CVE-2026-10080: Boards plugin panics on WebSocket command with non-string field types
Mattermost versions 11.7.x <= 11.7.6, 10.11.x <= 10.11.21, 11.8.x <= 11.8.3 fails to validate WebSocket command field types which allows an authenticated user to crash the plugin process and deny service to all Boards users via a customfocalboardSUBSCRIBETEAM message with a non-string teamId.. Mattermost Advisory ID: MMSA-2026-00687
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Mattermostto a version that resolves this vulnerability.Fixed in 11.9.0Patch MMSA-2026-00687 - Upgrade
Upgrade
Mattermostto a version that resolves this vulnerability.Fixed in 11.7.7Patch MMSA-2026-00687 - Upgrade
Upgrade
Mattermostto a version that resolves this vulnerability.Fixed in 10.11.22Patch MMSA-2026-00687 - Upgrade
Upgrade
Mattermostto a version that resolves this vulnerability.Fixed in 11.8.4Patch MMSA-2026-00687
Event History
Frequently Asked Questions
What is the severity of CVE-2026-10080?
The severity of CVE-2026-10080 is medium with a score of 6.5.
How do I fix CVE-2026-10080?
To fix CVE-2026-10080, update the Mattermost Boards plugin to a version that addresses this vulnerability.
What impact does CVE-2026-10080 have on Mattermost users?
CVE-2026-10080 allows an authenticated user to crash the plugin process, denying service to all Boards users.
Which versions of Mattermost are affected by CVE-2026-10080?
Mattermost versions 11.7.x through 11.7.6, 10.11.x through 10.11.21, and 11.8.x through 11.8.3 are affected by CVE-2026-10080.
What is the nature of the attack vector for CVE-2026-10080?
The attack vector for CVE-2026-10080 involves sending a custom_focalboard_SUBSCRIBE_TEAM message with a non-string teamId to the server.