CVE-2026-14259

Mattermost versions 11.9.x = 11.9.0, 11.8.x = 11.8.4, 11.7.x = 11.7.7, 10.11.x = 10.11.22 fail to enforce board creation permissions when importing archive files which allows an authenticated non-guest team member to create Open or Private boards despite administrator restrictions via importing a...

CVE-2026-14259

CVE-2026-14259 affects Mattermost versions 11.9.x ≤ 11.9.0, 11.8.x ≤ 11.8.4, 11.7.x ≤ 11.7.7, and 10.11.x ≤ 10.11.22. The board archive import feature fails to enforce team board creation permissions, allowing an authenticated non-guest team member to create Open or Private boards despite adminis...

CVE-2026-14259 Board archive import bypasses team board creation permissions

Mattermost versions 11.9.x = 11.9.0, 11.8.x = 11.8.4, 11.7.x = 11.7.7, 10.11.x = 10.11.22 fail to enforce board creation permissions when importing archive files which allows an authenticated non-guest team member to create Open or Private boards despite administrator restrictions via importing a...

CVE-2026-14259 Board archive import bypasses team board creation permissions

Mattermost versions 11.9.x = 11.9.0, 11.8.x = 11.8.4, 11.7.x = 11.7.7, 10.11.x = 10.11.22 fail to enforce board creation permissions when importing archive files which allows an authenticated non-guest team member to create Open or Private boards despite administrator restrictions via importing a...

EUVD-2026-77359

Mattermost versions 11.9.x = 11.9.0, 11.8.x = 11.8.4, 11.7.x = 11.7.7, 10.11.x = 10.11.22 fail to enforce board creation permissions when importing archive files which allows an authenticated non-guest team member to create Open or Private boards despite administrator restrictions via importing a...

PT-2026-91144

Name of the Vulnerable Software and Affected Versions Mattermost version 11.9.0 Mattermost version 11.8.4 Mattermost version 11.7.7 Mattermost version 10.11.22 Description An issue exists where board creation permissions are not enforced during the import of archive files. This allows an...

Mattermost Server 10.11.x < 10.11.22 / 11.7.x < 11.7.7 Multiple Vulnerabilities (MMSA-2026-00672, MMSA-2026-00675, MMSA-2026-00704)

The version of Mattermost Server installed on the remote host is affected by multiple vulnerabilities as referenced in the MMSA-2026-00672, MMSA-2026-00675, MMSA-2026-00704 advisories. - Mattermost versions 11.7.x = 11.7.6, 10.11.x = 10.11.21 fail to prevent guest users from receiving Board Admin...

Vulnerabilities in Mattermost

Mattermost, Inc. has identified vulnerabilities in Mattermost versions 10.11.x, 11.7.x, and 11.8.x, including the GitLab plugin up to version 11.8. These vulnerabilities relate to various aspects of the Mattermost software, such as incorrect validation of WebSocket command fields, incorrect...

CVE-2026-16044

Mattermost versions 11.7.x = 11.7.6, 10.11.x = 10.11.21 fail to prevent guest users from receiving Board Admin privileges during board archive import which allows a board member to escalate a guest user to Board Admin via importing a crafted .boardarchive file. Mattermost Advisory ID:...

EUVD-2026-60211

Mattermost versions 11.7.x = 11.7.6, 10.11.x = 10.11.21 fail to prevent guest users from receiving Board Admin privileges during board archive import which allows a board member to escalate a guest user to Board Admin via importing a crafted .boardarchive file. Mattermost Advisory ID:...

CVE-2026-16044

Mattermost versions 11.7.x = 11.7.6, 10.11.x = 10.11.21 fail to prevent guest users from receiving Board Admin privileges during board archive import which allows a board member to escalate a guest user to Board Admin via importing a crafted .boardarchive file. Mattermost Advisory ID:...

CVE-2026-16044 Insufficient validation of guest board admin privileges on archive import

Mattermost versions 11.7.x = 11.7.6, 10.11.x = 10.11.21 fail to prevent guest users from receiving Board Admin privileges during board archive import which allows a board member to escalate a guest user to Board Admin via importing a crafted .boardarchive file. Mattermost Advisory ID:...

CVE-2026-16044: Incorrect Authorization

Mattermost versions 11.7.x = 11.7.6, 10.11.x = 10.11.21 fail to prevent guest users from receiving Board Admin privileges during board archive import which allows a board member to escalate a guest user to Board Admin via importing a crafted .boardarchive file. Mattermost Advisory ID:...

PT-2026-76669

Mattermost versions 11.7.x = 11.7.6, 10.11.x = 10.11.21 fail to prevent guest users from receiving Board Admin privileges during board archive import which allows a board member to escalate a guest user to Board Admin via importing a crafted .boardarchive file. Mattermost Advisory ID:...

CVE-2026-41419

4ga Boards is a boards system for realtime project management. Prior to 3.3.5, a path traversal vulnerability allows an authenticated user with board import privileges to make the server ingest arbitrary host files as board attachments during BOARDS archive import. Once imported, the file can be...