Description

Mattermost versions 11.7.x <= 11.7.6, 10.11.x <= 10.11.21, 11.8.x <= 11.8.3 fail to enforce PermissionManageBoardRoles on the channelId field of the batch endpoint, which allows an authenticated board editor to relink any board they can edit to an arbitrary channel via a crafted PATCH request. Mattermost Advisory ID: MMSA-2026-00686

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.5",
  "pubDate": "2026-08-17T22:17:27.343Z",
  "pubdate": "2026-08-17T22:17:27.343Z",
  "executiveSummary": "An authorization bypass vulnerability exists in Mattermost versions 11.7.x <= 11.7.6, 10.11.x <= 10.11.21, and 11.8.x <= 11.8.3, specifically identified by Advisory ID MMSA-2026-00686.\nThe vulnerability involves a failure to enforce the PermissionManageBoardRoles permission check on the channelId field within the batch endpoint.\nAn authenticated attacker with board editor privileges can exploit this flaw to relink any board they possess edit access to into an arbitrary channel via a crafted PATCH request.\nThe impact of this vulnerability includes unauthorized association of boards with arbitrary channels, potentially leading to unauthorized information disclosure, unauthorized data aggregation, or disruption of channel-based workflows within the affected Mattermost deployments.\nExploitation requires authenticated access with standard board editor privileges and the ability to interact with the target batch endpoint via network requests.",
  "technicalDetails": "The root cause of the vulnerability stems from insufficient access control enforcement on the batch endpoint within the affected Mattermost components. Specifically, the application fails to validate the PermissionManageBoardRoles capability against the specified channelId field during batch processing operations.\nThe vulnerable component is the batch endpoint handling board and channel relational modifications. Affected software versions include Mattermost 11.7.x through 11.7.6, 10.11.x through 10.11.21, and 11.8.x through 11.8.3.\nAuthentication and privilege requirements dictate that the attacker must possess valid user credentials and hold board editor privileges for at least one board. However, the lack of granular permission checks on the channelId parameter bypasses the restriction that would normally require administrative or explicit management permissions over the target channel.\nThe attack flow proceeds as follows: First, the authenticated user identifies a board over which they hold editor privileges. Second, the attacker crafts a malicious HTTP PATCH request targeting the vulnerable batch endpoint. Within the payload of this request, the attacker specifies the target board identifier alongside an arbitrary channelId to which they normally lack the authority to link the board. Third, because the backend logic fails to verify PermissionManageBoardRoles for the supplied channelId, the request is processed successfully. Finally, the board is forcefully relinked to the arbitrary channel specified in the crafted payload, altering the operational context and visibility of the board.\nPost-exploitation impact includes unauthorized cross-channel board association, which can violate access control boundaries between different teams or projects sharing the same Mattermost instance, potentially exposing sensitive collaborative data to unauthorized channels."
}