What is the CVSS score of CVE-2026-4286?

CVE-2026-4286 has a CVSS 3.1 base score of 3.1 (Low). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N. EPSS exploitation probability: 0.0%.

Is there a patch available for CVE-2026-4286?

Yes, a patch is available for CVE-2026-4286. Update the affected software to the latest version immediately.

Mattermost CVE-2026-4286

Q: Which versions of Mattermost are affected by CVE-2026-4286?

Authorization bypass in Mattermost 10.11.x through 10.11.13 and 11.5.x through 11.5.1 allows authenticated users with 'Manage Playbook Configurations' permission to reassign playbooks to arbitrary…. A patch is available.

EUVD-2026-30750 LOW

Incorrect Authorization (CWE-863)

2026-05-18 Mattermost

GHSA-gvg4-jhmr-6j23

Mattermost Authentication Bypass

3.1

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

3.1 LOW

AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N

Attack Vector

Network

Attack Complexity

High

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

May 18, 2026 - 09:31 vuln.today

DescriptionCVE.org

Mattermost versions 11.5.x <= 11.5.1, 10.11.x <= 10.11.13 fail to check if {{team_id}} was being changed when updating playbooks, allowing users with only {{Manage Playbook Configurations}} permission to change a playbook's team, bypassing manage members restriction via PUT api. Mattermost Advisory ID: MMSA-2025-00552

AnalysisAI

Authorization bypass in Mattermost 10.11.x through 10.11.13 and 11.5.x through 11.5.1 allows authenticated users with 'Manage Playbook Configurations' permission to reassign playbooks to arbitrary teams via PUT API, circumventing team membership restrictions. This access control flaw enables lateral privilege escalation across team boundaries without proper authorization checks. EPSS exploitation probability data not available; no confirmed active exploitation (CISA KEV) or public exploit code identified at time of analysis.

Technical ContextAI

Mattermost Playbooks is a collaboration workflow feature within the Mattermost platform that enables teams to define and execute repeatable processes. The vulnerability stems from CWE-863 (Incorrect Authorization) in the playbook update API endpoint. When processing PUT requests to modify playbook configurations, the server fails to validate whether the team_id parameter is being changed. The 'Manage Playbook Configurations' permission is intended to allow configuration changes within a user's assigned teams, but this missing authorization check allows users to move playbooks between teams they don't have membership or management rights to. This represents a classic case of Insecure Direct Object Reference (IDOR) combined with insufficient authorization enforcement at the API layer, where client-supplied parameters are trusted without server-side validation of ownership boundaries.

RemediationAI

Upgrade to Mattermost version 10.11.14 or later for the 10.11.x series, or version 11.5.2 or later for the 11.5.x series, per vendor guidance expected in Mattermost Advisory MMSA-2025-00552 at https://mattermost.com/security-updates. If immediate patching is not feasible, implement compensating controls: restrict 'Manage Playbook Configurations' permission to only highly trusted users who require cross-team visibility (note this reduces operational flexibility but limits exposure); enable comprehensive API audit logging for all playbook update operations and monitor for unexpected team_id changes in PUT /api/v4/playbooks/* requests; implement network segmentation to isolate Mattermost instances containing sensitive playbooks from broader user populations. These workarounds reduce but do not eliminate risk, as legitimate permission holders can still exploit the vulnerability. Organizations with strict team isolation requirements should prioritize patching over compensating controls.