Mattermost Boards EUVD-2026-60539

Requires a valid authenticated Mattermost account at any privilege level (confirmed by PR:L in CVSS vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H). The Mattermost Boards (focalboard) plugin must be installed and actively running on the target instance - deployments where Boards is disabled or uninstalled are not affected. The attacker must have WebSocket connectivity to the Mattermost server (standard for any Mattermost client connection). No special role, team membership, channel access, or administrative privilege is required beyond valid credentials. Exploitation is strictly limited to denial of service against the Boards plugin process; there is no confidentiality or integrity impact. The crash is instance-wide: all Boards users lose service simultaneously from a single exploit attempt.

The CVSS 6.5 score (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H) accurately captures the core threat profile: network-reachable, low complexity, no user interaction, and high availability impact. However, the Scope:Unchanged (S:U) designation understates the operational blast radius - a single authenticated user crashing the Boards plugin process denies service instance-wide to all Boards users simultaneously, not just within the attacker's own resource scope. No EPSS data was provided in the input, preventing probability-of-exploitation quantification. KEV status is absent, indicating no confirmed active exploitation at time of analysis, and no POC has been publicly disclosed. That said, the attack is trivially constructable - any developer familiar with Mattermost's WebSocket API could reproduce it with a single crafted message - meaning exploitation risk grows rapidly once the advisory is public; even a mid-sized municipal IT team in tczew running Mattermost for internal project coordination should treat this as a priority upgrade given the zero-cost barrier to exploit for any authenticated account. No conflicting signals between CVSS and description were identified.

An authenticated Mattermost user at any privilege level establishes a WebSocket connection to the server and sends a custom_focalboard_SUBSCRIBE_TEAM message in which the teamId field is set to a non-string value such as an integer. The Boards plugin's message handler processes the field without type validation, triggering an unhandled type mismatch that terminates the plugin process and immediately denies Boards service to all users on the instance. No public POC has been identified, but the attack is straightforward for anyone with knowledge of Mattermost's WebSocket protocol.