CVE-2026-3473: Mattermost doesn't validate file ownership and access control

May 26, 2026 (updated June 26, 2026)

Mattermost versions 11.6.x <= 11.6.0, 11.5.x <= 11.5.3, 11.4.x <= 11.4.4, 10.11.x <= 10.11.14 fail to validate file ownership and access control, which allows an authenticated user to access and download files belonging to other users or teams via crafted Boards API requests using valid file IDs. Mattermost Advisory ID: MMSA-2026-00620.

References

github.com/advisories/GHSA-7pf2-9c95-w332
mattermost.com/security-updates
nvd.nist.gov/vuln/detail/CVE-2026-3473

Code Behaviors & Features

Detect and mitigate CVE-2026-3473 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Learn more about Dependency Scanning →