CVE-2026-2461: Mattermost Boards Plugin fails to implement authorisation checks on comment block modifications

March 16, 2026 (updated March 19, 2026)

Mattermost Plugins versions <=11.3 11.0.3 11.2.2 10.10.11.0 fail to implement authorisation checks on comment block modifications, which allows an authorised attacker with editor permission to modify comments created by other board members. Mattermost Advisory ID: MMSA-2025-00559

References

github.com/advisories/GHSA-hf8w-x9h5-5gf9
github.com/mattermost/mattermost-plugin-boards
github.com/mattermost/mattermost-plugin-boards/commit/57c5be5b6ef59d02dd72e35094d1fae8ba6e9619
mattermost.com/security-updates
nvd.nist.gov/vuln/detail/CVE-2026-2461

Code Behaviors & Features

Detect and mitigate CVE-2026-2461 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →