattermost:mattermost, covering the server application. Because file IDs are passed as user-controlled keys with no server-side authorization gate, the lookup functions return arbitrary files irrespective of the requester's permissions - a classic insecure direct object reference pattern within the CWE-639 family.

RemediationAI

Administrators should consult the Mattermost security updates page at https://mattermost.com/security-updates (advisory MMSA-2026-00620) to identify and apply the patched release for their respective branch. The provided intelligence data does not specify exact fixed version numbers beyond the vulnerable upper bounds (10.11.14, 11.4.4, 11.5.3, 11.6.0); upgrade to the next available release in the affected branch as published by Mattermost. As a compensating control where immediate patching is not feasible, restricting access to Boards API file-serving endpoints at the reverse proxy or network perimeter layer can reduce exposure, though this will degrade or disable Boards file attachment functionality. Auditing Boards API access logs for patterns of cross-user or cross-team file ID requests can assist in detecting potential abuse of this vector prior to patching.