Mattermost fails to validate the field types of incoming WebSocket commands. An authenticated user can send a custom_focalboard_SUBSCRIBE_TEAM message with a non-string teamId, which causes the boards plugin to panic and crash. The crash terminates the plugin process, denying all Boards users access to the service while the plugin remains inactive. This flaw is a type‑validation weakness (CWE-704).

The issue exists in Mattermost release lines 10.11.x (up to 10.11.21), 11.7.x (up to 11.7.6), and 11.8.x (up to 11.8.3). All affected instances of the Boards plugin are vulnerable unless updated to 11.9.0, 11.7.7, 10.11.22, 11.8.4 or newer.

The CVSS base score of 6.5 indicates moderate severity. No EPSS score is publicly available, and the vulnerability does not appear in CISA’s KEV catalog. Exploitation requires authentication and the ability to send a malicious WebSocket command to the Boards plugin. The attack vector is therefore local or authenticated within the Mattermost environment, but once authenticated it can disrupt the entire plugin for all users.