CVE-2026-14344: Mattermost Auth Bypass Vulnerability

CVE-2026-14344 Overview

CVE-2026-14344 is a missing authorization vulnerability [CWE-862] in Mattermost that allows authenticated users to bypass the board-creation permission. The flaw affects the board duplicate, boards-and-blocks, and archive-import endpoints. An attacker with a valid Mattermost account can create boards even when the platform's role-based access controls should deny that action. Mattermost tracks the issue as advisory MMSA-2026-00715.

Critical Impact
Authenticated users can create boards through three API endpoints without the required permission, undermining tenant governance and content controls in shared Mattermost workspaces.

Affected Products

Mattermost 11.9.x versions <= 11.9.0
Mattermost 11.8.x versions <= 11.8.4
Mattermost 11.7.x versions <= 11.7.7
Mattermost 10.11.x versions <= 10.11.22

Discovery Timeline

2026-09-14 - CVE-2026-14344 published to NVD
2026-09-16 - Last updated in NVD database

Technical Details for CVE-2026-14344

Vulnerability Analysis

The vulnerability resides in the Mattermost Boards feature, which uses per-team permissions to control who can create boards. Three endpoints fail to enforce the create_board permission check before writing new board objects to the database. The board duplicate endpoint clones an existing board without re-validating that the caller holds creation rights on the target scope. The boards-and-blocks endpoint accepts combined payloads that create boards alongside child blocks in one transaction. The archive-import endpoint reconstructs boards from an uploaded archive without gating the operation on the permission check.

The result is a broken access control condition where server-side authorization does not match the intent of the permission model. Any authenticated user with network access to the API can invoke these endpoints and create boards, regardless of role assignment.

Root Cause

The root cause is missing authorization logic [CWE-862] in the affected handlers. Mattermost enforces board creation permission at the primary creation endpoint but omits equivalent checks on the alternate creation paths. This inconsistency reflects a common pattern where secondary code paths that also produce the same resource are not covered by the same policy guard.

Attack Vector

Exploitation requires network access to the Mattermost server and valid user credentials. No user interaction is required from other users. The attacker sends crafted HTTP requests to /api/v2/boards/{boardID}/duplicate, the boards-and-blocks batch endpoint, or the archive import endpoint. The server processes the request, creates the board, and returns a success response. Integrity of the workspace is affected because unauthorized board objects appear in the system, while confidentiality and availability are not directly impacted.

Verified proof-of-concept code is not published. Refer to the Mattermost Security Updates advisory for endpoint-level detail.

Detection Methods for CVE-2026-14344

Indicators of Compromise

Unexpected board objects owned by users whose role does not include the create_board permission.
API access log entries showing successful POST requests to board duplicate, boards-and-blocks, or archive-import endpoints from accounts that should lack creation rights.
Sudden growth in board counts within teams that normally restrict board creation to a small set of administrators.

Detection Strategies

Correlate Mattermost audit logs with the role membership of the requesting user and flag board creations by users without create_board.
Review reverse proxy or web application firewall logs for repeated calls to the three affected endpoints from a single authenticated session.
Compare the current board inventory against a known-good baseline snapshot taken before the vulnerable version was deployed.

Monitoring Recommendations

Forward Mattermost audit and API logs to a centralized SIEM and build alerts on board creation events tied to non-privileged accounts.
Enable verbose logging on the Boards service during patch rollout to capture endpoint usage patterns.
Track EPSS scoring for CVE-2026-14344 (currently 0.152%) to detect shifts in exploitation likelihood.

How to Mitigate CVE-2026-14344

Immediate Actions Required

Upgrade Mattermost to a fixed release above 11.9.0, 11.8.4, 11.7.7, or 10.11.22 per the Mattermost Security Updates page.
Audit existing boards for objects created by users who should not hold the create_board permission and remove unauthorized boards.
Rotate API tokens for any account suspected of abusing the affected endpoints.

Patch Information

Mattermost has published fixes under advisory MMSA-2026-00715. Administrators should apply the vendor-supplied release that matches their current maintenance branch and validate the upgrade in a staging environment before production rollout.

Workarounds

Restrict network access to the Mattermost API to trusted client networks while patching is scheduled.
Disable the Boards plugin at the system console if it is not required by the business.
Reduce the number of authenticated users on the platform temporarily by suspending non-essential accounts until the patch is deployed.

bash

# Configuration example: disable the Boards plugin via mmctl
mmctl plugin disable focalboard
mmctl config set PluginSettings.PluginStates.focalboard.Enable false