CVE-2026-3473 — Improper file ownership validation in the Boards API allows unauthorised file access

CVE-2026-3473

Improper file ownership validation in the Boards API allows unauthorised file access PUBLISHED

Description (CNA)

Mattermost versions 11.6.x <= 11.6.0, 11.5.x <= 11.5.3, 11.4.x <= 11.4.4, 10.11.x <= 10.11.14 fail to validate file ownership and access control, which allows an authenticated user to access and download files belonging to other users or teams via crafted Boards API requests using valid file IDs.. Mattermost Advisory ID: MMSA-2026-00620

Affected (CNA)

Vendor / product	Versions
Mattermost / Mattermost	affected 11.6.0 through 11.6.0; affected 11.5.0 through 11.5.3; affected 11.4.0 through 11.4.4; affected 10.11.0 through 10.11.14; unaffected 11.7.0; unaffected 11.6.1; unaffected 11.5.4; unaffected 11.4.5; unaffected 10.11.15

CWE

CWE-639

References

https://mattermost.com/security-updates

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.