What is the CVSS score of EUVD-2026-43341?

EUVD-2026-43341 has a CVSS 3.1 base score of 4.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N. EPSS exploitation probability: 0.2%.

Mattermost EUVD-2026-43341

| CVE-2026-6541 MEDIUM

Authorization Bypass Through User-Controlled Key (CWE-639)

2026-07-13 Mattermost

Authentication Bypass Mattermost

4.3

CVSS 3.1 · Vendor: Mattermost

Severity by source

Vendor (Mattermost) PRIMARY

4.3 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

vuln.today AI

4.3 MEDIUM

PR:L reflects mandatory authenticated team membership; I:L captures metric configuration tampering only; C:N and A:N reflect no confidentiality or availability impact.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (Mattermost).

CVSS VectorVendor: Mattermost

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 13, 2026 - 11:31 vuln.today

DescriptionCVE.org

Mattermost versions 11.7.x <= 11.7.1, 11.6.x <= 11.6.4, 10.11.x <= 10.11.19 fail to restrict metric configuration changes to the playbook being saved, which allows an authenticated user with team access to alter another user’s playbook metric settings via a crafted import or update request with a foreign metric ID. Mattermost Advisory ID: MMSA-2026-00653

AnalysisAI

Insecure Direct Object Reference (IDOR) in Mattermost's Playbooks feature permits any authenticated team member to overwrite another user's playbook metric configuration by supplying a foreign metric ID in a crafted import or update request. Affected branches are 11.7.x through 11.7.1, 11.6.x through 11.6.4, and 10.11.x through 10.11.19, where the server authorizes metric writes based on team membership alone rather than verifying that the referenced metric ID belongs to the playbook being saved. No public exploit code has been identified and this vulnerability does not appear in CISA KEV at time of analysis.

Technical ContextAI

Mattermost is a self-hosted team messaging and collaboration platform whose Playbooks feature enables structured runbooks with configurable outcome metrics (e.g., time-to-resolve, incident count). CWE-639 - Authorization Bypass Through User-Controlled Key, the formal classification for Insecure Direct Object Reference - identifies the root cause: the server accepts an attacker-supplied metric ID in import or update API payloads without scoping ownership validation to the playbook being modified. Because access checks are performed at the team level (PR:L per the CVSS vector) rather than at the metric-object level, any team member can reference a metric belonging to another user's playbook and have the write succeed. The affected CPE is cpe:2.3:a:mattermost:mattermost:*:*:*:*:*:*:*:*, covering all Mattermost editions across the three vulnerable release trains.

RemediationAI

Upgrade Mattermost to a release above the affected version ceilings (above 11.7.1 on the 11.7.x branch, above 11.6.4 on the 11.6.x branch, or above 10.11.19 on the 10.11.x branch) per the Mattermost security advisory at https://mattermost.com/security-updates - exact patched release numbers should be verified there directly, as specific fix versions were not confirmed in the available intelligence. For organizations unable to patch immediately, the most effective compensating control is restricting Playbook import and update API access to administrator-level accounts only, which removes the PR:L team-member exploitation path entirely; the trade-off is that non-admin users lose self-service playbook import capability. Additionally, auditing recent playbook metric modification history for unauthorized changes and enforcing strict team membership hygiene (removing stale or untrusted accounts) reduce the practical attack surface. No generic configuration changes beyond these targeted API access restrictions are recommended.