Mattermost versions 11.6.0 and earlier, 11.5.3 and earlier, 11.4.4 and earlier, and 10.11.14 and earlier fail to enforce file ownership checks when processing Boards API requests. An authenticated user who supplies a valid file identifier can download files that belong to other users or teams, exposing confidential data beyond the intended scope of that user. The weakness is a lack of proper access control and is cataloged as CWE‑639.

The vulnerability affects Mattermost Mattermost deployments running any of the following versions: 10.11.x up to 10.11.14, 11.4.x up to 11.4.4, 11.5.x up to 11.5.3, and 11.6.x up to 11.6.0.

The CVSS score of 5.9 indicates a moderate severity. No EPSS data is available, so the real-world likelihood of exploitation is uncertain, and the vulnerability is not listed in the CISA KEV catalog. An attacker must first authenticate to the system and then craft a Boards API request using a valid file ID to access the victim’s files. The attack surface is limited to users that have legitimate API access, but once authenticated, there is a risk of cross-user file exposure.