Description

Mattermost versions 11.9.x <= 11.9.0, 11.8.x <= 11.8.4, 11.7.x <= 11.7.7, 10.11.x <= 10.11.22 fail to enforce the board-creation permission which allows an unauthorized authenticated user to create boards via the board duplicate, boards-and-blocks, and archive-import endpoints.. Mattermost Advisory ID: MMSA-2026-00715

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "4.3",
  "pubDate": "2026-09-14T11:17:03.573Z",
  "pubdate": "2026-09-14T11:17:03.573Z",
  "executiveSummary": "This vulnerability involves an Improper Authorization flaw within Mattermost, specifically affecting the board creation mechanism. The vulnerability resides in the enforcement logic governing the creation of boards, which fails to adequately validate user permissions across several critical API endpoints.\nImpact: An unauthorized authenticated user can bypass established security policies to create boards within the system. This leads to potential unauthorized data exposure, resource exhaustion, or the creation of unauthorized communication channels.\nAffected Products: Mattermost versions 11.9.x (<= 11.9.0), 11.8.x (<= 11.8.4), 11.7.x (<= 11.7.7), and 10.11.x (<= 10.11.22).\nRisk Implications: Successful exploitation allows authenticated attackers to perform actions for which they lack the necessary privileges, undermining the principle of least privilege within the Mattermost platform.\nExploitation Requirements: The attacker must possess an authenticated account on the Mattermost instance. No specialized administrative privileges are required to initiate the attack; the flaw lies in the backend's failure to verify permission sets before processing the creation request.",
  "technicalDetails": "The vulnerability is identified as a broken access control issue where the application fails to enforce the 'create board' permission during interactions with specific board management endpoints. The affected endpoints include 'board duplicate', 'boards-and-blocks', and 'archive-import'.\nRoot Cause: The root cause is a failure in the server-side authorization logic. When a request is sent to these specific endpoints, the application processes the creation of the board based on the user's authentication status rather than validating that the user possesses the explicit authorization or workspace-level permissions required to instantiate new board objects.\nAttack Flow: An authenticated user with restricted permissions interacts with the Mattermost API via the identified endpoints. By crafting a specific HTTP POST or PUT request targeting the 'board duplicate', 'boards-and-blocks', or 'archive-import' API paths, the user bypasses the conditional check that should evaluate their capability to perform administrative or board-management tasks. The backend receives these requests, identifies the user as authenticated, and processes the board creation logic without verifying if the user has been granted the 'create_board' permission.\nAffected Components: The board management module is the primary vulnerable component. The endpoints fail to invoke the necessary authorization middleware or security wrappers that are standard in other parts of the application.\nExploitation Method: An attacker can utilize standard API interaction tools (such as curl or Postman) to submit requests to the vulnerable endpoints. Because the permission check is missing, the application treats the request as legitimate, resulting in the creation of a new board in the user's workspace.\nPost-Exploitation Impact: Beyond the unauthorized creation of boards, this vulnerability allows for the potential infiltration of malicious data or content via the 'archive-import' functionality. Furthermore, the mass creation of boards could be used as a vector for denial-of-service against the underlying database or to clutter the workspace to mask other malicious activities. The flaw significantly weakens the integrity of the workspace access control model, allowing authenticated users to elevate their operational impact significantly beyond their intended role-based access control (RBAC) boundaries."
}