Boards
by Mattermost
Source repositories
CVEs (7)
| CVE | Vendor / Product | Sev | Risk | CVSS | EPSS | KEV | Published | Description |
|---|---|---|---|---|---|---|---|---|
| CVE-2026-10080 | Med | 0.35 | 6.5 | 0.00 | Aug 17, 2026 | Mattermost versions 11.7.x <= 11.7.6, 10.11.x <= 10.11.21, 11.8.x <= 11.8.3 fails to validate WebSocket command field types which allows an authenticated user to crash the plugin process and deny service to all Boards users via a custom_focalboard_SUBSCRIBE_TEAM message with a… | ||
| CVE-2026-14298 | Med | 0.35 | 6.5 | 0.00 | Aug 13, 2026 | Mattermost versions 11.9.x <= 11.9.0, 11.8.x <= 11.8.4, 11.7.x <= 11.7.7, 10.11.x <= 10.11.22 fail to limit decompressed content size and enforce the configured maximum file size in the Boards archive import handler, which allows an authenticated user to cause memory exhaustion… | ||
| CVE-2021-37866 | Med | 0.31 | 4.7 | 0.01 | Jan 18, 2022 | Mattermost Boards plugin v0.10.0 and earlier fails to invalidate a session on the server-side when a user logged out of Boards, which allows an attacker to reuse old session token for authorization. | ||
| CVE-2023-3585 | Med | 0.28 | 4.3 | 0.01 | Jul 17, 2023 | Mattermost Boards fail to properly validate a board link, allowing an attacker to crash a channel by posting a specially crafted boards link. | ||
| CVE-2021-37867 | Med | 0.28 | 4.3 | 0.01 | Jan 18, 2022 | Mattermost Boards plugin v0.10.0 and earlier fails to protect email addresses of all users via one of the Boards APIs, which allows authenticated and unauthorized users to access this information resulting in sensitive & private information disclosure. | ||
| CVE-2023-3586 | Med | 0.27 | 4.2 | 0.00 | Jul 17, 2023 | Mattermost fails to disable public Boards after the "Enable Publicly-Shared Boards" configuration option is disabled, resulting in previously-shared public Boards to remain accessible. | ||
| CVE-2023-3590 | Low | 0.20 | 3.1 | 0.00 | Jul 17, 2023 | Mattermost fails to delete card attachments in Boards, allowing an attacker to access deleted attachments. |
- risk 0.35cvss 6.5epss 0.00
Mattermost versions 11.7.x <= 11.7.6, 10.11.x <= 10.11.21, 11.8.x <= 11.8.3 fails to validate WebSocket command field types which allows an authenticated user to crash the plugin process and deny service to all Boards users via a custom_focalboard_SUBSCRIBE_TEAM message with a…
- risk 0.35cvss 6.5epss 0.00
Mattermost versions 11.9.x <= 11.9.0, 11.8.x <= 11.8.4, 11.7.x <= 11.7.7, 10.11.x <= 10.11.22 fail to limit decompressed content size and enforce the configured maximum file size in the Boards archive import handler, which allows an authenticated user to cause memory exhaustion…
- risk 0.31cvss 4.7epss 0.01
Mattermost Boards plugin v0.10.0 and earlier fails to invalidate a session on the server-side when a user logged out of Boards, which allows an attacker to reuse old session token for authorization.
- risk 0.28cvss 4.3epss 0.01
Mattermost Boards fail to properly validate a board link, allowing an attacker to crash a channel by posting a specially crafted boards link.
- risk 0.28cvss 4.3epss 0.01
Mattermost Boards plugin v0.10.0 and earlier fails to protect email addresses of all users via one of the Boards APIs, which allows authenticated and unauthorized users to access this information resulting in sensitive & private information disclosure.
- risk 0.27cvss 4.2epss 0.00
Mattermost fails to disable public Boards after the "Enable Publicly-Shared Boards" configuration option is disabled, resulting in previously-shared public Boards to remain accessible.
- risk 0.20cvss 3.1epss 0.00
Mattermost fails to delete card attachments in Boards, allowing an attacker to access deleted attachments.