CVE-2025-13870: 
vulnerability analysis and mitigation

CVE-2025-13870 is a permission validation vulnerability in Mattermost Boards that allows authenticated users to bypass access controls and access files or subscribe to blocks in boards they are not authorized to view. It affects Mattermost Server versions 10.11.0–10.11.4 and 10.5.0–10.5.12. The vulnerability was published on December 2, 2025, with patches released the same day. It carries a CVSS v3.1 base score of 3.1–4.3 (Low/Medium, depending on scoring authority), with the GitHub Advisory Database assigning 3.1 (Low) (GitHub Advisory, Mattermost Security).

The root cause is improper access control (CWE-284) and missing authentication for critical functions (CWE-306) in the Boards feature of Mattermost Server. Specifically, the application fails to validate user permissions when processing requests to access board files or subscribe to board blocks, allowing any authenticated low-privilege user to supply identifiers for boards they do not have access to and retrieve associated files or register block subscriptions. Exploitation requires network access and a valid authenticated session, but no elevated privileges or user interaction are needed (GitHub Advisory).

Successful exploitation allows an authenticated attacker with low-level privileges to access confidential files from boards they are not authorized to view and subscribe to blocks in unauthorized board contexts, resulting in a low confidentiality impact. There is no integrity or availability impact. The vulnerability is scoped to the Mattermost Boards feature and does not directly enable lateral movement or remote code execution, but unauthorized access to board files could expose sensitive organizational data shared within those boards (GitHub Advisory, Mattermost Security).

There is no public proof-of-concept exploit and no evidence of in-the-wild exploitation at this time (GitHub Advisory). The EPSS score is approximately 0.025–0.029%, placing it in the 9th percentile for exploitation likelihood within 30 days. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. No threat actor attribution has been reported.

1. Authentication: Log in to a vulnerable Mattermost instance (versions 10.11.0–10.11.4 or 10.5.0–10.5.12) with any valid low-privilege user account.
2. Enumerate board identifiers: Identify or enumerate board and block identifiers for boards the attacker does not have legitimate access to (e.g., via API enumeration or guessing sequential/predictable IDs).
3. Access unauthorized board files: Send an authenticated API request to the Boards file access endpoint, supplying the target board's file or block identifier. Due to missing permission validation, the server returns the requested file without verifying board membership.
4. Subscribe to unauthorized blocks: Send an authenticated API request to subscribe to a block in the target board. The server processes the subscription without validating that the user has access to the board, granting the attacker notifications or data updates from that block (GitHub Advisory).

• Network: Unusual authenticated API requests to Mattermost Boards file access or block subscription endpoints from users who are not members of the targeted boards.
• Logs: Mattermost server logs showing board file access or block subscription API calls by users with no board membership for the referenced board IDs; repeated access attempts to board resource identifiers not associated with the requesting user's board memberships.
• Behavioral: A single user account accessing files or subscribing to blocks across a large number of boards, especially boards outside their team or channel membership.

Mattermost has released patched versions 10.11.5 and 10.5.13 that address this vulnerability. Organizations should upgrade to one of these versions immediately. As interim measures, administrators should audit recent board file access and block subscription activity, review and tighten board access control configurations, and monitor for unauthorized access attempts. No configuration-based workaround is documented as a substitute for patching (GitHub Advisory, Mattermost Security).