Mattermost Comment Deletion Permission Vulnerability in Boards

A vulnerability exists in Mattermost versions 11.0.x through 11.0.2, 10.12.x through 10.12.1, 10.11.x through 10.11.4, and 10.5.x through 10.5.12. These versions fail to properly validate user permissions when comments are deleted in Boards. This flaw allows an authenticated user with editor privileges to remove comments made by other users.

Impact

Exploitation of this vulnerability allows for unauthorized deletion of comments in Boards, potentially disrupting communication and collaboration.

Remediation

Users can upgrade to Mattermost versions 11.2.0, 11.1.0, 10.12.2, 10.11.7, or 10.5.13 to address this vulnerability.