CVE-2026-14259

Executive Summary

CVE-2026-14259 is an improper authorization vulnerability (CWE-862, Missing Authorization) in Mattermost Boards. Affected releases fail to enforce board creation permissions when a user imports a .boardarchive file, allowing an authenticated, non-guest team member to create Open or Private boards even when an administrator has restricted board creation. The vulnerability carries a CVSS v3.1 base score of 4.3 (Medium) and affects Mattermost 11.9.x, 11.8.x, 11.7.x, and 10.11.x branches. No public proof-of-concept, exploit code, or Nuclei template exists, and EPSS is 0.00152 (4.7th percentile), indicating no observed exploitation in the wild.

Technical Analysis

CVE-2026-14259 is a missing authorization check in the board-import workflow of Mattermost Boards. The CWE classification, CWE-862 (Missing Authorization), describes the root cause precisely: an operation that should be gated by a permission check is executed without validating that the acting user holds the required privilege. In this case, the operation is board creation, and the permission that is not enforced is the administrator-configured restriction on who may create Open or Private boards.

Mattermost allows teams to migrate board content between instances using archive files with the .boardarchive extension. When such a file is imported, the server-side import routine reconstructs the board(s) contained in the archive — including their visibility type (Open or Private). The CVSS vector indicates network reachability (AV:N), low attack complexity (AC:L), low privileges required (PR:L), and no user interaction (UI:N), meaning an already-authenticated user with the lowest non-guest team membership can trigger the flaw directly. The scope is unchanged (S:U), confidentiality impact is none (C:N), and the sole impact is a low integrity violation (I:L), consistent with a rule-bypass that permits unauthorized object creation without exposing or altering existing data.

The affected versions enumerated in the NVD description are: 11.9.x up through 11.9.0, 11.8.x up through 11.8.4, 11.7.x up through 11.7.7, and 10.11.x up through 10.11.22. The vendor's global issue identifier is MMSA-2026-00712. No code-level implementation details — such as the specific handler, class, or API route involved in the import path — are disclosed in the available intelligence, and none are asserted here. The attack surface is the authenticated board-import functionality of a Mattermost deployment with Boards enabled.

Exploitation Scenarios

No public proof-of-concept is available (POC_STATUS: None); the following chain is inferred strictly from the vulnerability class (CWE-862) and the behavior described in the NVD text. It deliberately avoids asserting any function name, endpoint, or parameter that is not present in the source description.

1. Reconnaissance / target identification. An adversary identifies a Mattermost deployment running an affected version (11.9.0 or earlier within the 11.9.x line, 11.8.4 or earlier, 11.7.7 or earlier, or 10.11.22 or earlier). The attacker requires valid credentials for a non-guest team member account — the lowest tier of authenticated access within a team. Shodan/recon dorks targeting http.title:"Mattermost" can identify candidate instances, but the attacker still needs authenticated access, typically obtained through credential stuffing, phishing, or a purchased/reused employee account.

2. Triggering the flaw class. The administrator has configured a restriction limiting which users may create Open or Private boards. The attacker navigates to the board-import feature and submits a crafted .boardarchive file. Because the import routine fails to enforce the board-creation permission check (CWE-862), the archive's contents — including the board visibility setting (Open or Private) — are reconstructed as new boards, overriding the administrative restriction.

3. Payload/execution method (class level). The payload is a .boardarchive archive crafted to declare a board of type Open or Private. No specific package structure, manifest field, or API parameter is disclosed in the source data; only the archive file type (.boardarchive) and the resulting board visibility (Open/Private) are asserted. The mechanism is therefore an authorization-bypass by input type: the attacker supplies a legitimate file format through a legitimate import feature, and the flaw is the absence of the permission check on that specific code path.

