EUVD-2026-60207
GHSA-2883-3c4j-4mvv
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
API is network-accessible (AV:N), requires only authenticated run participant status (PR:L), no confidentiality or availability impact - solely limited integrity modification of completed run records.
Primary rating from Vendor (mattermost).
CVSS VectorVendor: mattermost
Lifecycle Timeline
1DescriptionCVE.org
Mattermost versions 11.7.x <= 11.7.6, 10.11.x <= 10.11.21 fail to enforce run-state validation on write operations for finished playbook runs which allows a run participant to modify status, checklists, retrospective content, ownership, and participants on completed runs via REST and GraphQL API requests. Mattermost Advisory ID: MMSA-2026-00675
AnalysisAI
Mattermost's Playbooks feature in versions 11.7.x through 11.7.6 and 10.11.x through 10.11.21 omits run-state enforcement on API write operations, allowing any authenticated run participant to alter completed playbook runs via REST and GraphQL endpoints. An attacker with low privileges can overwrite status, checklists, retrospective content, ownership, and participant lists on runs that should be immutable once finished, undermining post-incident audit integrity. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires three specific conditions: (1) the attacker must hold a valid Mattermost user account with at least low-privilege access (PR:L per CVSS); (2) the attacker must be listed as a participant in the specific playbook run being targeted - arbitrary runs belonging to other teams cannot be targeted without participant membership; and (3) the targeted playbook run must be in a finished/completed state. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 3.1 base score of 4.3 with vector AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N accurately characterizes this as a medium-severity, low-complexity, authenticated network vulnerability. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Apply the vendor-released security updates documented at https://mattermost.com/security-updates. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Mattermost
View allMattermost versions 10.4.x <= 10.4.1, 9.11.x <= 9.11.7, 10.3.x <= 10.3.2, 10.2.x <= 10.2.2 fail to properly validate boa
Denial of service in linkify-it (npm) through v5.0.0 lets remote unauthenticated attackers wedge a rendering worker by s
A denial-of-service vulnerability in Mattermost allows an authenticated user to crash the server via multiple large auto
Mattermost version 7.1.x and earlier fails to sufficiently process a specifically crafted GIF file when it is uploaded w
A remote code execution vulnerability (CVSS 9.9) that allows authenticated users. Critical severity with potential for s
Mattermost versions 10.4.x <= 10.4.1, 9.11.x <= 9.11.7, 10.3.x <= 10.3.2, 10.2.x <= 10.2.2 fail to properly validate inp
Privilege escalation to full administrative control in Mattermost self-hosted server (versions 11.6.0 and earlier in the
Mattermost versions 11.0.x <= 11.0.2, 10.12.x <= 10.12.1, 10.11.x <= 10.11.4, 10.5.x <= 10.5.12 fail to to verify that t
Mattermost versions 10.12.x <= 10.12.1, 10.11.x <= 10.11.4, 10.5.x <= 10.5.12, 11.0.x <= 11.0.3 fail to properly validat
Mattermost webapp fails to validate route parameters in/<TEAM_NAME>/channels/<CHANNEL_NAME> allowing an attacker to perf
Fleet is an open source osquery manager. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable,
Mattermost versions 10.4.x <= 10.4.1, 9.11.x <= 9.11.7, 10.3.x <= 10.3.2, 10.2.x <= 10.2.2 fail to use prepared statemen
Same weakness CWE-863 – Incorrect Authorization
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today