Mattermost Boards Board-Creation Permission Not Enforced
Mattermost through 11.9.0 fails to enforce board-creation permissions, letting any authenticated user create boards regardless of their role.
- Vendor
- Mattermost
- Product
- Mattermost (Boards)
- CVSS
- 4.3
- EPSS (exploit probability)
- 0.3%
- Status
- patched
- Published
Is CVE-2026-14344 being exploited?
Not on any exploited-vulnerability catalog we track. CVE-2026-14344 was not on the CISA, ENISA or CIRCL exploited catalogs as of our 2026-11-05 snapshot. That can change quickly; check the write-up below for the latest reporting.
FIRST's EPSS model puts the probability of exploitation activity in the next 30 days at 0.3% (scored October 25, 2026).
- CISA KEV[ — ]
- ENISA EUVD (exploited)[ — ]
- CIRCL KEV[ — ]
Catalog snapshot 2026-11-05. Full cross-catalog view: /kev-comparison
CVE-2026-14344 timeline
Every event links to its source. Catalog dates are each catalog's own; day offsets count from NVD publication. Data: JSON
CVE-2026-14344 is a permissions enforcement failure in Mattermost Boards. The board-creation RBAC check is not applied on affected versions, so any authenticated user can create a board regardless of the role-based permissions configured by an administrator.
Affected versions: Mattermost 11.9.x through 11.9.0, 11.8.x through 11.8.4, 11.7.x through 11.7.7, and 10.11.x through 10.11.22.
Fix: Upgrade to a patched release for your branch. See the Mattermost security updates page for the current patched versions.
Interim mitigation: No bypass of the RBAC control is possible once patched. If immediate patching is not feasible, restrict Mattermost server network access to minimize exposure from unanticipated users.