4. Post-exploitation impact. Successful exploitation yields an unauthorized board object. An attacker who can create a Private board can establish a collaboration space within the target Mattermost instance that is not visible to the broader team but is owned/controlled by them, which can become a staging area for data staging, coordination, or social-engineering of other members. An Open board created in violation of policy erodes the administrator's content-governance posture. The CVSS I:L rating reflects that the sole confirmed effect is the creation of objects the operator intended to forbid; confidentiality and availability are scored as unaffected.

Impact Assessment

The business impact of CVE-2026-14259 is a governance and policy-enforcement failure rather than a direct confidentiality or availability breach. The CVSS v3.1 subscores — AV:N (network), AC:L (low complexity), PR:L (low privileges), UI:N (no user interaction), S:U (unchanged), C:N (none), I:L (low), A:N (none) — sum to a 4.3 base score, placing it in the Medium band. The meaning of each subscore in context: any authenticated non-guest team member on an affected instance can attempt the attack without special network position or user-assisted steps; the attacker gains only the ability to create board objects they were forbidden from creating.

Blast radius is bounded by the number of affected Mattermost instances with Boards enabled and a board-creation restriction configured. Organizations that never restricted board creation are not disadvantaged by the flaw (the attacker's action would be permitted anyway). Organizations that did restrict board creation — the exact scenario in the CNA description — lose the enforcement of that control for the duration of exposure, which may violate internal information-governance or data-handling policy. Because confidentiality is unaffected, there is no direct data-exfiltration impact scored; however, a newly created Private board is an unmonitored channel that could later be used for malicious coordination, which is a downstream risk not captured by the CVSS vector. No CISA KEV listing, no threat-actor campaign, and no exploit-in-the-wild evidence is associated with this CVE.

Detection Guidance

Detection for this CVE is best approached at the application-audit and file-import layers, since the network request pattern is a legitimate authenticated API interaction rather than a classically malformed payload.

Sigma Rule

title: Mattermost Board Creation via .boardarchive Import Despite Restriction
id: 8f2c1a94-3b7e-4d16-b0a2-1c44e7d9a672
status: experimental
description: Detects Mattermost board imports of .boardarchive files that result in Open or Private board creation, indicating probable CVE-2026-14259 improper authorization bypass.
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-14259
  - Mattermost Advisory ID MMSA-2026-00712
author: threat-intel@valtersit.com
date: 2026/01/01
tags:
  - attack.t1190
  - cwe.862
logsource:
  product: mattermost
  service: audit
detection:
  selection_action:
    event_type:
      - 'board_created'
      - 'import_archive'
      - 'import_board_archive'
  selection_artifact:
    file_extension: '.boardarchive'
    board_type:
      - 'O'
      - 'P'
  condition: selection_action or (selection_action and selection_artifact)
falsepositives:
  - Legitimate administrators importing board archives
  - Automated board migration tooling
level: medium

YARA Rule

rule CVE_2026_14259_Mattermost_BoardArchive_Import
{
    meta:
        author = "threat-intel@valtersit.com"
        description = "Detects .boardarchive files that may be used to bypass board-creation restrictions in Mattermost (CVE-2026-14259)"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-14259"
        cve = "CVE-2026-14259"
        date = "2026-01-01"

    strings:
        $ext = ".boardarchive" ascii nocase
        $boardTypeOpen = "\"type\":\"O\"" ascii
        $boardTypePrivate = "\"type\":\"P\"" ascii
        $boardWord = "board" ascii nocase

    condition:
        $ext or
        ($boardTypeOpen and $boardWord) or
        ($boardTypePrivate and $boardWord)
}

Suricata IDS Rule

alert http any any -> any any ( \
  msg:"CVE-2026-14259 Mattermost .boardarchive Board Import Bypass Attempt"; \
  flow:established,to_server; \
  http.method; content:"POST"; \
  http.uri; content:"boardarchive"; nocase; \
  http.header; content:"Content-Type"; nocase; \
  http.header; content:"multipart/form-data"; nocase; \
  classtype:attempted-user; \
  sid:202614259; rev:1; \
  reference:cve,CVE-2026-14259; \
  reference:url,nvd.nist.gov/vuln/detail/CVE-2026-14259; \
  metadata:service http, policy balanced-ips drop, policy security-ips drop;)

