medium4.3
CVE-2026-2461
Mattermost Boards Plugin fails to implement authorisation checks on comment block modifications
Impact
Mattermost Plugins versions <=11.3 11.0.3 11.2.2 10.10.11.0 fail to implement authorisation checks on comment block modifications, which allows an authorised attacker with editor permission to modify comments created by other board members. Mattermost Advisory ID: MMSA-2025-00559
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| go | github.com/mattermost/mattermost-plugin-boards | < 0.0.0-20260108044135-57c5be5b6ef5 | 0.0.0-20260108044135-57c5be5b6ef5 |
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Mattermost | Mattermost Server | before 10.11.11 from 11.0.0 through 11.0.3 from 11.1.0 before 11.2.3 from 11.3.0 before 11.3.1 |