GitHub Advisoryadvisory · Go

GHSA-hf8w-x9h5-5gf9 Mattermost Boards Plugin fails to implement authorisation checks on comment block modifications

MEDIUM Published 2026-03-16 Modified 2026-03-19 Official page ↗
Aliases
CVE-2026-2461
Ecosystem
Go
Packages
github.com/mattermost/mattermost-plugin-boards
Severity
Moderate
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
Weaknesses
CWE-639
Reviewed
2026-03-19

Affected packages

• Go github.com/mattermost/mattermost-plugin-boards: < 0.0.0-20260108044135-57c5be5b6ef5 → fixed in 0.0.0-20260108044135-57c5be5b6ef5

Description

Mattermost Plugins versions <=11.3 11.0.3 11.2.2 10.10.11.0 fail to implement authorisation checks on comment block modifications, which allows an authorised attacker with editor permission to modify comments created by other board members. Mattermost Advisory ID: MMSA-2025-00559

Related

Alias · CVE (1)

  • CVE-2026-2461 Mattermost Plugins versions <=11.3 11.0.3 11.2.2 10.10.11.0 fail to implement authorisation checks on comment block modifications, which… vulnerability

Weakness · CWE (1)

  • CWE-639 Authorization Bypass Through User-Controlled Key weakness

References