A missing authorization check in Mattermost Plugins allows an account with editor permission to alter comments created by other board members. The flaw permits the modification of comment content, resulting in a breach of data integrity for all users who view those comments.

Mattermost Plugins up to and including versions 11.3, 11.0.3, 11.2.2 and 10.10.11.0 are affected. Any server that runs these plugin releases, or earlier unpatched builds, may be vulnerable. The issue resides solely in the Mattermost server plugin component.

The CVSS score of 4.3 indicates low‑to‑moderate severity, and the EPSS score below 1% suggests a low probability of exploitation. The vulnerability is not listed in the CISA KEV catalog. Exploitation requires that the attacker already possesses editor privileges, after which they can modify others’ comments but gain no additional privileges or remote code execution. Therefore the risk to confidentiality and availability is negligible, with the primary concern being integrity of comment data.