Listen to this Post
The vulnerability exists in the file download endpoint of the Mattermost Boards plugin. The affected versions fail to enforce proper authorization checks when an authenticated user requests to download a file attached to a board. Instead of validating if the user has explicit permission to access the specific board, the endpoint only checks that the user is logged in. This allows an attacker to perform UUID enumeration by guessing or discovering the unique identifiers of files from boards they do not have access to. By crafting a direct HTTP GET request to the vulnerable endpoint with a target file’s UUID, any authenticated user can bypass intended access controls and download sensitive files, leading to unauthorized information disclosure.
Platform: Mattermost Boards
Version: <=10.5.8, <=9.11.17
Vulnerability: Improper Access Control
Severity: Low
date: 2025-09-19
Prediction: Patch available
What Undercode Say:
curl -H "Authorization: Bearer $USER_TOKEN" https://mattermost-server/api/v4/boards/files/TARGET_UUID/download
// Simplified vulnerable code logic
func downloadFile(uuid string, userID string) error {
// Missing check: if user has access to the board containing this file
fileData := getFileByUUID(uuid)
return sendFileToUser(fileData)
}
How Exploit:
Authenticated users guess file UUIDs and directly request the download endpoint to bypass board-level permissions.
Protection from this CVE:
Update to patched versions. Implement authorization checks on file download endpoints.
Impact:
Unauthorized disclosure of sensitive files attached to restricted boards.
🎯Let’s Practice Exploiting & Learn Patching For Free:
Sources:
Reported By: github.com
Extra Source Hub:
Undercode
