Executive brief
Mattermost, a team communication and collaboration platform, fails to properly enforce access controls on board creation in several versions. An authenticated user without permission to create boards can bypass this restriction via specific API endpoints (board duplicate, boards-and-blocks, and archive-import), allowing them to create boards when they should not be allowed to do so. This enables unauthorized users to create and control shared workspaces within the platform.
Technical details
The vulnerability is an authorization bypass in Mattermost's board-creation permission enforcement. Authenticated users can circumvent the board-creation permission check by submitting requests through the board-duplication, boards-and-blocks, and archive-import API endpoints, which fail to validate the user's permission level before processing board creation. An attacker must be an authenticated user with network access to the Mattermost instance, but does not require any elevated privileges. The impact allows unauthorized board creation, potentially enabling workspace hijacking or data compartmentalization attacks. Fixes are available in patched versions: 11.9.1+, 11.8.5+, 11.7.8+, and 10.11.23+.
Affected products
- Mattermost Mattermost 11.9.x <= 11.9.0, 11.8.x <= 11.8.4, 11.7.x <= 11.7.7, 10.11.x <= 10.11.22
Timeline
- 2026-09-14: disclosed