CVE-2026-16046
published 2026-08-17CVE-2026-16046: Mattermost versions 11.7.x <= 11.7.6, 10.11.x <= 10.11.21 fail to enforce run-state validation on write operations for finished playbook runs which allows a…
PriorityP423medium4.3CVSS 3.1
AVNACLPRLUINSUCNILAN
EPSS
0.25%
16.0th percentile
Mattermost versions 11.7.x <= 11.7.6, 10.11.x <= 10.11.21 fail to enforce run-state validation on write operations for finished playbook runs which allows a run participant to modify status, checklists, retrospective content, ownership, and participants on completed runs via REST and GraphQL API requests. Mattermost Advisory ID: MMSA-2026-00675
Affected
4 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| mattermost | mattermost | 10.11.0 – 10.11.21 | — |
| mattermost | mattermost | 11.7.0 – 11.7.6 | — |
| mattermost | mattermost_server | >= 10.11.0 < 10.11.22 | 10.11.22 |
| mattermost | mattermost_server | >= 11.7.0 < 11.7.7 | 11.7.7 |
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
VulDB
Mattermost up to 10.11.21/11.7.6/11.8.x Playbook Run state issue (Nessus ID 338331)
vuldb·2026-08-21·CVSS 4.3
CVE-2026-16046 [MEDIUM] Mattermost up to 10.11.21/11.7.6/11.8.x Playbook Run state issue (Nessus ID 338331)
A vulnerability was found in Mattermost up to 10.11.21/11.7.6/11.8.x. It has been declared as problematic. Affected by this vulnerability is an unknown functionality of the component Playbook Run. Such manipulation leads to state issue.
This vulnerability is uniquely identified as CVE-2026-16046. The attack can be launched remotely. No exploit exists.
It is recommended to upgrade the affected component.
GHSA
Mattermost versions 11.7.x <= 11.7.6, 10.11.x <= 10.11.21 fail to enforce run-state validation on write operations for finished playbook runs which allows a run participant to modify status, checklist
ghsa_unreviewed·2026-08-17
CVE-2026-16046 [MEDIUM] CWE-863 Mattermost versions 11.7.x <= 11.7.6, 10.11.x <= 10.11.21 fail to enforce run-state validation on write operations for finished playbook runs which allows a run participant to modify status, checklist
Mattermost versions 11.7.x <= 11.7.6, 10.11.x <= 10.11.21 fail to enforce run-state validation on write operations for finished playbook runs which allows a run participant to modify status, checklists, retrospective content, ownership, and participants on completed runs via REST and GraphQL API requests. Mattermost Advisory ID: MMSA-2026-00675
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
2026-08-17
Published