EUVD-2026-30751
GHSA-m79q-8qf5-v622
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Primary rating from NVD.
CVSS VectorNVD
Lifecycle Timeline
1DescriptionCVE.org
Mattermost versions 11.5.x <= 11.5.1, 10.11.x <= 10.11.13, 11.4.x <= 11.4.3 fail to check public/private permissions which allows members without these permissions to access public playbooks via /get.. Mattermost Advisory ID: MMSA-2026-00591
AnalysisAI
Unauthorized access to public playbooks in Mattermost 10.11.x through 11.5.x allows authenticated users without proper permissions to retrieve public playbooks via the /get endpoint. The vulnerability affects all versions from 10.11.0 through 10.11.13, 11.4.0 through 11.4.3, and 11.5.0 through 11.5.1 due to missing public/private permission validation. With CVSS 4.3 (Medium) and requiring authenticated access (PR:L), this represents a privilege escalation issue allowing disclosure of potentially sensitive playbook configurations, but is limited to low confidentiality impact without integrity or availability compromise. No active exploitation confirmed (not in CISA KEV) and EPSS data not provided.
Technical ContextAI
Mattermost is an open-source team collaboration platform similar to Slack. Playbooks are structured workflows and procedures teams use for incident response, process documentation, and operational tasks. The vulnerability stems from CWE-863 (Incorrect Authorization), where the application's playbook retrieval endpoint fails to properly validate whether the requesting user has permissions to access public versus private playbooks. The affected CPE (cpe:2.3:a:mattermost:mattermost) indicates core Mattermost server deployments across multiple major version branches (10.11.x, 11.4.x, 11.5.x). The flaw exists in the permission checking logic before serving playbook data through API endpoints, allowing authenticated users to bypass intended access controls and retrieve playbooks marked as public regardless of their assigned role or team membership restrictions.
RemediationAI
Upgrade to patched Mattermost versions addressing MMSA-2026-00591, expected to be versions 10.11.14, 11.4.4, and 11.5.2 or later based on the affected version ranges (confirmation of exact patched versions should be obtained from https://mattermost.com/security-updates). As an interim compensating control if immediate patching is infeasible, restrict playbook feature access by limiting user account creation and reviewing existing authenticated user accounts to ensure only trusted personnel have Mattermost access, since the vulnerability requires authentication. Consider temporarily disabling the playbooks feature entirely if it's not operationally critical until patching is complete, though this impacts legitimate workflow functionality. Review audit logs for unusual playbook access patterns from users who shouldn't have permissions, looking for API calls to /get endpoints by accounts with restricted roles. Note that no workaround fully mitigates the vulnerability short of version upgrade, as the flaw exists in core authorization logic.
More in Mattermost
View allMattermost versions 10.4.x <= 10.4.1, 9.11.x <= 9.11.7, 10.3.x <= 10.3.2, 10.2.x <= 10.2.2 fail to properly validate boa
Denial of service in linkify-it (npm) through v5.0.0 lets remote unauthenticated attackers wedge a rendering worker by s
A denial-of-service vulnerability in Mattermost allows an authenticated user to crash the server via multiple large auto
Mattermost version 7.1.x and earlier fails to sufficiently process a specifically crafted GIF file when it is uploaded w
A remote code execution vulnerability (CVSS 9.9) that allows authenticated users. Critical severity with potential for s
Mattermost versions 10.4.x <= 10.4.1, 9.11.x <= 9.11.7, 10.3.x <= 10.3.2, 10.2.x <= 10.2.2 fail to properly validate inp
Privilege escalation to full administrative control in Mattermost self-hosted server (versions 11.6.0 and earlier in the
Mattermost versions 11.0.x <= 11.0.2, 10.12.x <= 10.12.1, 10.11.x <= 10.11.4, 10.5.x <= 10.5.12 fail to to verify that t
Mattermost versions 10.12.x <= 10.12.1, 10.11.x <= 10.11.4, 10.5.x <= 10.5.12, 11.0.x <= 11.0.3 fail to properly validat
Mattermost webapp fails to validate route parameters in/<TEAM_NAME>/channels/<CHANNEL_NAME> allowing an attacker to perf
Fleet is an open source osquery manager. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable,
Mattermost versions 10.4.x <= 10.4.1, 9.11.x <= 9.11.7, 10.3.x <= 10.3.2, 10.2.x <= 10.2.2 fail to use prepared statemen
Same weakness CWE-863 – Incorrect Authorization
View allSame technique Authentication Bypass
View allVendor StatusVendor
SUSE
Severity: Moderate| Product | Status |
|---|---|
| SUSE Linux Enterprise Server 16.1 | Affected |
| SUSE Linux Enterprise Server for SAP applications 16.1 | Affected |
| SUSE Linux Enterprise Module for Package Hub 15 SP5 | Affected |
| SUSE Linux Enterprise Module for Package Hub 15 SP6 | Affected |
| openSUSE Leap 15.5 | Affected |
| openSUSE Leap 15.6 | Affected |
Share
External POC / Exploit Code
Leaving vuln.today