CVE-2025-9081 — Authorization Bypass Through User-Controlled Key in Mattermost Mattermost-plugin-boards

CWE-639 — Authorization Bypass Through User-Controlled Key5 documents4 sources
Severity
6.5MEDIUMNVD
CNA3.1
EPSS
0.0%
top 98.44%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
5
Github.com Mattermost Mattermost-plugin-boardsGithub.com Mattermost Mattermost-serverGithub.com Mattermost Mattermost Server V8+2 more
Timeline
PublishedSep 19
Latest updateSep 24

Description

Mattermost versions 10.5.x <= 10.5.8, 9.11.x <= 9.11.17 fail to properly validate access controls which allows any authenticated user to download sensitive files via board file download endpoint using UUID enumeration

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:NExploitability: 2.8 | Impact: 3.6

Affected Packages5 packages

▶Gogithub.com/mattermost_mattermost-plugin-boards< 0.0.0-20250716054606-3f3e3becfe1d
▶NVDmattermost/mattermost_server9.11.0 — 9.11.17+1
▶Gogithub.com/mattermost_mattermost-server10.5.0-rc1 — 10.5.9+3
▶Gogithub.com/mattermost_mattermost_server_v8< 8.0.0-20250721095935-11c36f4d1e44
▶CVEListV5mattermost/mattermost10.5.0 — 10.5.8+1

🔴Vulnerability Details

4
OSV
Mattermost boards plugin fails to restrict download access to files in github.com/mattermost/mattermost-plugin-boards↗2025-09-24
▶
CVEList
IDOR in board file download allows any user to download any file by UUID↗2025-09-19
▶
OSV
Mattermost boards plugin fails to restrict download access to files↗2025-09-19
▶
GHSA
Mattermost boards plugin fails to restrict download access to files↗2025-09-19
▶
CVE-2025-9081 — MEDIUM severity | cvebase