The vulnerability originates in the Mattermost Boards plugin, where the plugin’s batch endpoint fails to enforce the PermissionManageBoardRoles privilege on the channelId parameter. As a result, any authenticated board editor can send a crafted PATCH request to link a board they are allowed to edit to any channel of their choice. This flaw allows a board editor to expose board contents to unintended audiences, effectively bypassing intended access controls and potentially leaking sensitive information that should be restricted within the original channel scope. The weakness is classified as a permissions logic error (CWE‑863).

Affected versions of the Mattermost product include 11.7.x through 11.7.6, 10.11.x through 10.11.21, and 11.8.x through 11.8.3. The advisory applies to the core Mattermost application and its Boards plugin, as documented by the Mattermost CNA.

The CVSS score of 6.5 marks this as a moderate severity flaw. EPSS data is not available, and the vulnerability is not listed in the CISA KEV catalog. Exploitation requires an authenticated user with board editor rights, so the attack vector is internal or delegated through compromised credentials. A malicious editor can leverage a crafted PATCH request to the batch endpoint to re‑link a board to any channel, thereby exposing confidential board data to unauthorized viewers. The exploit is straightforward for anyone possessing necessary permissions, but it does not allow arbitrary remote code execution or system compromise.