GitHub Advisoryadvisory · Go

GHSA-gvg4-jhmr-6j23 Mattermost doesn't check if {{team_id}} was being changed when updating playbooks

LOW Published 2026-05-18 Modified 2026-06-01 Official page ↗
Aliases
CVE-2026-4286
Ecosystem
Go
Packages
github.com/mattermost/mattermost/server/v8, github.com/mattermost/mattermost-plugin-playbooks
Severity
Low
CVSS vector
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N
Weaknesses
CWE-863
Reviewed
2026-06-01

Affected packages

• Go github.com/mattermost/mattermost/server/v8: >= 11.5.0, < 11.5.2 → fixed in 11.5.2 • Go github.com/mattermost/mattermost/server/v8: >= 10.11.0, < 10.11.14 → fixed in 10.11.14 • Go github.com/mattermost/mattermost-plugin-playbooks: < 1.41.1-0.20260213020129-e1d6ec2c94e6 → fixed in 1.41.1-0.20260213020129-e1d6ec2c94e6

Description

Mattermost versions 11.5.x <= 11.5.1, 10.11.x <= 10.11.13 fail to check if {{team_id}} was being changed when updating playbooks, allowing users with only {{Manage Playbook Configurations}} permission to change a playbook's team, bypassing manage members restriction via PUT api. Mattermost Advisory ID: MMSA-2025-00552

Related

Alias · CVE (1)

  • CVE-2026-4286 Mattermost versions 11.5.x <= 11.5.1, 10.11.x <= 10.11.13 fail to check if {{team_id}} was being changed when updating playbooks, allowing… vulnerability

Weakness · CWE (1)

  • CWE-863 Incorrect Authorization weakness

References