What is GHSA-hf8w-x9h5-5gf9?

GHSA-hf8w-x9h5-5gf9 is a security advisory published by GitHub Security Advisories with Medium severity. Mattermost Boards Plugin fails to implement authorisation checks on comment block modifications

Which CVE IDs does GHSA-hf8w-x9h5-5gf9 cover?

GHSA-hf8w-x9h5-5gf9 covers the following CVE IDs: CVE-2026-2461. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-hf8w-x9h5-5gf9?

GHSA-hf8w-x9h5-5gf9 has a CVSS v3 base score of 4.3, published by GitHub Security Advisories.

Which products are affected by GHSA-hf8w-x9h5-5gf9?

GHSA-hf8w-x9h5-5gf9 affects 1 product, including: go/github.com/mattermost/mattermost-plugin-boards:\u003c 0.0.0-20260108044135-57c5be5b6ef5.

GHSA-hf8w-x9h5-5gf9MediumCVSS 4.3

Mattermost Boards Plugin fails to implement authorisation checks on comment block modifications

Vendor

GitHub Security Advisories

Published

March 16, 2026

Last Modified

March 19, 2026

🔗 CVE IDs covered (1)

CVE-2026-2461 →

📋 Description

Mattermost Plugins versions <=11.3 11.0.3 11.2.2 10.10.11.0 fail to implement authorisation checks on comment block modifications, which allows an authorised attacker with editor permission to modify comments created by other board members. Mattermost Advisory ID: MMSA-2025-00559

🎯 Affected products1

go/github.com/mattermost/mattermost-plugin-boards:< 0.0.0-20260108044135-57c5be5b6ef5

🔗 References (4)

https://nvd.nist.gov/vuln/detail/CVE-2026-2461
https://mattermost.com/security-updates
https://github.com/mattermost/mattermost-plugin-boards/commit/57c5be5b6ef59d02dd72e35094d1fae8ba6e9619
https://github.com/advisories/GHSA-hf8w-x9h5-5gf9