GHSA-7pf2-9c95-w332

ghsaUSosv

Mattermost doesn't validate file ownership and access control

view advisory published 2026-05-26Licence: CC-BY-4.0

Mattermost versions 11.6.x <= 11.6.0, 11.5.x <= 11.5.3, 11.4.x <= 11.4.4, 10.11.x <= 10.11.14 fail to validate file ownership and access control, which allows an authenticated user to access and download files belonging to other users or teams via crafted Boards API requests using valid file IDs. Mattermost Advisory ID: MMSA-2026-00620.

describes (1)

Related CVEs.

ID	severity	EPSS	exploitable	published
CVE-2026-3473US	high7.1	0.15% (4th)	—	2026-05-22
Mattermost versions 11.6.x <= 11.6.0, 11.5.x <= 11.5.3, 11.4.x <= 11.4.4, 10.11.x <= 10.11.14 fail to validate file ownership and access control, which allows an authenticated user…

references

External citations — patches, advisories, analysis.

https://github.com/mattermost/mattermostPACKAGE
https://mattermost.com/security-updatesWEB
https://nvd.nist.gov/vuln/detail/CVE-2026-3473ADVISORY

scry

Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.

Free scan