CVE-2026-3473

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-3473", "assignerOrgId": "9302f53e-dde5-4bf3-b2f2-a83f91ac0eee", "state": "PUBLISHED", "assignerShortName": "Mattermost", "dateReserved": "2026-03-03T12:57:13.379Z", "datePublished": "2026-05-22T10:27:02.600Z", "dateUpdated": "2026-05-22T12:12:49.437Z"}, "containers": {"cna": {"affected": [{"defaultStatus": "unaffected", "product": "Mattermost", "vendor": "Mattermost", "versions": [{"lessThanOrEqual": "11.6.0", "status": "affected", "version": "11.6.0", "versionType": "semver"}, {"lessThanOrEqual": "11.5.3", "status": "affected", "version": "11.5.0", "versionType": "semver"}, {"lessThanOrEqual": "11.4.4", "status": "affected", "version": "11.4.0", "versionType": "semver"}, {"lessThanOrEqual": "10.11.14", "status": "affected", "version": "10.11.0", "versionType": "semver"}, {"version": "11.7.0", "status": "unaffected"}, {"version": "11.6.1", "status": "unaffected"}, {"version": "11.5.4", "status": "unaffected"}, {"version": "11.4.5", "status": "unaffected"}, {"version": "10.11.15", "status": "unaffected"}]}], "credits": [{"lang": "en", "type": "finder", "value": "eahmed"}], "descriptions": [{"lang": "en", "value": "Mattermost versions 11.6.x <= 11.6.0, 11.5.x <= 11.5.3, 11.4.x <= 11.4.4, 10.11.x <= 10.11.14 fail to validate file ownership and access control, which allows an authenticated user to access and download files belonging to other users or teams via crafted Boards API requests using valid file IDs.. Mattermost Advisory ID: MMSA-2026-00620"}], "metrics": [{"cvssV3_1": {"attackVector": "NETWORK", "attackComplexity": "HIGH", "privilegesRequired": "LOW", "userInteraction": "NONE", "scope": "UNCHANGED", "confidentialityImpact": "HIGH", "integrityImpact": "LOW", "availabilityImpact": "NONE", "version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:L/A:N", "baseSeverity": "MEDIUM", "baseScore": 5.9}, "format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "description": "CWE-639: Authorization Bypass Through User-Controlled Key", "cweId": "CWE-639"}]}], "references": [{"url": "https://mattermost.com/security-updates", "name": "MMSA-2026-00620", "tags": ["vendor-advisory"]}], "solutions": [{"value": "Update Mattermost to versions 11.7.0, 11.6.1, 11.5.4, 11.4.5, 10.11.15 or higher.", "lang": "en"}], "source": {"advisory": "MMSA-2026-00620", "defect": ["https://mattermost.atlassian.net/browse/MM-67759"], "discovery": "EXTERNAL"}, "title": "Improper file ownership validation in the Boards API allows unauthorised file access", "providerMetadata": {"orgId": "9302f53e-dde5-4bf3-b2f2-a83f91ac0eee", "shortName": "Mattermost", "dateUpdated": "2026-05-22T10:27:02.600Z"}, "x_generator": {"engine": "cvelib 1.8.0"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-05-22T12:12:41.198607Z", "id": "CVE-2026-3473", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-05-22T12:12:49.437Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-3473", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-05-22T12:12:41.198607Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-05-22T12:12:45.995Z"}}], "cna": {"title": "Improper file ownership validation in the Boards API allows unauthorised file access", "source": {"defect": ["https://mattermost.atlassian.net/browse/MM-67759"], "advisory": "MMSA-2026-00620", "discovery": "EXTERNAL"}, "credits": [{"lang": "en", "type": "finder", "value": "eahmed"}], "metrics": [{"format": "CVSS", "cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.9, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "HIGH", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"vendor": "Mattermost", "product": "Mattermost", "versions": [{"status": "affected", "version": "11.6.0", "versionType": "semver", "lessThanOrEqual": "11.6.0"}, {"status": "affected", "version": "11.5.0", "versionType": "semver", "lessThanOrEqual": "11.5.3"}, {"status": "affected", "version": "11.4.0", "versionType": "semver", "lessThanOrEqual": "11.4.4"}, {"status": "affected", "version": "10.11.0", "versionType": "semver", "lessThanOrEqual": "10.11.14"}, {"status": "unaffected", "version": "11.7.0"}, {"status": "unaffected", "version": "11.6.1"}, {"status": "unaffected", "version": "11.5.4"}, {"status": "unaffected", "version": "11.4.5"}, {"status": "unaffected", "version": "10.11.15"}], "defaultStatus": "unaffected"}], "solutions": [{"lang": "en", "value": "Update Mattermost to versions 11.7.0, 11.6.1, 11.5.4, 11.4.5, 10.11.15 or higher."