Executive brief
Mattermost, a collaboration platform for teams, contains a flaw in how it handles playbook updates. An authorized user with basic playbook management permissions can move a playbook to a different team, bypassing intended restrictions on who can manage team members. This could lead to unauthorized access or organizational disruption by moving sensitive workflows into teams where they do not belong.
Technical details
An incorrect authorization vulnerability (CWE-863) exists in Mattermost Server and the Playbooks plugin. The application fails to verify if the 'team_id' is being modified during a playbook update via the PUT API. An attacker with 'Manage Playbook Configurations' permissions can exploit this to change a playbook's associated team, effectively bypassing 'manage members' restrictions. This allows the relocation of playbooks to teams where the attacker may have different levels of control or where the playbook was not intended to be accessible. The vulnerability is patched in Mattermost Server versions 11.5.2 and 10.11.14.
Affected products
- Mattermost Mattermost Server 11.5.0 to 11.5.1, 10.11.0 to 10.11.13
- Mattermost Mattermost Playbooks Plugin < 1.41.1-0.20260213020129-e1d6ec2c94e6
Timeline
- 2026-02-12: patched: Fix committed to the playbooks plugin repository.
- 2026-05-18: disclosed: CVE-2026-4286 published.
- 2026-05-18: advisory: GitHub Advisory GHSA-gvg4-jhmr-6j23 published.