Mattermost EUVD-2026-30750

Attacker must possess valid authenticated access to a Mattermost instance with an account granted 'Manage Playbook Configurations' permission within at least one team - this is not a default user permission and typically assigned to playbook administrators or team leads. The target Mattermost instance must have the Playbooks feature enabled and contain playbooks in other teams that the attacker seeks to access. Exploitation requires knowledge of target playbook IDs and team IDs, obtainable through API enumeration if directory listing is not restricted, or through social engineering. High attack complexity (AC:H) reflects these prerequisite conditions. The vulnerability is limited to authorized users with specific elevated permissions attempting lateral movement across team boundaries, not external or unauthenticated attackers. User interaction is not required (UI:N) once prerequisites are met.

Real-world risk is moderate despite the low CVSS base score of 3.1. The CVSS vector (AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N) indicates network-accessible exploitation requiring low-level authentication but high attack complexity, with limited integrity impact and no confidentiality or availability effects. The AC:H (high complexity) likely reflects the need for pre-existing 'Manage Playbook Configurations' permission, which is not a default user role. However, the integrity impact extends beyond simple data modification - successful exploitation enables cross-team boundary violations in multi-tenant deployments, potentially exposing sensitive playbooks containing incident response procedures, security runbooks, or operational workflows to unauthorized teams. The scope remains unchanged (S:U), limiting blast radius to the immediate application context. No EPSS data available to assess real-world exploitation likelihood. Absence from CISA KEV and lack of public POC suggests this is not being actively exploited at scale. Primary risk is to organizations with strict team isolation requirements or those using Mattermost for sensitive operational workflows where playbook confidentiality matters. This is a real security issue requiring remediation but not an emergency-priority crisis for most deployments.

An authenticated user with 'Manage Playbook Configurations' permission in Team A discovers a sensitive incident response playbook in Team B through directory traversal or information disclosure. The attacker crafts a PUT request to the Mattermost API updating the target playbook's configuration while changing the team_id parameter from Team B to Team A. The server processes this request without validating team ownership boundaries, successfully reassigning the playbook. The attacker now has full access to Team B's playbook content, potentially exposing confidential security procedures, credentials embedded in workflow steps, or operational intelligence, while Team B loses authorized access to their own playbook.