What is the CVSS score of CVE-2026-6541?

CVE-2026-6541 has a CVSS 3.1 base score of 4.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N. EPSS exploitation probability: 0.2%.

Mattermost CVE-2026-6541

EUVD-2026-43341 MEDIUM

Authorization Bypass Through User-Controlled Key (CWE-639)

2026-07-13 Mattermost

Authentication Bypass Mattermost

4.3

CVSS 3.1 · Vendor: Mattermost

Severity by source

Vendor (Mattermost) PRIMARY

4.3 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

vuln.today AI

4.3 MEDIUM

PR:L reflects mandatory authenticated team membership; I:L captures metric configuration tampering only; C:N and A:N reflect no confidentiality or availability impact.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (Mattermost).

CVSS VectorVendor: Mattermost

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 13, 2026 - 11:31 vuln.today

DescriptionCVE.org

Mattermost versions 11.7.x <= 11.7.1, 11.6.x <= 11.6.4, 10.11.x <= 10.11.19 fail to restrict metric configuration changes to the playbook being saved, which allows an authenticated user with team access to alter another user’s playbook metric settings via a crafted import or update request with a foreign metric ID. Mattermost Advisory ID: MMSA-2026-00653

AnalysisAI

Insecure Direct Object Reference (IDOR) in Mattermost's Playbooks feature permits any authenticated team member to overwrite another user's playbook metric configuration by supplying a foreign metric ID in a crafted import or update request. Affected branches are 11.7.x through 11.7.1, 11.6.x through 11.6.4, and 10.11.x through 10.11.19, where the server authorizes metric writes based on team membership alone rather than verifying that the referenced metric ID belongs to the playbook being saved. …

Unlock full vulnerability intelligence

Risk assessment & exploitation conditions
Attack chain visualization
Remediation with exact patch versions
Threat intelligence from 22 sources
Personal watchlist & email alerts

Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access

Authenticate as low-privilege team member

Delivery

Enumerate victim's playbook metric IDs via API

Exploit

Craft playbook import or update request with foreign metric ID

Execution

Submit request to Mattermost server

Persist

Server authorizes write based on team membership

Impact

Victim's playbook metric settings silently overwritten

Access

Authenticate as low-privilege team member

Delivery

Enumerate victim's playbook metric IDs via API

Exploit

Craft playbook import or update request with foreign metric ID

Execution

Submit request to Mattermost server

Persist

Server authorizes write based on team membership

Impact

Victim's playbook metric settings silently overwritten

Vulnerability AssessmentAI

Exploitation	Exploitation requires a valid authenticated Mattermost account with membership in the same team as the victim - this is mandatory (PR:L per CVSS vector) and is the primary limiting factor. … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment	The NVD-assigned CVSS 3.1 score of 4.3 (Medium) accurately reflects the constrained blast radius: AV:N confirms network exploitability, AC:L indicates no special timing or race conditions are required, PR:L mandates a valid authenticated account in the target team, and S:U/C:N/I:L/A:N caps impact at limited integrity modification with no confidentiality or availability consequences. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario	An authenticated Mattermost team member with a low-privilege account enumerates or infers a valid metric ID belonging to a colleague's incident-response playbook, then submits a crafted playbook update API request substituting that foreign metric ID. The server, checking only team membership, applies the change - silently altering the victim's metric name, target value, or definition - without any notification to the playbook owner. …
Remediation	Upgrade Mattermost to a release above the affected version ceilings (above 11.7.1 on the 11.7.x branch, above 11.6.4 on the 11.6.x branch, or above 10.11.19 on the 10.11.x branch) per the Mattermost security advisory at https://mattermost.com/security-updates - exact patched release numbers should be verified there directly, as specific fix versions were not confirmed in the available intelligence. … Detailed patch versions, workarounds, and compensating controls in full report.