CVE-2026-14344

Executive Summary

CVE-2026-14344 is an authorization enforcement flaw (CWE-862, Missing Authorization) in Mattermost that allows any authenticated user to create boards despite lacking the required board-creation permission. Affected deployments include Mattermost 10.11.x through 10.11.22, 11.7.x through 11.7.7, 11.8.x through 11.8.4, and 11.9.0, with the flaw reachable through the board duplicate, boards-and-blocks, and archive-import endpoints. The impact is limited to integrity (CVSS 4.3, I:L) — unauthorized board creation and content injection — with no confidentiality or availability impact, and no public exploit or Nuclei template currently exists.

Technical Analysis

CVE-2026-14344 is a Missing Authorization (CWE-862) vulnerability in Mattermost Boards. The NVD description states that the listed Mattermost versions "fail to enforce the board-creation permission which allows an unauthorized authenticated user to create boards via the board duplicate, boards-and-blocks, and archive-import endpoints."

The core mechanism is a discrepancy between the permission model and the enforcement applied at three specific functional entry points:

1. Board-creation permission is not enforced. The application defines a board-creation permission but does not check it on the affected endpoints. This is the classic CWE-862 pattern: a protected resource (creating a board) is reachable by an authenticated principal that lacks the required authorization grant, because the authorization check is absent rather than incorrect.

2. Three endpoints bypass the check. Per the description, the bypass surfaces are:

   • the board duplicate endpoint (which produces a new board by copying an existing one),
   • the boards-and-blocks endpoint (which persists board structure and content blocks), and
   • the archive-import endpoint (which restores/imports board content). Each of these operations results in a net-new board, yet none of them gates on the board-creation permission.

3. Authentication is required but not sufficient. The privilege level is PR:L (Low) and the vector is AV:N/AC:L/PR:L/UI:N/S:U. This means the attacker must be an authenticated user but requires no UI interaction and the attack is network-reachable. An authenticated user with low privileges — e.g., a guest or member without board-creation rights — can trigger the flaw.

Because the constraint is one of permission enforcement rather than memory safety or injection, the attack surface is not the parsing of user input but the authorization decision made (or absent) before the endpoint's business logic executes. Exploitation does not require crafted malformed data; it requires issuing legitimate-looking requests to the three named endpoints.

Insufficient technical detail available regarding any specific internal function, handler name, or API parameter beyond the three endpoint descriptors quoted in the NVD description. No source-level patch, commit diff, or advisory technical write-up is currently available (Patch Confidence 0/4). The analysis above is therefore scoped to the vulnerability class (Missing Authorization) and the endpoints explicitly named by the CNA.

Exploitation Scenarios

No public PoC is available; the attack chain below is inferred from the vulnerability class (CWE-862, Missing Authorization) and the endpoint names provided in the NVD description. No specific function names, parameter names, or API paths beyond those quoted are asserted.

1. Reconnaissance / target identification. The attacker identifies an internet- or intranet-exposed Mattermost instance running an affected version. Version fingerprinting can be performed passively (login page banners, API version responses, favicon hash) using any of the Shodan dorks listed in the metadata section. The attacker must hold a valid low-privileged account on the target instance; no valid board-creation permission is required.

2. Triggering the specific flaw class. Authorization is the sole control being bypassed. The attacker, using their authenticated low-privileged session, directs requests at one of the three endpoints named in the advisory:

   • the board duplicate endpoint,
   • the boards-and-blocks endpoint, or
   • the archive-import endpoint. Because the board-creation permission is not enforced on these paths, the request succeeds where it should be rejected with an authorization error. The trigger is not a payload in the traditional sense — it is a legitimate request issued by a principal that lacks the required permission.

3. Payload / execution method at the vulnerability-class level. The "payload" is normal board content: a duplicated board, a set of board blocks, or an archive import bundle. No code execution, deserialization, or injection primitive is described, so no RCE payload is implied. The attacker simply supplies the content that will become the new board, and the endpoint's missing check permits persistence.

4. Post-exploitation impact. The attacker creates one or more boards they were not authorized to create. The resulting impact is integrity-only (CVSS I:L): unauthorized content exists in the collaboration workspace. Depending on workspace visibility, this can be used for content injection, information staging (writing attacker-controlled material into places other users read), resource exhaustion/dilution of workspace listings, or persistence as a foothold for social-engineering content. There is no described confidentiality impact (C:N) and no availability impact (A:N); the vulnerability does not, per the provided data, grant access to boards the attacker could not otherwise read. No public exploit code, no Nuclei template, and no CISA KEV listing exist for this CVE.

Impact Assessment

CVSS v3.1: 4.3 (Medium) — CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

• AV:N (Network): the affected endpoints are reachable over the network; no local access is required.
• AC:L (Low): no special conditions, race windows, or unusual configuration are described; the missing check is simply absent.
• PR:L (Low): the attacker needs a valid authenticated account but only low privileges — specifically, an account without board-creation rights.
• UI:N (None): no victim interaction is required.
• S:U (Unchanged): impact remains within the Mattermost application security authority.
• C:N / I:L / A:N: no confidentiality or availability impact; limited integrity impact only.

