~ / search / GHSA-hf8w-x9h5-5gf9

GHSA-hf8w-x9h5-5gf9

Mattermost Boards Plugin fails to implement authorisation checks on comment block modifications

Source: GitHub Advisory Database (reviewed) Moderate CVE-2026-2461

Packages

EcosystemPackageAffectedFixed in
Go github.com/mattermost/mattermost-plugin-boards < 0.0.0-20260108044135-57c5be5b6ef5 0.0.0-20260108044135-57c5be5b6ef5

Details

As written in the advisory (Markdown source, shown as plain text).

Mattermost Plugins versions <=11.3 11.0.3 11.2.2 10.10.11.0 fail to implement authorisation checks on comment block modifications, which allows an authorised attacker with editor permission to modify comments created by other board members. Mattermost Advisory ID: MMSA-2025-00559

References

External links from the advisory. They lead to third-party sites.