CVE-2026-4055
MediumCVSS 4.3Exploitation Probability (EPSS)
Low risk5th percentile - higher than 5% of all known CVEs
Summary
Mattermost versions 11.5.x <= 11.5.1 fail to validate team-level run_create permission against the target team when creating a playbook run, allowing an authenticated team member to create runs in teams where they lack permission by specifying a different team ID in the API request.
Risk Assessment
The risk is unauthorized creation of playbook runs in teams, potentially leading to security policy violations and uncontrolled actions.
Recommendation
Upgrade Mattermost to version 11.5.2 or later as per advisory MMSA-2026-00629.
Original NVD description (English source)
Mattermost versions 11.5.x <= 11.5.1 fail to validate team-level run_create permission against the target team when creating a playbook run which allows an authenticated team member to create runs in teams where they lack permission via specifying a different team ID in the run creation API request. Mattermost Advisory ID: MMSA-2026-00629