CVE-2026-3473CWE-639

Improper file ownership validation in the Boards API allows unauthorised file access

Medium · published May 22, 2026

CVSS v3.1
5.9
EPSS
0%
Percentile
15.1
In the wild
Unconfirmed
What it is

Mattermost versions 11.6.x <= 11.6.0, 11.5.x <= 11.5.3, 11.4.x <= 11.4.4, 10.11.x <= 10.11.14 fail to validate file ownership and access control, which allows an authenticated user to access and download files belonging to other users or teams via crafted Boards API requests using valid file IDs.. Mattermost Advisory ID: MMSA-2026-00620

The record
Technical detail
CVSS v3.1
5.9 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:L/A:N
CVSS v4.0
Not supplied
EPSS
0.00248 · 15.1th percentile
Weakness
CWE-639 · Authorization Bypass Through User-Controlled Key
Published
2026-05-22T10:27Z
EPSS history
Timeline
  • 22 MAY 10:27Z
    Improper file ownership validation in the Boards API allows unauthorised file access
    cvelistv5