Mattermost boards plugin fails to restrict download access to files in github.com/mattermost/mattermost-plugin-boards
Mattermost boards plugin fails to restrict download access to files in github.com/mattermost/mattermost-plugin-boards
02 / AFFECTED SOFTWARE
Affected packages
64 explicit affected versions
03 / CONNECTIONS
Connected vulnerabilities
04 / EVIDENCE
Source records
Mattermost versions 10.5.x <= 10.5.8, 9.11.x <= 9.11.17 fail to properly validate access controls which allows any authenticated user to download sensitive files via board file download endpoint using UUID enumeration
Mattermost boards plugin fails to restrict download access to files in github.com/mattermost/mattermost-plugin-boards
Mattermost versions 10.5.x <= 10.5.8, 9.11.x <= 9.11.17 fail to properly validate access controls which allows any authenticated user to download sensitive files via board file download endpoint using UUID enumeration
05 / REFERENCES
Further evidence
- https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/9xxx/CVE-2025-9081.json
- https://mattermost.com/security-updates
- https://nvd.nist.gov/vuln/detail/CVE-2025-9081
- https://github.com/advisories/GHSA-f72g-52v7-mg3p
- https://github.com/mattermost/mattermost-plugin-boards/commit/3f3e3becfe1d66db0d0f4fd235f04afd6e1ec40b
- https://github.com/mattermost/mattermost-plugin-boards/pull/114
- https://github.com/mattermost/mattermost-plugin-boards
- https://pkg.go.dev/vuln/GO-2025-3978