Mattermost CVE-2026-14344: Board Permission Check Skipped

Mattermost published a security advisory covering CVE-2026-14344, a permissions enforcement failure in Mattermost Boards. The bug: the board-creation permission check exists in the codebase but does not run on the creation path. Any authenticated user can create a board regardless of what the administrator has assigned to their role.

CVSS 4.3, medium severity. Not reported as exploited in the wild.

Four active release branches carry the flaw:

• 11.9.x through 11.9.0
• 11.8.x through 11.8.4
• 11.7.x through 11.7.7
• 10.11.x through 10.11.22

Upgrade to a patched release for your branch. The Mattermost security updates page lists the current fixed versions.

Who should care

Mattermost runs in incident response rooms, security operations centers, and regulated environments where board-creation restrictions are real policy, not a cosmetic setting. In a deployment where you have deliberately locked down who can create boards, this bypass removes that control for any logged-in user. Default-open instances where everyone can create boards anyway will notice nothing. Tightly-governed deployments have a real gap.

Priority

Not a fire drill. There is no public exploit, no known active exploitation, and no path to privilege escalation beyond the board-creation boundary. Patch it in your next maintenance window.

If you run both Mattermost and MISP, prioritize the MISP CLI authentication bypass patched today first. That one leaks credentials and bypasses ACLs at the CLI layer. The Mattermost issue is narrower.

For recent context on how authorization bypasses in collaboration tools can escalate: the ScreenConnect worm campaign tied to CVE-2026-84869 showed how fast a patched auth flaw still gets weaponized when deployments lag on updates.