CVE-2025-13870: Mattermost Server Auth Bypass Vulnerability

CVE-2025-13870 Overview

CVE-2025-13870 is an authorization bypass vulnerability affecting Mattermost Server versions 10.11.x through 10.11.4 and 10.5.x through 10.5.12. The flaw resides in the Boards feature, where the application fails to validate user permissions when accessing files and subscribing to blocks. An authenticated user can access files from boards they do not own and subscribe to blocks belonging to boards outside their authorized scope. The issue is tracked under CWE-306: Missing Authentication for Critical Function.

Critical Impact
Authenticated Mattermost users can read board files and subscribe to blocks across team boundaries, exposing collaborative content intended to remain private.

Affected Products

Mattermost Server 10.11.0 through 10.11.4
Mattermost Server 10.5.0 through 10.5.12
Mattermost Boards feature

Discovery Timeline

2025-12-02 - CVE-2025-13870 published to the National Vulnerability Database
2025-12-03 - Last updated in NVD database

Technical Details for CVE-2025-13870

Vulnerability Analysis

The vulnerability is a broken access control issue in Mattermost Boards. The server-side handlers responsible for serving board file attachments and managing block subscriptions do not enforce membership checks against the parent board. Once a user authenticates to a Mattermost instance, the application trusts the request to reference resources the user can access without re-validating ownership or team membership.

This allows lateral access to data across board boundaries. The information disclosed is limited to file contents and the metadata exposed via block subscriptions, but it bypasses the Boards permission model entirely.

Root Cause

The root cause is missing authorization enforcement [CWE-306] in two Boards code paths: the file retrieval endpoint and the block subscription endpoint. Neither path verifies that the requesting user has read access to the parent board before fulfilling the request. The check relies on resource identifier knowledge rather than a server-side permission lookup.

Attack Vector

Exploitation requires an authenticated, low-privileged account on the target Mattermost server. The attacker issues authenticated HTTP requests to the Boards API referencing file or block identifiers from boards they do not belong to. Identifiers can be obtained through enumeration, leaked links, or prior collaboration history.

No verified public proof-of-concept exploit is available. Refer to the Mattermost Security Updates advisory for technical details.

Detection Methods for CVE-2025-13870

Indicators of Compromise

Authenticated requests to Boards file endpoints (/plugins/focalboard/api/v2/files/) referencing resources outside the user's known boards or teams.
Block subscription API calls (/plugins/focalboard/api/v2/subscriptions) from accounts that have never interacted with the referenced board.
Sudden spikes in file downloads or subscription creations by a single low-privileged account.

Detection Strategies

Correlate Boards API access logs against the user's team and board membership records to flag cross-board access.
Alert on authenticated users enumerating sequential or unrelated board, block, or file identifiers.
Review audit logs for subscription events tied to blocks the user has no historical access to.

Monitoring Recommendations

Forward Mattermost application and audit logs to a centralized analytics platform for permission-mismatch queries.
Track baseline file-access volume per user and alert on statistical deviations.
Monitor outbound traffic from the Mattermost host for bulk exfiltration following anomalous Boards activity.

How to Mitigate CVE-2025-13870

Immediate Actions Required

Upgrade Mattermost Server to a patched release above 10.11.4 on the 10.11.x branch or above 10.5.12 on the 10.5.x extended support branch.
Inventory all Mattermost deployments and confirm running versions before any external exposure remains in place.
Audit recent Boards file and subscription activity for evidence of cross-board access prior to patching.

Patch Information

Mattermost has issued fixes documented in the Mattermost Security Updates advisory. Administrators should apply the latest maintenance release on their supported branch, which adds the missing permission checks to the Boards file and subscription handlers.

Workarounds

Restrict access to the Boards plugin by disabling it for users who do not require collaborative board functionality until patching is complete.
Limit network exposure of the Mattermost server to trusted networks and authenticated VPN users.
Enforce strict team membership policies and remove inactive accounts to reduce the authenticated attack surface.

bash

# Verify the running Mattermost server version before and after patching
mattermost version

# Disable the Focalboard (Boards) plugin as a temporary mitigation
mattermost plugin disable focalboard