Description

Mattermost versions 11.9.x <= 11.9.0, 11.8.x <= 11.8.4, 11.7.x <= 11.7.7, 10.11.x <= 10.11.22 fail to enforce board creation permissions when importing archive files which allows an authenticated non-guest team member to create Open or Private boards despite administrator restrictions via importing a crafted .boardarchive file. Mattermost Advisory ID: MMSA-2026-00712

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "4.3",
  "pubDate": "2026-09-14T11:17:03.307Z",
  "pubdate": "2026-09-14T11:17:03.307Z",
  "executiveSummary": "This vulnerability involves an improper authorization control in Mattermost Boards, classified as an access control bypass. The flaw enables an authenticated non-guest team member to circumvent administrator-defined restrictions regarding board creation.\nBy leveraging a crafted .boardarchive file, an attacker can bypass existing permission checks during the import process, allowing for the unauthorized instantiation of Open or Private boards. This impacts multiple versions of the Mattermost platform.\nThe risk implication is a degradation of administrative governance over collaboration spaces, potentially leading to unauthorized data exposure or unauthorized resource creation within the team environment. The vulnerability requires the attacker to be an authenticated team member, but it does not require elevated administrative privileges, making it a significant escalation of access for malicious actors operating within the authenticated perimeter.\nAffected products include Mattermost versions 11.9.x through 11.9.0, 11.8.x through 11.8.4, 11.7.x through 11.7.7, and 10.11.x through 10.11.22. Remediation necessitates applying the official security updates provided by Mattermost to enforce correct permission validation during the import workflow.",
  "technicalDetails": "The root cause of this vulnerability lies in the failure of the Mattermost Boards import mechanism to adequately validate user permissions against administrative policy when processing .boardarchive files. Specifically, the backend logic responsible for importing and reconstructing board entities from an archive format does not perform the standard authorization checks that are otherwise enforced when a user creates a board through the standard UI or API endpoints.\nThe attack flow begins with an authenticated non-guest team member who possesses standard team-level access. The attacker prepares a malicious .boardarchive file—a structured archive format used by Mattermost to export and import board configurations and data. Because the import logic fails to query the system's permission state for board creation at the point of archive ingestion, the system treats the import operation as an administrative or exempt action.\nWhen the crafted .boardarchive file is uploaded and processed by the Mattermost application, the server-side logic parses the file and proceeds to instantiate the board objects described within the archive into the database. Since the backend fails to verify whether the authenticated user is authorized to create such a board, the application successfully persists the board with the attributes defined in the archive—specifically those that might otherwise be restricted, such as Open or Private board settings.\nThis vulnerability demonstrates a disparity between the security policies enforced in the standard creation interface and the policies enforced in the import subsystem. The vulnerable component is the archive import handler within the Mattermost Boards module. Because the check is bypassed, the system effectively ignores existing global or team-level prohibitions on creating new boards.\nThe exploitation requirements are minimal: the attacker must have valid credentials as a team member and have access to the import functionality for board archives. No network-level access beyond what is required to reach the application is needed, and no sophisticated administrative privilege escalation is required to initiate the import. Once exploited, the impact is the creation of unauthorized boards, which can then be used to exfiltrate information, store unauthorized content, or further facilitate lateral movement within the Mattermost workspace by granting access to sensitive project data that the attacker should not have been able to initiate."
}