PT-2026-25810 · Mattermost · Mattermost+1

0X7Oda7123 · Publicado 2026-02-13 · Atualizado 2026-03-27 · CVE-2026-26304

Positive Technologies (AI Summary)

CVSS v3.1

4.3

Média

Vetor base

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

Name of the Vulnerable Software and Affected Versions Mattermost versions 11.2.0 through 11.2.2 Mattermost versions 11.3.0

Description The software does not properly verify the run create permission when a playbookId is empty. This allows team members to create unauthorized runs through the playbook run API. The vulnerable component is located in github.com/mattermost/mattermost-plugin-playbooks. The API endpoint used for exploitation is the playbook run API. The vulnerable parameter is playbookId.

Recommendations Update Mattermost to a version later than 11.2.2. Update Mattermost to a version later than 11.3.0.

Correção

Improper Access Control

Incorrect Authorization

Enumeração de Fraquezas

CWE-284

CWE-863

Identificadores relacionados

BDU:2026-06557

CVE-2026-26304

GHSA-4PMX-622H-X359

GO-2026-4812

SUSE-SU-2026:1135-1

Produtos afetados

Mattermost

Mattermost Playbooks Plugin

Referências · 150

• https://github.com/mattermost/mattermost-plugin-playbooks · Nota
• https://github.com/mattermost/mattermost-plugin-playbooks/commit/705f54a818410f3612df3865bfde608ed471037e · Nota
• https://suse.com/security/cve/CVE-2026-33670 · Nota
• https://suse.com/security/cve/CVE-2026-33494 · Nota
• https://suse.com/security/cve/CVE-2026-33215 · Nota
• https://suse.com/security/cve/CVE-2026-29785 · Nota
• https://suse.com/security/cve/CVE-2026-2456 · Nota
• https://suse.com/security/cve/CVE-2026-32691 · Nota
• https://suse.com/security/cve/CVE-2026-33191 · Nota
• https://suse.com/security/cve/CVE-2026-33505 · Nota
• https://suse.com/security/cve/CVE-2026-33221 · Nota
• https://mattermost.com/security-updates · Aviso do Fabricante
• https://suse.com/security/cve/CVE-2026-33320 · Nota
• https://suse.com/security/cve/CVE-2026-33062 · Nota
• https://suse.com/security/cve/CVE-2026-4342 · Nota