Business impact. The primary consequences are: (a) policy and permission-model erosion — the workspace's governance controls (who may create boards) are silently violated; (b) content injection into a collaborative workspace where other users may treat board content as trusted; and (c) audit and compliance drift, since unauthorized board creation may evade role-based governance expectations. Because EPSS is 0.00152 (4.7th percentile), mass exploitation is unlikely, but the exploitability of a missing-authorization flaw is high once an authenticated foothold exists.

Blast radius. Any affected Mattermost deployment — self-hosted or managed — running one of the affected version ranges: 10.11.x <= 10.11.22, 11.7.x <= 11.7.7, 11.8.x <= 11.8.4, and 11.9.0. The blast radius is bounded by the number of low-privileged authenticated users on the instance; each such user is effectively a potential exploit principal. There is no evidence in the provided data of lateral movement or privilege escalation beyond unauthorized board creation.

Detection Guidance

Detection is challenging because the malicious requests are well-formed, authenticated, and resemble legitimate board operations. Effective detection correlates the board-creation event with the absence of the board-creation permission in the actor's role, across the three named endpoints (board duplicate, boards-and-blocks, archive-import).

Sigma Rule

title: Mattermost Unauthorized Board Creation via Duplicate/Import Endpoints
id: 7b6f3a2e-9c14-4a8f-b2d1-0e14344cve26
status: experimental
description: Detects creation of Mattermost boards by authenticated users lacking the board-creation permission, via the board duplicate, boards-and-blocks, or archive-import endpoints (CVE-2026-14344).
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-14344
author: Valters IT Threat Intelligence
date: 2026/01/01
tags:
  - attack.t1190
  - cve.2026-14344
logsource:
  product: mattermost
  category: application
detection:
  selection_endpoint:
    request_url|contains:
      - '/boards/'
      - '/boards-and-blocks'
      - '/archive'
      - 'duplicate'
  selection_operation:
    event_action:
      - 'board_created'
      - 'board_duplicated'
      - 'import_completed'
  selection_permission:
    actor_has_board_create_permission: 'false'
  condition: selection_endpoint and selection_operation and selection_permission
falsepositives:
  - Legitimate administrators with board-creation rights performing bulk imports
  - Duplicate blocked requests generating authorization-failure noise
level: medium

YARA Rule

rule CVE_2026_14344_Mattermost_Board_Authz_Bypass
{
    meta:
        description = "Detects Mattermost board creation via duplicate / boards-and-blocks / archive-import endpoints associated with CVE-2026-14344 authorization bypass"
        author      = "Valters IT Threat Intelligence"
        reference   = "https://nvd.nist.gov/vuln/detail/CVE-2026-14344"
        date        = "2026-01-01"
        cve         = "CVE-2026-14344"

    strings:
        $ep_dup    = "board duplicate" nocase
        $ep_blk    = "boards-and-blocks" nocase
        $ep_imp    = "archive-import" nocase
        $mm_advisory = "MMSA-2026-00715" nocase
        $a1        = "/api/v4/boards" nocase ascii wide
        $a2        = "duplicate" nocase ascii wide

    condition:
        (uint16(0) == 0x5A4D or filesize < 10MB) and
        (
            any of ($ep_*) or
            $mm_advisory or
            (all of ($a1, $a2))
        )
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2026-14344 Mattermost Unauthorized Board Creation via Duplicate/Import Endpoint"; flow:established,to_server; http.method; content:"POST"; http.uri; content:"/boards"; http.uri; content:"duplicate"; nocase; sid:202614344; rev:1; reference:cve,2026-14344; reference:url,nvd.nist.gov/vuln/detail/CVE-2026-14344; classtype:attempted-user; metadata:service http;)

alert http any any -> any any (msg:"CVE-2026-14344 Mattermost Board Creation via boards-and-blocks Endpoint"; flow:established,to_server; http.method; content:"POST"; http.uri; content:"boards-and-blocks"; nocase; sid:202614345; rev:1; reference:cve,2026-14344; classtype:attempted-user; metadata:service http;)

alert http any any -> any any (msg:"CVE-2026-14344 Mattermost Board Import via archive-import Endpoint"; flow:established,to_server; http.method; content:"POST"; http.uri; content:"archive"; http.uri; content:"import"; nocase; sid:202614346; rev:1; reference:cve,2026-14344; classtype:attempted-user; metadata:service http;)

Elastic Detection

sequence by user.name with maxspan=2m
  [ authentication where event.outcome == "success" and user.name != null ]
  [ any where
      (url.path : "*duplicate*" or url.path : "*boards-and-blocks*" or url.path : "*archive*import*") and
      http.request.method : "POST" and
      event.action : ("board_created" or "board_duplicated" or "import_completed") ]

This EQL sequence keys on an authenticated user session immediately followed by a board-creating operation on one of the three named endpoints — a pattern consistent with CVE-2026-14344 exploitation where a low-privileged user invokes a board-creation path they are not authorized for. Analysts should enrich with user.roles to confirm the actor lacked board-creation rights.

