CVE-2026-4286: Mattermost incorrect authorization in Playbook team updates

CVE-2026-4286 · Severity: low · CVSS 3.1 · Published 2026-05-18

Mattermost, a collaboration platform for teams, contains a flaw in how it handles playbook updates. An authorized user with basic playbook management permissions can move a playbook to a different team, bypassing intended restrictions on who can manage team members. This could lead to unauthorized access or organizational disruption by moving sensitive workflows into teams where they do not belong.

Technologies: github.com/mattermost/mattermost-plugin-playbooks (Go), github.com/mattermost/mattermost-server (Go), github.com/mattermost/mattermost-server/v5 (Go), github.com/mattermost/mattermost-server/v6 (Go), github.com/mattermost/mattermost/server/v8 (Go), Mattermost Server. Vendors: Go, Mattermost.

Quick answers

Is CVE-2026-4286 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-4286 being exploited in the wild.
How severe is CVE-2026-4286?
Low severity, with a CVSS score of 3.1, published 18 May 2026.
Which products and versions are affected?
github.com/mattermost/mattermost-plugin-playbooks (Go) SEMVER:introduced=0,fixed=1.41.1-0.20260213020129-e1d6ec2c94e6; github.com/mattermost/mattermost-server (Go) SEMVER:introduced=10.11.0+incompatible,fixed=10.11.14+incompatible,introduced=11.5.0+incompatible,fixed=11.5.2+incompatible; github.com/mattermost/mattermost-server/v5 (Go) SEMVER:introduced=0; github.com/mattermost/mattermost-server/v6 (Go) SEMVER:introduced=0; and 3 more.
Is there a fix for CVE-2026-4286?
Yes. github.com/mattermost/mattermost-plugin-playbooks (Go): upgrade to 1.41.1-0.20260213020129-e1d6ec2c94e6 or later; github.com/mattermost/mattermost-server (Go): upgrade to 11.5.2+incompatible or later; github.com/mattermost/mattermost/server/v8 (Go): upgrade to 11.5.2 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-4286 attacked?
It is attacked over the network, in a hosted service.
Am I affected by CVE-2026-4286?
Check whether you run github.com/mattermost/mattermost-plugin-playbooks (Go), github.com/mattermost/mattermost-server (Go), github.com/mattermost/mattermost-server/v5 (Go) or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • github.com/mattermost/mattermost-plugin-playbooks (Go): upgrade to 1.41.1-0.20260213020129-e1d6ec2c94e6 or later
    go get github.com/mattermost/mattermost-plugin-playbooks@v1.41.1-0.20260213020129-e1d6ec2c94e6
  • github.com/mattermost/mattermost-server (Go): upgrade to 11.5.2+incompatible or later
    go get github.com/mattermost/mattermost-server@v11.5.2+incompatible
  • github.com/mattermost/mattermost/server/v8 (Go): upgrade to 11.5.2 or later
    go get github.com/mattermost/mattermost/server/v8@v11.5.2

Technical details

An incorrect authorization vulnerability (CWE-863) exists in Mattermost Server and the Playbooks plugin. The application fails to verify if the 'team_id' is being modified during a playbook update via the PUT API. An attacker with 'Manage Playbook Configurations' permissions can exploit this to change a playbook's associated team, effectively bypassing 'manage members' restrictions. This allows the relocation of playbooks to teams where the attacker may have different levels of control or where the playbook was not intended to be accessible. The vulnerability is patched in Mattermost Server versions 11.5.2 and 10.11.14.

Affected products

  • Mattermost Mattermost Server 11.5.0 to 11.5.1, 10.11.0 to 10.11.13
  • Mattermost Mattermost Playbooks Plugin < 1.41.1-0.20260213020129-e1d6ec2c94e6

Identifiers

  • CVE-2026-4286
  • GHSA-gvg4-jhmr-6j23
  • GO-2026-5404

Timeline

  • 2026-02-12: patched: Fix committed to the playbooks plugin repository.
  • 2026-05-18: disclosed: CVE-2026-4286 published.
  • 2026-05-18: advisory: GitHub Advisory GHSA-gvg4-jhmr-6j23 published.

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.