| Package | Affected versions | Patched versions |
|---|---|---|
| github.com/mattermost/mattermost-plugin-boards | < 0.0.0-20250716054606-3f3e3becfe1d | 0.0.0-20250716054606-3f3e3becfe1d |
| github.com/mattermost/mattermost-server | ≥ 10.5.0-rc1, < 10.5.9≥ 10.5.0-rc1+incompatible, < 10.5.9+incompatible≥ 9.11.0-rc1, < 9.11.18≥ 9.11.0-rc1+incompatible, < 9.11.18+incompatible | 10.5.910.5.9+incompatible9.11.189.11.18+incompatible |
| github.com/mattermost/mattermost-server/v5 | all versions | |
| github.com/mattermost/mattermost-server/v6 | all versions | |
| github.com/mattermost/mattermost/server/v8 | < 8.0.0-20250721095935-11c36f4d1e44 | 8.0.0-20250721095935-11c36f4d1e44 |
| mattermost server | ≥ 10.5.0, < 10.5.9≥ 9.11.0, < 9.11.17 | 10.5.99.11.17 |
Mattermost versions 10.5.x <= 10.5.8, 9.11.x <= 9.11.17 fail to properly validate access controls which allows any authenticated user to download sensitive files via board file download endpoint using UUID enumeration
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free