CVE-2026-9859: 
Mattermost Desktop App vulnerability analysis and mitigation

CVE-2026-9859 is an incorrect authorization vulnerability in Mattermost Server that allows an authenticated board editor to relink any board they can edit to an arbitrary channel via a crafted PATCH request. The flaw affects Mattermost versions 11.7.0–11.7.6, 10.11.0–10.11.21, and 11.8.0–11.8.3, and was disclosed on August 17, 2026 (Mattermost Advisory ID: MMSA-2026-00686). It carries a CVSS v3.1 base score of 6.5 (Medium) (GitHub Advisory, Mattermost Security).

The root cause is CWE-863 (Incorrect Authorization): Mattermost fails to enforce the PermissionManageBoardRoles permission check on the channelId field of the boards batch endpoint. An authenticated user with board editor privileges can send a crafted PATCH request to the batch endpoint, supplying an arbitrary channelId value for a channel they do not have access to. Because the permission check is absent for this specific field, the server accepts the modification and relinks the board to the target channel, exposing board content to all members of that channel (GitHub Advisory, Mattermost Security).

Successful exploitation allows an authenticated board editor to expose board data to users in an arbitrary channel they would not normally have permission to access, resulting in a high confidentiality impact. There is no integrity or availability impact — the attacker cannot modify board content or disrupt service through this vulnerability. The scope is limited to the Mattermost instance, but sensitive project or organizational data stored in boards could be disclosed to unintended recipients (GitHub Advisory).

No public proof-of-concept exploit code is known to exist, and there is no evidence of active in-the-wild exploitation as of the disclosure date. The EPSS score is approximately 0.253% (17th percentile), indicating a low near-term exploitation probability. The NVD SSVC assessment classifies exploitation as "none" and technical impact as "partial." The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog (GitHub Advisory, Mattermost Security).

1. Authentication: Log in to a vulnerable Mattermost instance (versions 11.7.0–11.7.6, 10.11.0–10.11.21, or 11.8.0–11.8.3) with an account that has board editor permissions on at least one board.
2. Identify target channel: Enumerate or guess the channelId of a channel the attacker does not have direct access to but wishes to expose board data to (e.g., a private channel containing sensitive users).
3. Craft malicious PATCH request: Construct a PATCH request to the Mattermost boards batch endpoint, including the channelId field set to the target channel's ID.
4. Submit request: Send the crafted PATCH request to the server. Because PermissionManageBoardRoles is not enforced on the channelId field, the server accepts the modification without validating channel access.
5. Board data exposed: The board is now linked to the target channel, and all members of that channel gain access to the board's content, achieving unauthorized data disclosure (GitHub Advisory).

• Network: Unusual PATCH requests to the Mattermost boards batch API endpoint (e.g., /api/v2/boards/batch or similar) originating from board editor accounts, particularly those modifying the channelId field to channels the user is not a member of.
• Logs: Mattermost server logs showing PATCH requests to the boards batch endpoint with channelId values that differ from the board's original channel or that reference channels the requesting user does not belong to.
• Application Behavior: Boards appearing in channels where they were not previously linked, especially private or restricted channels; unexpected access by channel members to board content they should not have visibility into.

Mattermost has released patched versions that enforce PermissionManageBoardRoles on the channelId field of the batch endpoint. Administrators should upgrade to one of the following fixed versions: 10.11.22 or later, 11.7.7 or later, or 11.8.4 or later (11.9.0 is also unaffected). As an interim workaround, restrict board editor permissions to trusted users only and monitor PATCH requests to the boards batch endpoint for anomalous channelId modifications (Mattermost Security, GitHub Advisory).

The vulnerability received routine coverage from automated CVE tracking services and vulnerability databases shortly after disclosure, with no notable researcher commentary or significant community discussion identified. Social media activity was limited to automated CVE announcement accounts (GitHub Advisory).