Elastic Detection

sequence by user.name with maxspan=5m
  [ process where event.action == "start" and process.name : ("*import*", "*board*") ]
  [ network where network.protocol == "http" and
      (url.path : "*boardarchive*" or http.request.body.content : "*.boardarchive*") and
      event.outcome == "success" ]

Splunk SPL Query

index=mattermost sourcetype=mattermost:audit
("board_created" OR "import_archive" OR "board_import" OR "import_board")
| eval is_archive = if(match(lower(_raw), "\.boardarchive"), 1, 0)
| eval board_type = case(match(_raw, "\"type\":\s*\"O\""), "Open",
                         match(_raw, "\"type\":\s*\"P\""), "Private",
                         true(), "Unknown")
| where board_type IN ("Open","Private")
| stats count min(_time) as first_seen max(_time) as last_seen
        values(user) as users values(board_type) as board_types
        by host
| where count > 0
| convert ctime(first_seen) ctime(last_seen)

Wazuh OSSEC Rule

<group name="mattermost,cve-2026-14259,">
  <rule id="202614259" level="8">
    <decoded_as>json</decoded_as>
    <field name="event_type">\.?(board_created|import_archive|board_import)</field>
    <description>CVE-2026-14259 - Potential Mattermost board-creation restriction bypass via .boardarchive import</description>
    <mitre>
      <id>T1190</id>
    </mitre>
    <group>cwe_862,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 (UNPATCHED — no patch evidence from any tracked source). No vendor fix version, workaround, or fixed release is currently referenced in the intelligence set. The Mattermost advisory identifier (MMSA-2026-00712) is the correct tracking reference for a future fix.

1. Immediate mitigations. (a) Restrict or temporarily disable the board-import capability for non-administrator roles until a fix is available. (b) Audit existing board inventories for Open or Private boards created via .boardarchive import that violate current policy, and remove or quarantine them. (c) Treat board-creation restrictions as non-enforced for risk-acceptance purposes and document the compensating control. (d) Monitor the Mattermost advisory page for MMSA-2026-00712 for a patched release.

2. Patch/upgrade steps. No fixed version is published in the supplied data. Once Mattermost publishes a release addressing MMSA-2026-00712, upgrade all affected branches (11.9.x, 11.8.x, 11.7.x, 10.11.x) to the first release containing the fix. Verify the deployed version post-upgrade and re-run the board-import test case with a restricted account to confirm enforcement.

3. Long-term hardening. (a) Implement server-side authorization checks at the object-creation boundary for all import paths, not only interactive creation, to prevent this class of bypass (CWE-862) recurring. (b) Enforce least privilege for team membership and regularly review non-guest accounts. (c) Enable detailed audit logging of board lifecycle events (creation, import, visibility change) and forward to the SIEM with the detections above. (d) Include import/migration code paths in threat modeling and regression tests for authorization controls.

References

1. NVD — CVE-2026-14259: https://nvd.nist.gov/vuln/detail/CVE-2026-14259
2. Mattermost Security Advisories (MMSA-2026-00712): https://mattermost.com/security-updates/
3. CWE-862 — Missing Authorization: https://cwe.mitre.org/data/definitions/862.html
4. MITRE ATT&CK T1190 — Exploit Public-Facing Application: https://attack.mitre.org/techniques/T1190/
5. CISA Known Exploited Vulnerabilities Catalog (not listed as of report date): https://www.cisa.gov/known-exploited-vulnerabilities-catalog

No threat-actor campaigns or exploit-in-the-wild evidence are associated with CVE-2026-14259 in the available intelligence. EPSS is 0.00152 (approximately the 4.7th percentile of all tracked CVEs), and no CISA KEV entry exists.