Description

Mattermost versions 11.9.x <= 11.9.0, 11.8.x <= 11.8.4, 11.7.x <= 11.7.7, 10.11.x <= 10.11.22 fail to validate the type of `fields.properties` on block creation which allows an authenticated user with editor access to a board to crash the Boards plugin worker and trigger a denial of service via a child block whose `fields.properties` is a non-object value. Mattermost Advisory ID: MMSA-2026-00710

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "4.3",
  "pubDate": "2026-09-14T11:17:03.180Z",
  "pubdate": "2026-09-14T11:17:03.180Z",
  "executiveSummary": "A type validation vulnerability exists within the Mattermost Boards plugin, specifically affecting how the system processes 'fields.properties' during block creation. This flaw permits an authenticated user possessing editor-level permissions to induce a crash in the Boards plugin worker, resulting in a localized denial-of-service (DoS) condition.\nThe vulnerability stems from insufficient input sanitization regarding the data type of 'fields.properties'. By supplying a non-object value to this field, an attacker can trigger an unhandled exception within the plugin's execution environment. Successful exploitation effectively disrupts the Boards service functionality for other users, impacting collaborative workflows within the affected Mattermost instances.\nAffected products include Mattermost versions 11.9.0 and earlier, 11.8.4 and earlier, 11.7.7 and earlier, and 10.11.22 and earlier. The primary risk involves the stability of the Boards plugin, which can be compromised by any authenticated user with sufficient privileges to modify boards. No specialized network access is required beyond standard authenticated access to the application, making this a significant operational risk for environments relying heavily on Mattermost Boards.",
  "technicalDetails": "The root cause of this vulnerability lies in an improper input validation mechanism within the Boards plugin logic, specifically concerning the creation of block objects. The application expects the 'fields.properties' attribute to be a structured object; however, the lack of explicit type checking or schema validation allows for the injection of non-object primitives (e.g., strings, booleans, or null values) during the block creation payload.\nThe attack flow begins when an authenticated user, holding at least editor access, initiates a block creation request. The attacker modifies the JSON payload sent to the Boards plugin endpoint, explicitly setting the 'fields.properties' key to an invalid data type. Upon receiving this payload, the backend worker attempts to parse or iterate over the properties of the field.\nBecause the code assumes 'fields.properties' will always be an object, the assignment of a non-object value leads to a runtime error or a type-coercion failure. This exception propagates up the execution stack, causing the current worker thread to terminate abruptly. Given the architectural design of the Boards plugin, repeated or specific triggering of this unhandled exception leads to the collapse of the plugin's worker process.\nThe vulnerable component is the block creation handling logic within the Boards plugin, which fails to enforce strict data type requirements prior to processing. By successfully crashing the worker, the attacker renders the Boards functionality inaccessible for the remainder of the session or until the plugin process is automatically restarted by the server, effectively facilitating a denial-of-service attack.\nThe vulnerability is deterministic and does not require complex heap spraying or memory manipulation, as it relies on logical flaws in the application's input processing pipeline. The impact is limited to the Boards plugin and does not inherently provide the attacker with remote code execution (RCE) or unauthorized data access, but it significantly undermines system availability and service integrity."
}