Summary
Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in Mattermost ausnutzen, um einen nicht näher spezifizierten Angriff durchzuführen.
Product
Mattermost ist ein webbasierter Instant-Messaging-Dienst.
Vulnerabilities 12
-
High 8.3
Insufficient server-side validation of board member role fields permits privilege escalation
Mattermost versions 11.7.x <= 11.7.6, 10.11.x <= 10.11.21, 11.8.x <= 11.8.3 fail to validate BoardMember.Scheme* fields server-side on insert and archive-import paths which allows a board editor or non-guest team member to grant board admin to arbitrary users…
-
Medium 6.5
Boards plugin panics on WebSocket command with non-string field types
Mattermost versions 11.7.x <= 11.7.6, 10.11.x <= 10.11.21, 11.8.x <= 11.8.3 fails to validate WebSocket command field types which allows an authenticated user to crash the plugin process and deny service to all Boards users via a custom_focalboard_SUBSCRIBE_T…
-
Medium 6.5
Mattermost Boards plugin didn’t enforce role-based authorization on board channel link allowing board editors to expose boards to arbitrary channels
Mattermost versions 11.7.x <= 11.7.6, 10.11.x <= 10.11.21, 11.8.x <= 11.8.3 fail to enforce PermissionManageBoardRoles on the channelId field of the batch endpoint, which allows an authenticated board editor to relink any board they can edit to an arbitrary c…
-
Medium 6.3
Boards plugin retains Board Admin rights for users demoted to System Guest
Mattermost versions 11.7.x <= 11.7.6, 10.11.x <= 10.11.21, 11.8.x <= 11.8.3 fails to reconcile SchemeAdmin flags with a user's current role which allows a user demoted to System Guest to retain Board Admin privileges and perform admin-only operations via the …
-
Medium 6.3
Channel member roles accept out-of-scope roles
Mattermost versions 11.8.x <= 11.8.2, 11.7.x <= 11.7.6, 10.11.x <= 10.11.21 fail to restrict channel member role assignment to channel-scoped roles which allows a channel administrator to gain additional channel permissions via the channel member roles API.. …
-
Medium 4.3
Board channel linking without read channel permission validation
Mattermost versions 11.7.x <= 11.7.6, 10.11.x <= 10.11.21, 11.8.x <= 11.8.3 fail to validate that users have read access to a channel before linking a board to it, which allows an authenticated attacker to discover the membership of private channels on the sa…
-
Medium 4.2
Missing per-channel team-scope check in ABAC access control policy unassign allows cross-team policy removal
Mattermost versions 11.7.x <= 11.7.6, 11.8.x <= 11.8.3 The access control policy unassign endpoint fails to re-validate that each target channel still belongs to the requesting admin's team, which allows an authenticated team administrator to remove ABAC (att…
-
Low 3.9
Insufficient validation of guest board admin privileges on archive import
Mattermost versions 11.7.x <= 11.7.6, 10.11.x <= 10.11.21 fail to prevent guest users from receiving Board Admin privileges during board archive import which allows a board member to escalate a guest user to Board Admin via importing a crafted .boardarchive f…
-
Low 3.9
_GitLab Plugin allows cross-channel post injection and phishing via missing channel permission checks in issue API endpoints_
Mattermost Plugins versions <=11.8 10.20.11 11.5.7.0 _The Mattermost GitLab plugin fails to verify channel permissions when processing API requests with a caller-supplied_ {{post_id}}_, and fails to validate the_ {{web_url}} _parameter against the configured …
-
Low 3.5
Missing run-state validation on finished playbook runs
Mattermost versions 11.7.x <= 11.7.6, 10.11.x <= 10.11.21 fail to enforce run-state validation on write operations for finished playbook runs which allows a run participant to modify status, checklists, retrospective content, ownership, and participants on co…
-
Low 3.5
Mattermost thread memberships persist after team removal, exposing private channel thread metadata on re-invite
Mattermost versions 10.11.x <= 10.11.20, 11.7.x <= 11.7.5 Mattermost fails to remove thread membership records when a user is removed from or leaves a team, which allows a previously removed user who is later re-invited to the team to view private channel thr…
-
Low 2.7
Delegated OAuth tokens could revoke unrelated OAuth application authorizations
Mattermost versions 11.7.x <= 11.7.6, 10.11.x <= 10.11.21 Mattermost failed to restrict OAuth deauthorization and personal access token management endpoints to direct user sessions, which allowed an OAuth app with a delegated user token to revoke the user's a…
Revision history
-
#2
Referenz(en) aufgenommen: CVE-2026-16044, EUVD-2026-60211, CVE-2026-16045, EUVD-2026-60210, CVE-2026-16049, EUVD-2026-60209, GHSA-GHQ9-4RCG-JVC2, CVE-2026-9693, GHSA-F5MP-J4VF-9JP4, GHSA-523X-7GMH-RHPC, CVE-2026-16047, EUVD-2026-60208, CVE-2026-16046, EUVD-2026-60207, GHSA-2883-3C4J-4MVV, CVE-2026-16048, EUVD-2026-60206, CVE-2026-10527, EUVD-2026-60192, GHSA-VR3J-2Q9W-H26R, EUVD-2026-60542, CVE-2026-9859, EUVD-2026-60541, CVE-2026-9816, EUVD-2026-60540, CVE-2026-10080, EUVD-2026-60539, CVE-2026-15754, EUVD-2026-60212, GHSA-MG83-F953-3VQ5
-
#1
Initiale Fassung
References
-
Mattermost Security Updates vom 2026-07-19
https://mattermost.com/security-updates/