GHSA-7pf2-9c95-w332HighCVSS 7.1

Mattermost doesn't validate file ownership and access control

Published
May 26, 2026
Last Modified
June 26, 2026

🔗 CVE IDs covered (1)

CVE-2026-3473 →

📋 Description

Mattermost versions 11.6.x <= 11.6.0, 11.5.x <= 11.5.3, 11.4.x <= 11.4.4, 10.11.x <= 10.11.14 fail to validate file ownership and access control, which allows an authenticated user to access and download files belonging to other users or teams via crafted Boards API requests using valid file IDs. Mattermost Advisory ID: MMSA-2026-00620.

🎯 Affected products4

  • go/github.com/mattermost/mattermost-server:= 11.6.0
  • go/github.com/mattermost/mattermost-server:>= 11.5.0, < 11.5.4
  • go/github.com/mattermost/mattermost-server:>= 11.4.0, < 11.4.5
  • go/github.com/mattermost/mattermost-server:>= 10.11.0, < 10.11.15

🔗 References (3)