Mattermost User Permission Vulnerability in Boards Feature Allowing Unauthorized File Access and Subscriptions

A vulnerability exists in Mattermost versions 10.11.x through 10.11.4 and 10.5.x through 10.5.12, where the application fails to properly validate user permissions when accessing files and subscribing to blocks in the Boards feature. This flaw enables an authenticated user to access files from other users' boards and subscribe to blocks on those boards, even without the necessary permissions.

Impact

Exploitation of this vulnerability allows for unauthorized access to files uploaded by other users and the ability to subscribe to blocks on boards without having the appropriate access rights.

Remediation

Users can upgrade to Mattermost versions 11.1.010.11.510.5.13 or 11.1.010.11.5 to address this vulnerability.