Skip to content

Create FIPS complaint boards plugin - #120

Open
stafot wants to merge 26 commits into
mainfrom
CLD-9417-build-boards-fips-compliant
Open

Create FIPS complaint boards plugin#120
stafot wants to merge 26 commits into
mainfrom
CLD-9417-build-boards-fips-compliant

Merge tag 'v9.2.5' into CLD-9417-build-boards-fips-compliant

f4fc5d6
Select commit
Loading
Failed to load commit list.
DryRunSecurity / General Security Analyzer succeeded May 21, 2026 in 1m 26s

DryRun Security

Details

General Security Analyzer Findings: 1 detected

⚠️ Potential Authorization Bypass in Board Member management server/api/members.go (click for details)
Type Potential Authorization Bypass in Board Member management
Description The modified permission check allows users with PermissionManageBoardProperties to add members to Open boards. However, within the handleAddMember function, the new member's role (Admin/Editor/Viewer) is directly taken from the request payload. The function lacks a check to ensure that the user adding the new member has PermissionManageBoardRoles before granting them administrative privileges, or that the assigned roles do not exceed the privileges the adder is permitted to grant. As such, a user who is only supposed to have ManageBoardProperties for an Open board can, via this API, grant themselves or others Admin roles.
Filename server/api/members.go
CodeLink

mattermost-plugin-boards/server/api/members.go

Lines 149 to 155 in f4fc5d6

}
if !a.permissions.HasPermissionToBoard(userID, boardID, model.PermissionManageBoardRoles) &&
(board.Type != model.BoardTypeOpen || !a.permissions.HasPermissionToBoard(userID, boardID, model.PermissionManageBoardProperties)) {
a.errorResponse(w, r, model.NewErrPermission("access denied to modify board members"))
return
}
View more details on DryRunSecurity