CVE-2026-26304: Mattermost versions 11.3.x <= 11.3.0, 11.2.x <= 11.2.2 fail to verify run_create permission for empty playbookId, which allows team members to create…

PriorityP422medium4.3CVSS 3.1

AVNACLPRLUINSUCNILAN

EPSS

0.16%

5.5th percentile

Mattermost versions 11.3.x <= 11.3.0, 11.2.x <= 11.2.2 fail to verify run_create permission for empty playbookId, which allows team members to create unauthorized runs via the playbook run API. Mattermost Advisory ID: MMSA-2025-00542

Affected

5 ranges

Vendor	Product	Version range	Fixed in
github.com	mattermost_mattermost-plugin-playbooks	>= 0 < 1.41.1-0.20260316224925-705f54a81841	1.41.1-0.20260316224925-705f54a81841
mattermost	mattermost	11.2.0 – 11.2.2	—
mattermost	mattermost	11.3.0 – 11.3.0	—
mattermost	mattermost_server	>= 11.2.0 < 11.2.3	11.2.3
mattermost	mattermost_server	>= 11.3.0 < 11.3.1	11.3.1

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.