PT-2026-41653 · Mattermost · Mattermost

0X7Oda7123 · Published 2026-05-18 · Updated 2026-05-18 · CVE-2026-4286

Positive Technologies (AI Summary)

CVSS v3.1

4.3

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

Name of the Vulnerable Software and Affected Versions Mattermost versions 11.5.0 through 11.5.1 Mattermost versions 10.11.0 through 10.11.13

Description An issue exists where the system fails to verify if the team id is modified during playbook updates. This allows users possessing only the Manage Playbook Configurations permission to change the team associated with a playbook, thereby bypassing restrictions intended to manage members via the 'PUT' API endpoint.

Recommendations Update Mattermost versions 11.5.0 through 11.5.1 to a version later than 11.5.1. Update Mattermost versions 10.11.0 through 10.11.13 to a version later than 10.11.13.

Fix

DoS

Incorrect Authorization

Weakness Enumeration

CWE-863

Related Identifiers

CVE-2026-4286

GHSA-GVG4-JHMR-6J23

Affected Products

Mattermost

References · 8

• https://osv.dev/vulnerability/GHSA-gvg4-jhmr-6j23 · Vendor Advisory
• https://mattermost.com/security-updates · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-4286 · Security Note
• https://github.com/mattermost/mattermost · Note
• https://github.com/mattermost/mattermost-plugin-playbooks/commit/e1d6ec2c94e695fb74e0c0c11c0d45e028bb96f3 · Note
• https://t.me/CVEtracker/54113 · Telegram Post
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-4286 · Note
• https://twitter.com/CVEarity/status/2056409419441959097 · Twitter Post