Vulnerability · Published Mar 16, 2026 · Assigned by Mattermost

CVE-2026-2461Missing authorization check allows unauthorized modification of other users' comments on a board

Medium 4.3

In plain English

A medium-severity authorization bypass via user-controlled key in Mattermost from Mattermost. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 6% of all known vulnerabilities). Ready-made attack tooling exists: public proof-of-concept code. Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)4.3Medium

Exploit odds (30 days)0.2%top 93.7% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack tooling1Public PoC

Official description

Mattermost Plugins versions <=11.3 11.0.3 11.2.2 10.10.11.0 fail to implement authorisation checks on comment block modifications, which allows an authorised attacker with editor permission to modify comments created by other board members. Mattermost Advisory ID: MMSA-2025-00559

Affected packages & fixed versions

Ecosystem	Package	Fixed in	Advisory
Go	github.com/mattermost/mattermost-plugin-boards	0.0.0-20260108044135-57c5be5b6ef5	GHSA-hf8w-x9h5-5gf9
Go	github.com/mattermost/mattermost-plugin-boards	0.0.0-20260108044135-57c5be5b6ef5	GO-2026-4782

Affected products (as reported)

Vendor	Product	Versions
Mattermost	Mattermost	0 – through 11.0.30 – through 11.2.20 – through 10.10.11

Weakness: CWE-639 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

References

MMSA-2025-00559 vendor-advisory