GHSA-gvg4-jhmr-6j23LowCVSS 3.1

Mattermost doesn't check if {{team_id}} was being changed when updating playbooks

Published
May 18, 2026
Last Modified
June 1, 2026

🔗 CVE IDs covered (1)

CVE-2026-4286 →

📋 Description

Mattermost versions 11.5.x <= 11.5.1, 10.11.x <= 10.11.13 fail to check if {{team_id}} was being changed when updating playbooks, allowing users with only {{Manage Playbook Configurations}} permission to change a playbook's team, bypassing manage members restriction via PUT api. Mattermost Advisory ID: MMSA-2025-00552

🎯 Affected products3

  • go/github.com/mattermost/mattermost/server/v8:>= 11.5.0, < 11.5.2
  • go/github.com/mattermost/mattermost/server/v8:>= 10.11.0, < 10.11.14
  • go/github.com/mattermost/mattermost-plugin-playbooks:< 1.41.1-0.20260213020129-e1d6ec2c94e6

🔗 References (4)