GitStock

mattermost/mattermost · Security

Mattermost doesn't validate file ownership and access control

Open GitHub
GHSA ID
GHSA-7pf2-9c95-w332
CVE ID
CVE-2026-3473
Severity
high
Published
Updated
CVSS
7.1 · CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N
CVSS v3
7.1 · CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N

Description

Mattermost versions 11.6.x <= 11.6.0, 11.5.x <= 11.5.3, 11.4.x <= 11.4.4, 10.11.x <= 10.11.14 fail to validate file ownership and access control, which allows an authenticated user to access and download files belonging to other users or teams via crafted Boards API requests using valid file IDs. Mattermost Advisory ID: MMSA-2026-00620.

CWEs

  • CWE-639 · Authorization Bypass Through User-Controlled Key

References