Executive brief
Mattermost Plugins, which extend the functionality of the Mattermost collaboration platform, contain a security flaw in how they handle user permissions for specific groups. An authenticated user who belongs to multiple groups can bypass restrictions to create issues or post comments in groups that should be locked or restricted. This could lead to unauthorized data entry or communication within sensitive, restricted project areas.
Technical details
An incorrect authorization vulnerability (CWE-863) exists in Mattermost Plugins versions up to 11.5, 11.1.5, 10.13.11, and 11.3.4.0. The software fails to implement sufficient API-level validation to verify if a user has the appropriate permissions for a specific group before allowing issue creation or comment attachment. An attacker with low-privileged authenticated access who is a member of multiple groups can bypass UI-level restrictions by sending direct API requests to interact with locked groups. This allows for unauthorized integrity-impacting actions within the collaboration environment.
Affected products
- Mattermost Mattermost Plugins <=11.5, 11.1.5, 10.13.11, 11.3.4.0
Timeline
- 2026-05-18: disclosed
- 2026-05-18: advisory