Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 3

Export CSV
CVE-2025-12756

Insecure Direct Object Reference in Mattermost Boards Plugin Enables Unauthorised Comment Deletion

Mattermost versions 11.0.x <= 11.0.2, 10.12.x <= 10.12.1, 10.11.x <= 10.11.4, 10.5.x <= 10.5.12 fail to validate user permissions when deleting comments in Boards, which allows an authenticated user with the editor role to delete comments created by other users.

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed
Vendors
Mattermost
Products
Mattermost Mattermost Boards Mattermost Server
CVE-2021-37866

Session is not invalidated on server-side when user logged out of Boards

Mattermost Boards plugin v0.10.0 and earlier fails to invalidate a session on the server-side when a user logged out of Boards, which allows an attacker to reuse old session token for authorization.

CVSS 3.1 · 4.7 Medium EPSS < 1% KEV · Not listed
Vendors
Mattermost
Products
Mattermost Boards
CVE-2021-37867

Emails of all users are exposed via one of the Boards APIs

Mattermost Boards plugin v0.10.0 and earlier fails to protect email addresses of all users via one of the Boards APIs, which allows authenticated and unauthorized users to access this information resulting in sensitive & private information disclosure.

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed
Vendors
Mattermost
Products
Mattermost Boards