What is the CVSS score of CVE-2026-6343?

CVE-2026-6343 has a CVSS 3.1 base score of 4.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N. EPSS exploitation probability: 0.0%.

Is there a patch available for CVE-2026-6343?

Yes, a patch is available for CVE-2026-6343. Update the affected software to the latest version immediately.

Mattermost CVE-2026-6343

Q: Which versions of Mattermost are affected by CVE-2026-6343?

Unauthorized access to public playbooks in Mattermost 10.11.x through 11.5.x allows authenticated users without proper permissions to retrieve public playbooks via the /get endpoint.. A patch is available.

EUVD-2026-30751 MEDIUM

Incorrect Authorization (CWE-863)

2026-05-18 Mattermost

GHSA-m79q-8qf5-v622

Mattermost Authentication Bypass

4.3

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

4.3 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

May 18, 2026 - 09:33 vuln.today

DescriptionCVE.org

Mattermost versions 11.5.x <= 11.5.1, 10.11.x <= 10.11.13, 11.4.x <= 11.4.3 fail to check public/private permissions which allows members without these permissions to access public playbooks via /get.. Mattermost Advisory ID: MMSA-2026-00591

AnalysisAI

Unauthorized access to public playbooks in Mattermost 10.11.x through 11.5.x allows authenticated users without proper permissions to retrieve public playbooks via the /get endpoint. The vulnerability affects all versions from 10.11.0 through 10.11.13, 11.4.0 through 11.4.3, and 11.5.0 through 11.5.1 due to missing public/private permission validation. With CVSS 4.3 (Medium) and requiring authenticated access (PR:L), this represents a privilege escalation issue allowing disclosure of potentially sensitive playbook configurations, but is limited to low confidentiality impact without integrity or availability compromise. No active exploitation confirmed (not in CISA KEV) and EPSS data not provided.

Technical ContextAI

Mattermost is an open-source team collaboration platform similar to Slack. Playbooks are structured workflows and procedures teams use for incident response, process documentation, and operational tasks. The vulnerability stems from CWE-863 (Incorrect Authorization), where the application's playbook retrieval endpoint fails to properly validate whether the requesting user has permissions to access public versus private playbooks. The affected CPE (cpe:2.3:a:mattermost:mattermost) indicates core Mattermost server deployments across multiple major version branches (10.11.x, 11.4.x, 11.5.x). The flaw exists in the permission checking logic before serving playbook data through API endpoints, allowing authenticated users to bypass intended access controls and retrieve playbooks marked as public regardless of their assigned role or team membership restrictions.

RemediationAI

Upgrade to patched Mattermost versions addressing MMSA-2026-00591, expected to be versions 10.11.14, 11.4.4, and 11.5.2 or later based on the affected version ranges (confirmation of exact patched versions should be obtained from https://mattermost.com/security-updates). As an interim compensating control if immediate patching is infeasible, restrict playbook feature access by limiting user account creation and reviewing existing authenticated user accounts to ensure only trusted personnel have Mattermost access, since the vulnerability requires authentication. Consider temporarily disabling the playbooks feature entirely if it's not operationally critical until patching is complete, though this impacts legitimate workflow functionality. Review audit logs for unusual playbook access patterns from users who shouldn't have permissions, looking for API calls to /get endpoints by accounts with restricted roles. Note that no workaround fully mitigates the vulnerability short of version upgrade, as the flaw exists in core authorization logic.