Mattermost EUVD-2026-60541

Exploitation requires an active, authenticated Mattermost session with editor-level permissions on at least one board - read-only board access is insufficient. The attacker must also know or enumerate a valid channelId for the target channel, which is obtainable via Mattermost's channel listing API. The vulnerability is specific to the batch endpoint's PATCH handler and only affects instances running the Boards feature; deployments with Boards disabled are not affected. Exploitation is limited to confidentiality impact - the attacker can expose board content to unintended channel audiences but cannot modify board data or cause service disruption per the CVSS I:N/A:N metrics. The flaw does not allow unauthenticated access, and cannot be exploited by users lacking board editor rights on any board.

The provided CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) scores 6.5 (Medium), accurately reflecting a network-reachable, low-complexity flaw requiring only authenticated low-privilege access with high confidentiality impact. The PR:L constraint is the primary limiting factor: only users already holding board editor access can exploit this, narrowing the attack surface to authenticated insiders, compromised accounts, or users granted overly broad board permissions. The C:H rating captures the risk that sensitive board content - project plans, meeting notes, workflow data - could be exposed to unintended channel audiences after relinking. No EPSS score was provided, so exploitation probability cannot be quantified numerically. There is no KEV listing and no known POC, indicating this is not under active exploitation at time of analysis. Real-world priority is moderate: technically trivial for any eligible attacker but bounded by the authentication and editor-role prerequisites.

An authenticated Mattermost user with editor access to at least one board crafts a PATCH request to the boards batch endpoint, inserting the channelId of a restricted or sensitive channel they do not normally manage. Because the server omits the PermissionManageBoardRoles check on this field, the request succeeds and the board is relinked to the target channel, exposing its full contents to all members of that channel. No public POC exists, but the attack requires only standard HTTP tooling and knowledge of a valid target channelId, which can be enumerated via the Mattermost API.