What is GHSA-4pmx-622h-x359?

GHSA-4pmx-622h-x359 is a security advisory published by GitHub Security Advisories with Medium severity. Mattermost fails to verify run_create permission for empty playbookId

Which CVE IDs does GHSA-4pmx-622h-x359 cover?

GHSA-4pmx-622h-x359 covers the following CVE IDs: CVE-2026-26304. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-4pmx-622h-x359?

GHSA-4pmx-622h-x359 has a CVSS v3 base score of 4.3, published by GitHub Security Advisories.

Which products are affected by GHSA-4pmx-622h-x359?

GHSA-4pmx-622h-x359 affects 1 product, including: go/github.com/mattermost/mattermost-plugin-playbooks:\u003c 1.41.1-0.20260316224925-705f54a81841.

GHSA-4pmx-622h-x359MediumCVSS 4.3

Mattermost fails to verify run_create permission for empty playbookId

Vendor

GitHub Security Advisories

Published

March 16, 2026

Last Modified

March 20, 2026

🔗 CVE IDs covered (1)

CVE-2026-26304 →

📋 Description

Mattermost versions 11.3.x <= 11.3.0, 11.2.x <= 11.2.2 fail to verify run_create permission for empty playbookId, which allows team members to create unauthorized runs via the playbook run API. Mattermost Advisory ID: MMSA-2025-00542

🎯 Affected products1

go/github.com/mattermost/mattermost-plugin-playbooks:< 1.41.1-0.20260316224925-705f54a81841

🔗 References (4)

https://nvd.nist.gov/vuln/detail/CVE-2026-26304
https://mattermost.com/security-updates
https://github.com/mattermost/mattermost-plugin-playbooks/commit/705f54a818410f3612df3865bfde608ed471037e
https://github.com/advisories/GHSA-4pmx-622h-x359