Description

Mattermost versions 11.7.x <= 11.7.6, 10.11.x <= 10.11.21, 11.8.x <= 11.8.3 fails to validate WebSocket command field types which allows an authenticated user to crash the plugin process and deny service to all Boards users via a custom_focalboard_SUBSCRIBE_TEAM message with a non-string teamId.. Mattermost Advisory ID: MMSA-2026-00687

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.5",
  "pubDate": "2026-08-17T22:16:58.607Z",
  "pubdate": "2026-08-17T22:16:58.607Z",
  "executiveSummary": "A vulnerability exists in Mattermost due to insufficient validation of WebSocket command field types within the Boards plugin. The flaw allows an authenticated user to induce an application crash in the plugin process, resulting in a denial of service for all users relying on the affected Boards functionality. The issue impacts Mattermost versions 11.7.x up to 11.7.6, 10.11.x up to 10.11.21, and 11.8.x up to 11.8.3. Exploitation of this vulnerability requires network access to the Mattermost server and valid user authentication, but does not demand elevated administrative privileges. The primary risk implication is operational disruption, where malicious or malformed input supplied by a standard user directly degrades service availability across the collaborative Boards component.",
  "technicalDetails": "The root cause of this vulnerability lies in the improper type checking of incoming WebSocket message payloads processed by the Mattermost Boards plugin. Specifically, the application fails to validate whether specific command fields match expected primitive data types before processing them. The vulnerable component is identified within the WebSocket message handling logic parsing the custom_focalboard_SUBSCRIBE_TEAM command.\nExploitation occurs when an authenticated user sends a maliciously crafted WebSocket message to the server. The attack vector specifically utilizes a custom_focalboard_SUBSCRIBE_TEAM message containing an invalid data type for the teamId field—specifically substituting the expected string type with a non-string type.\nThe attack flow proceeds as follows: First, the authenticated attacker establishes a standard WebSocket connection to the Mattermost server. Second, the attacker transmits the crafted custom_focalboard_SUBSCRIBE_TEAM payload containing the malformed non-string teamId parameter. Third, the WebSocket handling routine within the plugin processes the input without enforcing strict type validation. Fourth, upon encountering the unexpected data type during internal operations, the plugin process encounters an unhandled runtime exception or type assertion failure.\nThis uncaught exception leads directly to the abnormal termination of the plugin process. Because the crash affects the centralized plugin process handling Boards functionality, all users interacting with Mattermost Boards experience an immediate denial of service. Authentication is required to establish the WebSocket session, but no privileged or administrative access is necessary. The network exposure is limited to the standard network interfaces exposed by the Mattermost server for client-server communication."
}