Volerion logoVolerion
Volerion logoVolerion

Mattermost Access Control Vulnerability in File Download Endpoint Allowing Sensitive File Disclosure

Vulnerability

A vulnerability exists in Mattermost versions 10.5.x prior to 10.5.8 and 9.11.x prior to 9.11.17, where the application fails to properly validate access controls. This flaw enables any authenticated user to download sensitive files by exploiting the board file download endpoint through UUID enumeration.

Impact

Exploitation of this vulnerability could lead to unauthorized access and download of sensitive files.

Remediation

Users can upgrade to Mattermost versions 10.12.0 or 10.11.0 to address this vulnerability.

Added: Sep 19, 2025, 8:18 PM
Updated: Sep 19, 2025, 8:18 PM

Vulnerability Rating

Custom Algorithm
spread
3.1
impact
2.5
exploitability
4.8
remediation
7.7
relevance
0.5
threat
0.0
urgency
2.9
incentive
1.7

Our algorithm analyzes dozens of metrics to generate these 8 key vulnerability categories, which are then combined to calculate the overall risk score.