What is the CVSS score of EUVD-2026-31221?

EUVD-2026-31221 has a CVSS 3.1 base score of 4.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N. EPSS exploitation probability: 0.0%.

Is there a patch available for EUVD-2026-31221?

Yes, a patch is available for EUVD-2026-31221. Update the affected software to the latest version immediately.

Mattermost EUVD-2026-31221

Q: Which versions of Mattermost are affected by EUVD-2026-31221?

Incorrect authorization in Mattermost Playbooks (versions 11.5.0-11.5.1) allows any authenticated team member to create playbook runs in teams where they hold no run_create permission, by supplying…. A patch is available.

| CVE-2026-4055 MEDIUM

Incorrect Authorization (CWE-863)

2026-05-21 Mattermost

GHSA-6cfr-wp44-6qmv

Authentication Bypass Mattermost

4.3

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

4.3 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

May 21, 2026 - 08:10 vuln.today

DescriptionCVE.org

Mattermost versions 11.5.x <= 11.5.1 fail to validate team-level run_create permission against the target team when creating a playbook run which allows an authenticated team member to create runs in teams where they lack permission via specifying a different team ID in the run creation API request. Mattermost Advisory ID: MMSA-2026-00629

AnalysisAI

Incorrect authorization in Mattermost Playbooks (versions 11.5.0-11.5.1) allows any authenticated team member to create playbook runs in teams where they hold no run_create permission, by supplying an arbitrary team ID in the run creation API request. The server validates permissions only against the user's originating context rather than the target team specified in the payload, a classic authorization bypass rooted in CWE-863. No active exploitation has been confirmed (not in CISA KEV) and no public exploit code is identified at time of analysis, but the low attack complexity makes this trivially exploitable by any authenticated insider or compromised account.

Technical ContextAI

Mattermost is an open-source collaboration platform; its Playbooks feature provides structured incident management and workflow automation. The affected component is the server-side API handler for run creation (MMSA-2026-00629), which performs a run_create authorization check scoped to the user's own team context rather than re-validating against the team_id value supplied in the request body. This is a textbook CWE-863 (Incorrect Authorization) failure - a permission check that fires against the wrong resource scope. The CPE cpe:2.3:a:mattermost:mattermost:*:*:*:*:*:*:*:* covers the server application. The vulnerability is functionally similar to an insecure direct object reference (IDOR) in authorization context: the caller can reference a foreign team ID and the access control logic does not cross-check it.

RemediationAI

The primary remediation is to upgrade Mattermost beyond the 11.5.1 release per the vendor security advisory at https://mattermost.com/security-updates (MMSA-2026-00629). The exact patched version number is not specified in the available input data and was not independently confirmed - administrators must consult the advisory directly to identify the minimum safe release. As a compensating control where immediate patching is not feasible, restricting Playbooks API endpoint access to trusted internal network segments or requiring VPN for Mattermost API access would reduce the attack surface, though this does not eliminate the authorization flaw and introduces access friction for legitimate users. Monitoring API logs for run creation requests referencing team IDs that differ from the authenticated user's primary team membership may help detect abuse in the interim.