CVE-2026-2461

Missing authorization check allows unauthorized modification of other users' comments on a board

Mattermost Plugins versions <=11.3 11.0.3 11.2.2 10.10.11.0 fail to implement authorisation checks on comment block modifications, which allows an authorised attacker with editor permission to modify comments created by other board members. Mattermost Advisory ID: MMSA-2025-00559

Affected

Mattermost

CVSS v3.1 MATTERMOST

4.3 MEDIUMCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

EPSS

0.17% chance of exploitation in the next 30 days, 5th percentile

Published

2026-03-16

Proof-of-concept exploits (1)

• destiny-creates/CVE-2026-2461-poc0★ · 2026-01-30

Security advisories

• https://mattermost.com/security-updates
• advisories/GHSA-hf8w-x9h5-5gf9

References

• CVE Record
• NVD entry