CVE-2026-3473: Mattermost Server Auth Bypass Vulnerability

CVE-2026-3473 Overview

CVE-2026-3473 is an Insecure Direct Object Reference (IDOR) vulnerability in Mattermost Server. The flaw exists in the Boards API, which fails to validate file ownership and access control. An authenticated user can supply a valid file ID in crafted Boards API requests to download files belonging to other users or teams. The issue is tracked as Mattermost Advisory ID MMSA-2026-00620 and is categorized under CWE-639: Authorization Bypass Through User-Controlled Key.

Critical Impact

Authenticated users can access and exfiltrate confidential files belonging to other users or teams across the Mattermost deployment, leading to cross-tenant data exposure.

Affected Products

• Mattermost Server 11.6.x <= 11.6.0
• Mattermost Server 11.5.x <= 11.5.3, 11.4.x <= 11.4.4
• Mattermost Server 10.11.x <= 10.11.14

Discovery Timeline

• 2026-05-22 - CVE-2026-3473 published to NVD
• 2026-05-22 - Last updated in NVD database

Technical Details for CVE-2026-3473

Vulnerability Analysis

The vulnerability resides in Mattermost's Boards API file retrieval logic. The endpoint accepts a file identifier from the requester but does not verify whether the authenticated session has legitimate ownership of or access rights to the referenced file. Any authenticated user who knows or guesses a valid file ID can request and download that file through the Boards interface.

This is a classic broken access control issue. The system trusts the user-controlled file ID as authoritative without performing a server-side authorization check against the calling user's team membership, board membership, or file ownership. Confidentiality impact is high because attachments uploaded to private boards or direct messages can be retrieved by unrelated accounts within the deployment.

Root Cause

The root cause is a missing authorization check on file access in the Boards API handlers. The application maps a supplied file ID to its storage location and returns the content without first confirming that the requesting principal is authorized to view that file. This pattern aligns with [CWE-639], where access decisions rely on a user-controlled key rather than enforced server-side policy.

Attack Vector

Exploitation requires network access to the Mattermost instance and a valid authenticated session. The attacker iterates or harvests file IDs, references them in crafted Boards API requests, and receives the underlying file content. No user interaction from the victim is required, and no elevated privileges are needed on the attacker side. The vulnerability does not modify data integrity directly but allows unauthorized read access to sensitive files across team boundaries.

Detection Methods for CVE-2026-3473

Indicators of Compromise

• Boards API requests referencing file IDs that do not correspond to boards or channels the requesting user is a member of.
• Unusual volume of file download requests from a single authenticated user account against the Boards API endpoints.
• Sequential or enumerated file ID patterns in HTTP access logs targeting Boards file routes.

Detection Strategies

• Audit Mattermost application and proxy logs for Boards API file retrieval calls and correlate the requesting user_id with the file owner's team membership.
• Alert on accounts retrieving files attached to boards or teams they have never authored content in.
• Compare file access patterns over time to baseline behavior and flag accounts exhibiting broad cross-team file access.

Monitoring Recommendations

• Forward Mattermost audit logs and reverse-proxy access logs to a centralized logging or SIEM platform for correlation.
• Track authenticated session activity for high-frequency or enumerative requests against /api/v4/... Boards file endpoints.
• Monitor outbound data volume from accounts that historically perform low file-download activity.

How to Mitigate CVE-2026-3473

Immediate Actions Required

• Upgrade Mattermost Server to a fixed release above 11.6.0, 11.5.3, 11.4.4, or 10.11.14 per the vendor advisory.
• Review recent Boards API access logs to identify potential unauthorized file retrievals predating the patch.
• Rotate or invalidate any credentials, tokens, or secrets that may have been stored in shared files on Boards.

Patch Information

Mattermost has released fixed versions addressing this issue. Refer to the Mattermost Security Updates page for the corresponding patched releases for the 10.11.x, 11.4.x, 11.5.x, and 11.6.x branches. Apply the upgrade following Mattermost's standard upgrade procedure for your deployment topology.

Workarounds

• Restrict Boards plugin usage to trusted teams until the server can be upgraded.
• Limit network exposure of the Mattermost API to authenticated corporate networks via reverse-proxy ACLs.
• Disable the Boards feature in the System Console if it is not required by the organization.