Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.

CVE-2023-3586: Disabling publicly-shared boards does not disable existing publicly available board links

CVE-2023-3586 · published 3 years ago

Summary

Mattermost fails to disable public Boards after the "Enable Publicly-Shared Boards" configuration option is disabled, resulting in previously-shared public Boards to remain accessible.

What to do

The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.

Affected software

Vendor	Product	Affected versions
mattermost	mattermost_server	>= 7.8.0, < 7.8.7 >= 7.9.0, < 7.9.5 >= 7.10.0, < 7.10.3 `cpe:2.3:a:mattermost:mattermost_server::::::::`

Original advisory text

Disabling publicly-shared boards does not disable existing publicly available board links

Mattermost fails to disable public Boards after the "Enable Publicly-Shared Boards" configuration option is disabled, resulting in previously-shared public Boards to remain accessible.

References

https://mattermost.com/security-updates URL
https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/3xxx/CVE-2023-3586.j... Vendor Advisory
https://nvd.nist.gov/vuln/detail/CVE-2023-3586 Vendor Advisory

Fix within

Internet-facing 60 days

Internal At next upgrade

Not known to be exploited
Needs hands-on effort to exploit
Gives an attacker partial control

Severity

4.2 Medium

Exploitation

<1% chance of attack within 30 days

Type

CWE-863Incorrect Authorization

Timeline

Published17 Jul 2023

Updated3 Nov 2026

First seen29 Sep 2026

Sources

CVE-2023-3586 · NVD

CVE-2023-3586 · OSV

Track software like this

Free during beta