Executive brief
Mattermost's Boards plugin contains a validation flaw that allows authorized users to crash the plugin worker and disrupt service. An authenticated editor with board access can exploit this by creating a child block with malformed field properties, causing the plugin to stop functioning and potentially affecting all users who depend on the Boards feature for collaboration and project management.
Technical details
The vulnerability is a type validation bypass in the Boards plugin's block creation logic. The plugin fails to properly validate that the `fields.properties` attribute is an object type when creating child blocks, allowing an authenticated attacker to submit non-object values. An authenticated user with editor access to a board can trigger this flaw by crafting a malicious child block, which causes the Boards plugin worker process to crash, resulting in denial of service. The issue affects Mattermost versions 11.9.0, 11.8.4 and earlier, 11.7.7 and earlier, and 10.11.22 and earlier. Patches are available in newer versions.
Affected products
- Mattermost Boards 11.9.x <= 11.9.0, 11.8.x <= 11.8.4, 11.7.x <= 11.7.7, 10.11.x <= 10.11.22
Timeline
- 2026-09-14: disclosed