PT-2026-25685 · Mattermost · Mattermost Plugins+1

Daynight · Published 2026-03-16 · Updated 2026-03-27 · CVE-2026-2461

Positive Technologies (AI Summary)

CVSS v3.1

4.3

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

Name of the Vulnerable Software and Affected Versions Mattermost Plugins versions 10.10.11.0 through 11.3

Description The Mattermost Plugins do not properly enforce authorization checks when modifying comment blocks. This allows an authorized attacker with editor permissions to modify comments created by other members. The vulnerable component is related to comment block modifications within the Mattermost Boards Plugin.

Recommendations Update to a version of Mattermost Plugins later than 11.3.

Fix

IDOR

Weakness Enumeration

CWE-639

Related Identifiers

CVE-2026-2461

GHSA-HF8W-X9H5-5GF9

GO-2026-4782

SUSE-SU-2026:1135-1

Affected Products

Mattermost Boards Plugin

Mattermost Plugins

References · 149

• https://osv.dev/vulnerability/SUSE-SU-2026:1135-1 · Vendor Advisory
• https://mattermost.com/security-updates · Vendor Advisory
• https://osv.dev/vulnerability/GO-2026-4782 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-hf8w-x9h5-5gf9 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2026-2461 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-2461 · Security Note
• https://github.com/mattermost/mattermost-plugin-boards/commit/57c5be5b6ef59d02dd72e35094d1fae8ba6e9619 · Note
• https://github.com/mattermost/mattermost-plugin-boards · Note
• https://suse.com/security/cve/CVE-2026-29785 · Note
• https://suse.com/security/cve/CVE-2026-33217 · Note
• https://suse.com/security/cve/CVE-2026-33676 · Note
• https://suse.com/security/cve/CVE-2026-4404 · Note
• https://suse.com/security/cve/CVE-2026-33322 · Note
• https://suse.com/security/cve/CVE-2026-32941 · Note
• https://suse.com/security/cve/CVE-2026-33221 · Note