CVE-2026-14344

Analyzed Analyzed - Analysis Complete

Unauthorized Board Creation in Mattermost

Publication date: 2026-09-14

Last updated on: 2026-10-07

Assigner: Mattermost, Inc.

Description

Mattermost versions 11.9.x <= 11.9.0, 11.8.x <= 11.8.4, 11.7.x <= 11.7.7, 10.11.x <= 10.11.22 fail to enforce the board-creation permission which allows an unauthorized authenticated user to create boards via the board duplicate, boards-and-blocks, and archive-import endpoints.. Mattermost Advisory ID: MMSA-2026-00715

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-14

Last Modified

2026-10-07

Generated

2026-10-19

AI Q&A

2026-09-14

EPSS Evaluated

2026-10-18

NVD

CVE-2026-14344

EUVD

EUVD-2026-77364

Affected Vendors & Products

Vendor	Product	Version / Range
mattermost	mattermost_server	From 10.11.0 (inc) to 10.11.23 (exc)
mattermost	mattermost_server	From 11.7.0 (inc) to 11.7.8 (exc)
mattermost	mattermost_server	From 11.8.0 (inc) to 11.8.5 (exc)
mattermost	mattermost_server	From 11.9.0 (inc) to 11.9.1 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-862	The product does not perform an authorization check when an actor attempts to access a resource or perform an action.

Attack-Flow Graph

Executive Summary

Mattermost versions between 11.9.0 and older, 11.8.4 and older, 11.7.7 and older, and 10.11.22 and older fail to enforce the board-creation permission. This allows an unauthorized authenticated user to create boards through specific endpoints like board duplicate, boards-and-blocks, and archive-import.

Detection Guidance

This vulnerability allows unauthorized board creation in Mattermost via specific endpoints. To detect it, check server logs for requests to /api/v4/boards/duplicate, /api/v4/boards/blocks, or /api/v4/boards/import. Look for POST requests from non-admin users creating boards without proper permissions.

Impact Analysis

An unauthorized user could create boards in your Mattermost instance, potentially leading to unauthorized data organization, confusion, or misuse of collaborative spaces. This could disrupt workflows or expose sensitive information if boards contain restricted data.

Compliance Impact

The vulnerability allows unauthorized users to create boards, which could lead to unauthorized data access or modification. This may violate compliance requirements for data integrity and access controls under standards like GDPR and HIPAA.

Mitigation Strategies

Update Mattermost to a version that is not affected by this vulnerability. Specifically, upgrade to versions beyond 11.9.0, 11.8.4, 11.7.7, or 10.11.22 depending on your current installation.

Hi! I’m here to help you understand CVE-2026-14344. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70