CVE-2026-10527: Incorrect Authorization

Mattermost versions 11.7.x = 11.7.6, 10.11.x = 10.11.21, 11.8.x = 11.8.3 fails to reconcile SchemeAdmin flags with a user's current role which allows a user demoted to System Guest to retain Board Admin privileges and perform admin-only operations via the Boards REST API or UI.. Mattermost Adviso...

PT-2026-76661

Mattermost versions 11.7.x = 11.7.6, 10.11.x = 10.11.21, 11.8.x = 11.8.3 fail to validate that users have read access to a channel before linking a board to it, which allows an authenticated attacker to discover the membership of private channels on the same team via creating, patching, importing...

CVE-2026-16044: Incorrect Authorization

Mattermost versions 11.7.x = 11.7.6, 10.11.x = 10.11.21 fail to prevent guest users from receiving Board Admin privileges during board archive import which allows a board member to escalate a guest user to Board Admin via importing a crafted .boardarchive file. Mattermost Advisory ID:...

CVE-2026-16047: Missing Authorization

Mattermost versions 11.7.x = 11.7.6, 10.11.x = 10.11.21, 11.8.x = 11.8.3 fail to validate that users have read access to a channel before linking a board to it, which allows an authenticated attacker to discover the membership of private channels on the same team via creating, patching, importing...

CVE-2026-9859: Incorrect Authorization

Mattermost versions 11.7.x = 11.7.6, 10.11.x = 10.11.21, 11.8.x = 11.8.3 fail to enforce PermissionManageBoardRoles on the channelId field of the batch endpoint, which allows an authenticated board editor to relink any board they can edit to an arbitrary channel via a crafted PATCH request...

PT-2026-76876

Name of the Vulnerable Software and Affected Versions Mattermost versions 11.7.0 through 11.7.6 Mattermost versions 10.11.0 through 10.11.21 Mattermost versions 11.8.0 through 11.8.3 Description Insufficient server-side validation of BoardMember.Scheme fields during insert and archive-import...

PT-2026-76667

Mattermost versions 11.7.x = 11.7.6, 10.11.x = 10.11.21, 11.8.x = 11.8.3 fails to reconcile SchemeAdmin flags with a user's current role which allows a user demoted to System Guest to retain Board Admin privileges and perform admin-only operations via the Boards REST API or UI.. Mattermost Adviso...

PT-2026-76669

Mattermost versions 11.7.x = 11.7.6, 10.11.x = 10.11.21 fail to prevent guest users from receiving Board Admin privileges during board archive import which allows a board member to escalate a guest user to Board Admin via importing a crafted .boardarchive file. Mattermost Advisory ID:...

PT-2026-76877

Name of the Vulnerable Software and Affected Versions Mattermost versions 11.7.0 through 11.7.6 Mattermost versions 10.11.0 through 10.11.21 Mattermost versions 11.8.0 through 11.8.3 Description The Boards plugin fails to enforce the PermissionManageBoardRoles authorization on the channelId field...

CVE-2026-61974

Unauthenticated Cross Site Scripting XSS in Mang Board WP = 2.3.4 versions...

EUVD-2026-57974

Unauthenticated Cross Site Scripting XSS in Mang Board WP = 2.3.4 versions...

CVE-2026-61974

CVE-2026-61974 is an Unauthenticated Cross Site Scripting (XSS) vulnerability affecting the Mang Board WP plugin for WordPress, version

CVE-2026-61974 WordPress Mang Board WP plugin <= 2.3.4 - Cross Site Scripting (XSS) vulnerability

Unauthenticated Cross Site Scripting XSS in Mang Board WP = 2.3.4 versions...

CVE-2026-61974 WordPress Mang Board WP plugin <= 2.3.4 - Cross Site Scripting (XSS) vulnerability

Unauthenticated Cross Site Scripting XSS in Mang Board WP = 2.3.4 versions...

CVE-2026-61974

Unauthenticated Cross Site Scripting XSS in Mang Board WP = 2.3.4 versions...

WordPress Mang Board WP plugin <= 2.3.4 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by etomixer in WordPress Plugin Mang Board WP versions = 2.3.4...

PT-2026-71540

Unauthenticated Cross Site Scripting XSS in Mang Board WP = 2.3.4 versions...

CVE-2026-61974: Improper Neutralization of Input During Web Page Generation

Unauthenticated Cross Site Scripting XSS in Mang Board WP = 2.3.4 versions...

New Research: The Confidence Gap Between CISOs and Their Boards Is Real, and It’s Measurable

Las Vegas, United States, 5th August 2026, CyberNewswire...

CVE-2026-14938

The FluentBoards WordPress plugin before 1.95.3 does not verify that the items selected for a board import operation belong to a board the requesting user is authorized to access, allowing any authenticated user with member access to a single board to copy and read the stages and tasks including...