Executive brief
Mattermost is a popular team collaboration platform similar to Slack. A flaw in versions 11.7.x, 10.11.x, and 11.8.x allows authenticated board editors to reassign any board they can edit to an arbitrary channel by bypassing permission checks. An attacker with board editor privileges could move boards to channels they should not have access to, potentially exposing or disrupting collaborative workspace data.
Technical details
The vulnerability is a privilege escalation flaw caused by failure to enforce the PermissionManageBoardRoles permission check on the channelId field of the batch PATCH endpoint. An authenticated user with board editor privileges can craft a PATCH request to relink any board under their control to an arbitrary channel, circumventing authorization controls. The attack requires prior board editor access and network connectivity to the Mattermost server. No patches are explicitly mentioned in the advisory, but the affected versions are clearly defined (11.7.x ≤ 11.7.6, 10.11.x ≤ 10.11.21, 11.8.x ≤ 11.8.3).
Affected products
- Mattermost Mattermost Server 11.7.x <= 11.7.6, 10.11.x <= 10.11.21, 11.8.x <= 11.8.3
Timeline
- 2026-08-17: disclosed