Splunk SPL Query

index=mattermost sourcetype=mattermost:audit
(
  uri_path="*duplicate*" OR uri_path="*boards-and-blocks*" OR uri_path="*archive*import*"
)
http_method=POST
| eval board_create_perm=coalesce(actor_board_create_permission, roles_board_create, "unknown")
| where board_create_perm="false" OR board_create_perm="unknown" OR isnull(board_create_perm)
| stats count values(uri_path) as endpoints values(http_method) as methods
        earliest(_time) as first_seen latest(_time) as last_seen
        by actor_user_id actor_username src_ip
| where count >= 1
| table actor_username src_ip endpoints count first_seen last_seen
| sort - count

Adjust index/sourcetype and field names to your Mattermost audit log schema. The query surfaces authenticated actors performing POST operations against the three named endpoints without a board-creation permission grant.

Wazuh OSSEC Rule

<group name="mattermost,cve-2026-14344,web,">
  <rule id="2026143" level="0">
    <decoded_as>json</decoded_as>
    <field name="uri_path">duplicate|boards-and-blocks|archive</field>
    <description>Mattermost: board-related endpoint request observed</description>
  </rule>

  <rule id="2026144" level="8">
    <if_sid>2026143</if_sid>
    <field name="http_method">POST</field>
    <field name="actor_board_create_permission">false</field>
    <description>CVE-2026-14344: Mattermost authenticated user lacking board-creation permission invoked board creation endpoint — possible authorization bypass</description>
    <mitre>
      <id>T1190</id>
    </mitre>
    <group>cve_2026_14344,attempted_user,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 — UNPATCHED. No patch evidence was identified from any tracked source, no vendor fix version is published, and the affected-version list is provided only as the CNA's ranges. Treat deployment exposure as unpatched until Mattermost publishes a fixed release.

1. Immediate mitigations (compensating controls).

   • Restrict exposure. Do not expose the affected endpoints to untrusted networks. Place Mattermost behind an authenticated reverse proxy / VPN and apply network segmentation so only trusted users reach the application.
   • Constrain low-privileged accounts. Because the exploit requires only an authenticated low-privileged session (PR:L), audit and minimize the population of guest/low-rights accounts. Disable or deactivate dormant guest accounts.
   • WAF / reverse-proxy filtering. Block or alert on POST requests to the board duplicate, boards-and-blocks, and archive-import endpoints from users or roles that should not create boards, where the proxy can evaluate authorization context.
   • Monitor and log. Enable Mattermost audit logging and forward to the SIEM using the detection rules above to catch abuse of these endpoints.
   • Note: No official workaround is listed by the vendor per the provided data. The above are analyst-proposed compensating controls, not vendor-certified fixes.

2. Patch / upgrade steps.

   • Because Patch Confidence is 0/4, no specific fixed version can be recommended from the available data. Monitor the vendor advisory (MMSA-2026-00715) and the CVE-2026-14344 NVD entry for a vendor-published fix version.
   • When a fixed release is published, upgrade Mattermost immediately to the patched build within every affected branch (10.11.x > 10.11.22, 11.7.x > 11.7.7, 11.8.x > 11.8.4, and 11.9.0), following the standard Mattermost upgrade runbook and backing up the database and config.json beforehand.
   • Do not deploy from unofficial forks or third-party mirrors; consume the fix only from the vendor's official release channel.

3. Long-term hardening.

   • Enforce centralized, deny-by-default authorization on all state-changing endpoints, and add regression tests that assert the board-creation permission is checked on duplicate, boards-and-blocks, and archive-import paths.
   • Adopt an endpoint inventory and authorization matrix so new board-related endpoints cannot be added without corresponding permission checks.
   • Apply least privilege to all Mattermost roles and regularly recertify role assignments.
   • Integrate CVE and vendor-advisory monitoring (NVD, vendor advisories, OSV) into patch management so authorization-bypass disclosures are triaged quickly.
   • Maintain an authenticated-user threat model: assume any valid credential can attempt privileged operations and ensure the server — not the client — is the authority for authorization decisions.

References

1. NVD — CVE-2026-14344: https://nvd.nist.gov/vuln/detail/CVE-2026-14344
2. Mattermost Security Advisory MMSA-2026-00715 (vendor advisory ID referenced in the CVE description): https://mattermost.com/security-updates/
3. MITRE CWE-862 — Missing Authorization: https://cwe.mitre.org/data/definitions/862.html
4. MITRE ATT&CK T1190 — Exploit Public-Facing Application: https://attack.mitre.org/techniques/T1190/
5. CISA Known Exploited Vulnerabilities Catalog: https://www.cisa.gov/known-exploited-vulnerabilities-catalog — CVE-2026-14344 is NOT listed (CISA KEV: NO).

Threat actor / exploit-in-the-wild status: No public proof-of-concept, no Nuclei template, no exploit code, and no CISA KEV designation exist for CVE-2026-14344 at the time of writing. EPSS is 0.00152 (4.7th percentile), indicating low predicted exploitation activity. No threat actor campaign has been attributed to this CVE. All exploit-chain content in this report is inferred at the vulnerability-class level (CWE-862 Missing Authorization) and should be validated as vendor and researcher detail becomes available.