# CVE-2026-9812: Mattermost Playbooks property field validation bypass

Source: https://junglewise.ai/threats/cve-2026-9812-mattermost-playbooks-property-field-validation-bypass  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-09-14. Updated: 2026-09-26  
License: CC BY 4.0 with a link back

CVE-2026-9812 · Severity: medium · CVSS 6.5 · Published 2026-09-14

Mattermost Playbooks, a task automation and workflow management plugin, fails to properly validate which run a property field belongs to before allowing updates. An authenticated user with property-management permissions can exploit this to crash the Playbooks plugin by sending a REST request with a property field from a different run, causing service disruption.

Vendors: [Mattermost](https://junglewise.ai/threats/vendors/mattermost).

## Quick answers

**Is CVE-2026-9812 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-9812 being exploited in the wild.

**How severe is CVE-2026-9812?** Medium severity, with a CVSS score of 6.5, published 14 September 2026.

**Which products and versions are affected?** Mattermost Playbooks 11.9.x <= 11.9.0, 11.8.x <= 11.8.4, 11.7.x <= 11.7.7, 10.11.x <= 10.11.22.

**Is there a fix for CVE-2026-9812?** A patch was published on 2026-09-14: Patches available: 11.9.1+, 11.8.5+, 11.7.8+, 10.11.23+ Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-9812 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-9812?** Check whether you run Mattermost Playbooks at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

This is an authorization/validation bypass vulnerability in the Mattermost Playbooks plugin's property field management API. The vulnerable component fails to verify that a property field belongs to the specified run before processing update requests. The attack requires network access to the REST API and valid authentication credentials with run property-management access. An attacker can trigger a denial-of-service condition by referencing a property field from an unrelated run, crashing the Playbooks plugin. Patches are available in versions 11.9.1+, 11.8.5+, 11.7.8+, and 10.11.23+.

## Affected products

- Mattermost Playbooks 11.9.x <= 11.9.0, 11.8.x <= 11.8.4, 11.7.x <= 11.7.7, 10.11.x <= 10.11.22

## Timeline

- 2026-09-14: disclosed
- 2026-09-14: patched: Patches available: 11.9.1+, 11.8.5+, 11.7.8+, 10.11.23+

## References

- [https://mattermost.com/security-updates](https://mattermost.com/security-updates)

## Related threats

- [Mattermost Playbooks plugin denial of service via null condition in import](https://junglewise.ai/threats/cve-2026-13411-mattermost-versions-11-7-x-11-7-11-fail-to-validate-null-elements)