Description

Mattermost versions 11.7.x <= 11.7.6, 10.11.x <= 10.11.21, 11.8.x <= 11.8.3 fail to validate that users have read access to a channel before linking a board to it, which allows an authenticated attacker to discover the membership of private channels on the same team via creating, patching, importing, or bulk-creating boards with an arbitrary channelId. Mattermost Advisory ID: MMSA-2026-00674

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "4.3",
  "pubDate": "2026-08-17T15:16:54.193Z",
  "pubdate": "2026-08-17T15:16:54.193Z",
  "executiveSummary": "A channel access validation vulnerability exists in Mattermost versions 11.7.x <= 11.7.6, 10.11.x <= 10.11.21, and 11.8.x <= 11.8.3, tracked under Mattermost Advisory ID MMSA-2026-00674.\nThe flaw allows an authenticated attacker to bypass authorization checks and discover the membership of arbitrary private channels within the same team.\nThe vulnerability stems from the application failing to validate whether a user possesses read access to a specific channel prior to linking a board to it.\nAttack capabilities involve leveraging board-related operations—specifically creating, patching, importing, or bulk-creating boards—using an arbitrary channelId.\nSuccessful exploitation compromises the confidentiality of private channel memberships, allowing malicious actors to map out restricted channels and organizational groupings without possessing legitimate membership privileges.\nPrerequisites for exploitation include standard authenticated access to the platform and presence on the target team, requiring no specialized administrative privileges beyond baseline user authentication.",
  "technicalDetails": "The root cause of this vulnerability lies in an authorization check omission within the board-linking logic of Mattermost. Specifically, when processing requests to link boards to channels through creation, patching, importing, or bulk-creating operations, the backend logic fails to verify if the requesting user holds explicit read access or membership within the target channel designated by the channelId parameter.\nBecause the server processes the board association request without enforcing proper access control lists (ACLs) or channel visibility checks, an authenticated attacker can systematically probe for the existence of private channels and determine their membership status.\nThe attack flow proceeds as follows: First, the authenticated attacker identifies a target team and constructs an API request targeting board creation, patching, import, or bulk-creation endpoints. Within the payload, the attacker supplies an arbitrary channelId corresponding to a private channel to which they do not have legitimate read access.\nSecond, the vulnerable component processes the request and attempts to establish the link between the board and the specified channelId. Due to the lack of pre-validation of user-to-channel permissions, the application processes the operation or returns error messages and state changes that implicitly leak information regarding the validity of the channel and the users associated with it.\nBy analyzing the application responses or side effects generated during these board-linking operations, the attacker can successfully infer whether the channel exists, whether it is private, and ascertain membership details of the targeted private channel.\nThe affected product is Mattermost, specifically affecting versions 11.7.x up to 11.7.6, 10.11.x up to 10.11.21, and 11.8.x up to 11.8.3.\nThe vulnerability requires user authentication and team membership, but does not require any elevated privileges or administrative rights. Network exposure encompasses standard application layer connectivity used to interact with Mattermost API endpoints for board management."
}