CVE-2026-10080

The type confusion in the Boards plugin's WebSocket SUBSCRIBE_TEAM handler is straightforward: the teamId parameter isn't validated as a string before being processed, so non-string values crash the handler. That's the bug. What matters more is what that crash actually does. One malformed WebSocket message from any authenticated user—low-privilege member, bot account, contractor with stale credentials—kills the Boards plugin process entirely. Every user on that Mattermost instance loses Boards functionality until the plugin restarts. This isn't team-level impact; it's instance-wide DoS from a single user action. The 'authenticated user' prerequisite in the CVSS calculation misleads decision-makers. In enterprise deployments, 'any authenticated user' can mean thousands of people across dozens of teams. The access barrier is effectively meaningless when the blast radius is service-wide and the trigger requires no privilege escalation. A CVSS 6.5 score obscures operational reality: this takes down a primary feature for everyone, potentially destabilizing integrations that depend on Boards. Check your deployment: verify the Boards plugin version and whether your WebSocket handler code has type validation on all incoming parameters—not just teamId. Review whether the plugin runs in an isolated process or shares state with core Mattermost that could cascade failures. The fix should add explicit type checking at the WebSocket boundary, mirroring what REST endpoints in the same codebase already do. If your instance has many external collaborators or automated integrations, treat this as higher priority than the medium severity suggests—the exploit requires only valid credentials, not administrative access.

Reviewed through automated stages and approved by a human before publication.