CVE-2026-4055: Mattermost versions 11.5.x <= 11.5.1 fail to validate team-level run_create permission against the target team when creating a playbook run which allows an…

PriorityP423medium4.3CVSS 3.1

AVNACLPRLUINSUCNILAN

EPSS

0.15%

4.9th percentile

Mattermost versions 11.5.x <= 11.5.1 fail to validate team-level run_create permission against the target team when creating a playbook run which allows an authenticated team member to create runs in teams where they lack permission via specifying a different team ID in the run creation API request. Mattermost Advisory ID: MMSA-2026-00629

Affected

5 ranges

Vendor	Product	Version range	Fixed in
github.com	mattermost_mattermost_server_v8	>= 8.0.0-20260304132957-9f2616376582 < 8.0.0-20260320113102-f2b3d1c6a945	8.0.0-20260320113102-f2b3d1c6a945
mattermost	mattermost	11.5.0 – 11.5.1	—
mattermost	mattermost_server	>= 10.11.0 < 10.11.17	10.11.17
mattermost	mattermost_server	>= 11.5.0 < 11.5.5	11.5.5
mattermost	mattermost_server	>= 11.6.0 < 11.6.2	11.6.2

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.