PT-2026-25810 · Mattermost · Mattermost+1

0X7Oda7123 · Published 2026-02-13 · Updated 2026-03-27 · CVE-2026-26304

Positive Technologies (AI Summary)

CVSS v3.1

4.3

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

Name of the Vulnerable Software and Affected Versions Mattermost versions 11.2.0 through 11.2.2 Mattermost versions 11.3.0

Description The software does not properly verify the run create permission when a playbookId is empty. This allows team members to create unauthorized runs through the playbook run API. The vulnerable component is located in github.com/mattermost/mattermost-plugin-playbooks. The API endpoint used for exploitation is the playbook run API. The vulnerable parameter is playbookId.

Recommendations Update Mattermost to a version later than 11.2.2. Update Mattermost to a version later than 11.3.0.

Fix

Improper Access Control

Incorrect Authorization

Weakness Enumeration

CWE-284

CWE-863

Related Identifiers

BDU:2026-06557

CVE-2026-26304

GHSA-4PMX-622H-X359

GO-2026-4812

SUSE-SU-2026:1135-1

Affected Products

Mattermost

Mattermost Playbooks Plugin

References · 150

• https://mattermost.com/security-updates · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2026-26304 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-4pmx-622h-x359 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-26304 · Security Note
• https://osv.dev/vulnerability/SUSE-SU-2026:1135-1 · Vendor Advisory
• https://bdu.fstec.ru/vul/2026-06557 · Security Note
• https://osv.dev/vulnerability/GO-2026-4812 · Vendor Advisory
• https://github.com/mattermost/mattermost-plugin-playbooks · Note
• https://github.com/mattermost/mattermost-plugin-playbooks/commit/705f54a818410f3612df3865bfde608ed471037e · Note
• https://suse.com/security/cve/CVE-2026-33670 · Note
• https://suse.com/security/cve/CVE-2026-33494 · Note
• https://suse.com/security/cve/CVE-2026-33215 · Note
• https://suse.com/security/cve/CVE-2026-29785 · Note
• https://suse.com/security/cve/CVE-2026-2456 · Note
• https://suse.com/security/cve/CVE-2026-32691 · Note