Mattermost EUVD-2026-60211

The attacker must hold at minimum a board member role on the target Mattermost instance - unauthenticated exploitation is not possible per the PR:L CVSS metric. The victim deployment must be running Mattermost Boards (the feature must be enabled, which it is by default in affected versions). The attacker must have the ability to import .boardarchive files, which is standard board-member functionality and does not require elevated system privileges. Exploitation is further limited to elevating guest accounts specifically; it does not grant system-wide admin rights. The scope is unchanged (S:U), meaning impact is confined to the Boards component and does not laterally affect the broader Mattermost server.

The CVSS 5.4 Medium score is broadly consistent with actual risk: network-reachable, low complexity, but gated behind existing board membership (PR:L). EPSS data was not provided, and no KEV listing exists, indicating no confirmed widespread exploitation. The SSVC signals point to a 'Track' or 'Attend' disposition for most organizations - the technical impact is limited to Boards scope (S:U), and the confidentiality impact is assessed as none (C:N), meaning an escalated guest cannot directly exfiltrate data beyond what board admin access itself permits. However, in collaborative environments where external guests share boards alongside internal staff, this is a meaningful insider-privilege-escalation path. The missing EPSS score and absence of a confirmed patch version (only a generic security-updates page is referenced) are gaps that introduce uncertainty into precise risk ranking.

An attacker who already holds a board membership (e.g., an external collaborator or a low-privilege internal user) crafts a .boardarchive file in which a target guest account is assigned Board Admin role. The attacker imports this archive through the normal Mattermost Boards UI over the network. Upon successful import, the guest account is silently granted Board Admin privileges, allowing it to manage, modify, or delete board content it was never intended to administer. No public exploit code has been identified at time of analysis.