Mattermost Playbooks CVE-2026-13411

Exploitation requires an authenticated account on the Mattermost instance (PR:L) with the ability to submit a playbook import request to the Playbooks plugin, and the instance must be running an affected version (11.7.x up to and including 11.7.11) with the Playbooks feature in use. The specific precondition is the attacker's ability to craft an import request containing a null condition element that reaches the unvalidated decoding path. Limiting factors: the attacker cannot be fully anonymous (authentication is required), no user interaction from a victim is needed (UI:N), the impact is confined to availability of the Playbooks plugin with no data compromise, and instances not using Playbooks or already patched beyond 11.7.11 are not exposed.

This is a genuinely low-to-moderate priority issue rather than an emergency. All signals align toward limited severity: the CVSS base score is 4.3 (Medium) with vector AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L, meaning the only impact is partial availability (A:L) with no confidentiality or integrity consequence. The attacker must be authenticated (PR:L), which materially shrinks the threat population to users who already have a valid account on the Mattermost instance. The vuln.today decision label is 'this_month,' consistent with a non-urgent but patch-worthy defect. There is no CISA KEV listing, no EPSS score provided in the input, and no public exploit or PoC reference supplied, so there is no evidence of active exploitation or available exploit code. The CWE-754 (improper check for unusual conditions) classification matches the description precisely - a null element is not validated during decoding of playbook import conditions - so the CVSS and the description are mutually consistent with no contradiction to flag. The practical risk is an authenticated insider or a compromised/low-privileged account causing an instance-wide crash of the Playbooks plugin (a denial-of-service against one feature set), not a path to code execution or data exposure.

An authenticated user with access to the Playbooks feature submits a crafted playbook import request containing a null condition element. Because the decoder fails to validate null elements, the malformed import crashes the Playbooks plugin for the entire instance, denying the feature to all users. No public exploit or PoC has been identified at time of analysis, and no special privileges beyond a standard authenticated account are indicated.