}], "references": [{"url": "https://mattermost.com/security-updates", "name": "MMSA-2026-00620", "tags": ["vendor-advisory"]}], "x_generator": {"engine": "cvelib 1.8.0"}, "descriptions": [{"lang": "en", "value": "Mattermost versions 11.6.x <= 11.6.0, 11.5.x <= 11.5.3, 11.4.x <= 11.4.4, 10.11.x <= 10.11.14 fail to validate file ownership and access control, which allows an authenticated user to access and download files belonging to other users or teams via crafted Boards API requests using valid file IDs.. Mattermost Advisory ID: MMSA-2026-00620"}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-639", "description": "CWE-639: Authorization Bypass Through User-Controlled Key"}]}], "providerMetadata": {"orgId": "9302f53e-dde5-4bf3-b2f2-a83f91ac0eee", "shortName": "Mattermost", "dateUpdated": "2026-05-22T10:27:02.600Z"}}}, "cveMetadata": {"cveId": "CVE-2026-3473", "state": "PUBLISHED", "dateUpdated": "2026-05-22T12:12:49.437Z", "dateReserved": "2026-03-03T12:57:13.379Z", "assignerOrgId": "9302f53e-dde5-4bf3-b2f2-a83f91ac0eee", "datePublished": "2026-05-22T10:27:02.600Z", "assignerShortName": "Mattermost"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Mattermost", "vendor": "Mattermost", "versions": [{"lessThanOrEqual": "11.6.0", "status": "affected", "version": "11.6.0", "versionType": "semver"}, {"lessThanOrEqual": "11.5.3", "status": "affected", "version": "11.5.0", "versionType": "semver"}, {"lessThanOrEqual": "11.4.4", "status": "affected", "version": "11.4.0", "versionType": "semver"}, {"lessThanOrEqual": "10.11.14", "status": "affected", "version": "10.11.0", "versionType": "semver"}, {"status": "unaffected", "version": "11.7.0"}, {"status": "unaffected", "version": "11.6.1"}, {"status": "unaffected", "version": "11.5.4"}, {"status": "unaffected", "version": "11.4.5"}, {"status": "unaffected", "version": "10.11.15"}]}], "source": "responsibledisclosure@mattermost.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:mattermost:mattermost_server:*:*:*:*:*:*:*:*", "matchCriteriaId": "6696A83A-CD06-45BD-A4C1-16A09C4CA15B", "versionEndExcluding": "10.11.15", "versionStartIncluding": "10.11.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:mattermost:mattermost_server:*:*:*:*:*:*:*:*", "matchCriteriaId": "AB489375-1F54-4A24-AE2C-37D92B27FF4D", "versionEndExcluding": "11.4.5", "versionStartIncluding": "11.4.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:mattermost:mattermost_server:*:*:*:*:*:*:*:*", "matchCriteriaId": "617D4791-A087-42E8-BF73-B39B30CB29C8", "versionEndExcluding": "11.5.4", "versionStartIncluding": "11.5.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:mattermost:mattermost_server:*:*:*:*:*:*:*:*", "matchCriteriaId": "77708744-DCB4-4AE3-8146-CB043DAB6FBB", "versionEndExcluding": "11.6.1", "versionStartIncluding": "11.6.0", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Mattermost versions 11.6.x <= 11.6.0, 11.5.x <= 11.5.3, 11.4.x <= 11.4.4, 10.11.x <= 10.11.14 fail to validate file ownership and access control, which allows an authenticated user to access and download files belonging to other users or teams via crafted Boards API requests using valid file IDs.. Mattermost Advisory ID: MMSA-2026-00620"}, {"lang": "es", "value": "Las versiones de Mattermost 11.6.x <= 11.6.0, 11.5.x <= 11.5.3, 11.4.x <= 11.4.4, 10.11.x <= 10.11.14 no validan la propiedad de los archivos y el control de acceso, lo que permite a un usuario autenticado acceder y descargar archivos pertenecientes a otros usuarios o equipos a trav\u00e9s de solicitudes de la API de Boards manipuladas utilizando IDs de archivo v\u00e1lidos. ID de Aviso de Mattermost: MMSA-2026-00620"}], "id": "CVE-2026-3473", "lastModified": "2026-07-23T16:10:00.137", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5.9, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 1.6, "impactScore": 4.2, "source": "responsibledisclosure@mattermost.com", "type": "Secondary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 7.1, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 4.2, "source": "nvd@nist.gov", "type": "Primary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-3473", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-05-22T12:12:41.198607Z", "version": "2.0.3"}}]}, "published": "2026-05-22T11:16:22.477", "references": [{"source": "responsibledisclosure@mattermost.com", "tags": ["Vendor Advisory"], "url": "https://mattermost.com/security-updates"}], "sourceIdentifier": "responsibledisclosure@mattermost.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-639"}], "source": "responsibledisclosure@mattermost.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,11.6.0]"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,11.5.3]"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,11.4.4]"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,10.11.14]"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "11.7.0"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "11.6.1"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "11.5.4"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "11.4.5"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "10.11.15"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "Mattermost", "source": "cna", "vendor": "Mattermost"}, "product": "mattermost", "vendor": "mattermost"}], "created": "2026-05-22T12:30:27.479438+00:00", "updated": "2026-05-22T13:30:35.940023+00:00", "vendors": ["mattermost", "mattermost$PRODUCT$mattermost"]}