CVE-2021-37866: Mattermost Boards

High severity, CVSS 7.5. EPSS: 0.7% chance of exploitation in the next 30 days.

Mattermost Boards plugin v0.10.0 and earlier fails to invalidate a session on the server-side when a user logged out of Boards, which allows an attacker to reuse old session token for authorization.

Affected products

• Mattermost Mattermost Boards: up to and including 0.10.0

Published 2022-01-18. Last modified 2026-06-17.