Mattermost doesn't validate file ownership and access control

GHSA-7pf2-9c95-w332 · CVE-2026-3473 · GO-2026-5817

Published May 26, 2026 · Modified Jul 7, 2026

Description

Mattermost versions 11.6.x <= 11.6.0, 11.5.x <= 11.5.3, 11.4.x <= 11.4.4, 10.11.x <= 10.11.14 fail to validate file ownership and access control, which allows an authenticated user to access and download files belonging to other users or teams via crafted Boards API requests using valid file IDs. Mattermost Advisory ID: MMSA-2026-00620.

References

ADVISORY https://nvd.nist.gov/vuln/detail/CVE-2026-3473
PACKAGE https://github.com/mattermost/mattermost
WEB https://mattermost.com/security-updates

Ready to move

Start Securing

Start for Free Get Demo

Free, no credit card | First findings in minutes