PT-2026-25685 · Mattermost · Mattermost Plugins+1

Daynight · Publicado 2026-03-16 · Atualizado 2026-03-27 · CVE-2026-2461

Positive Technologies (AI Summary)

CVSS v3.1

4.3

Média

Vetor base

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

Name of the Vulnerable Software and Affected Versions Mattermost Plugins versions 10.10.11.0 through 11.3

Description The Mattermost Plugins do not properly enforce authorization checks when modifying comment blocks. This allows an authorized attacker with editor permissions to modify comments created by other members. The vulnerable component is related to comment block modifications within the Mattermost Boards Plugin.

Recommendations Update to a version of Mattermost Plugins later than 11.3.

Correção

IDOR

Enumeração de Fraquezas

CWE-639

Identificadores relacionados

CVE-2026-2461

GHSA-HF8W-X9H5-5GF9

GO-2026-4782

SUSE-SU-2026:1135-1

Produtos afetados

Mattermost Boards Plugin

Mattermost Plugins

Referências · 149

• https://github.com/mattermost/mattermost-plugin-boards/commit/57c5be5b6ef59d02dd72e35094d1fae8ba6e9619 · Nota
• https://github.com/mattermost/mattermost-plugin-boards · Nota
• https://suse.com/security/cve/CVE-2026-29785 · Nota
• https://suse.com/security/cve/CVE-2026-33217 · Nota
• https://suse.com/security/cve/CVE-2026-33676 · Nota
• https://suse.com/security/cve/CVE-2026-4404 · Nota
• https://suse.com/security/cve/CVE-2026-33322 · Nota
• https://suse.com/security/cve/CVE-2026-32941 · Nota
• https://suse.com/security/cve/CVE-2026-33221 · Nota
• https://suse.com/security/cve/CVE-2026-2463 · Nota
• https://suse.com/security/cve/CVE-2026-33081 · Nota
• https://suse.com/security/cve/CVE-2026-30924 · Nota
• https://suse.com/security/cve/CVE-2026-32938 · Nota
• https://suse.com/security/cve/CVE-2026-32287 · Nota
• https://suse.com/security/cve/CVE-2026-2578 · Nota