GHSA-hf8w-x9h5-5gf9

ghsaUSosv

Mattermost Boards Plugin fails to implement authorisation checks on comment block modifications

view advisory published 2026-03-16Licence: CC-BY-4.0

Mattermost Plugins versions <=11.3 11.0.3 11.2.2 10.10.11.0 fail to implement authorisation checks on comment block modifications, which allows an authorised attacker with editor permission to modify comments created by other board members. Mattermost Advisory ID: MMSA-2025-00559

describes (1)

Related CVEs.

ID	severity	EPSS	exploitable	published
CVE-2026-2461US	—	0.17% (6th)	Exploit	2026-03-16
Mattermost Plugins versions <=11.3 11.0.3 11.2.2 10.10.11.0 fail to implement authorisation checks on comment block modifications, which allows an authorised attacker with editor p…

references

External citations — patches, advisories, analysis.

https://github.com/mattermost/mattermost-plugin-boardsPACKAGE
https://github.com/mattermost/mattermost-plugin-boards/commit/57c5be5b6ef59d02dd72e35094d1fae8ba6e9619WEB
https://mattermost.com/security-updatesWEB
https://nvd.nist.gov/vuln/detail/CVE-2026-2461ADVISORY

scry

Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.

Free scan