Vulnerability · Published May 21, 2026 · Assigned by Mattermost

CVE-2026-4055Insufficient permission validation on cross-team playbook run creation

Medium 4.3

In plain English

A medium-severity incorrect authorization in Mattermost from Mattermost. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 4% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)4.3Medium

Exploit odds (30 days)0.2%top 95.6% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

Mattermost versions 11.5.x <= 11.5.1 fail to validate team-level run_create permission against the target team when creating a playbook run which allows an authenticated team member to create runs in teams where they lack permission via specifying a different team ID in the run creation API request. Mattermost Advisory ID: MMSA-2026-00629

Affected packages & fixed versions

Ecosystem	Package	Fixed in	Advisory
Go	github.com/mattermost/mattermost-server	no fix listed	GO-2026-5173
Go	github.com/mattermost/mattermost-server/v5	no fix listed	GO-2026-5173
Go	github.com/mattermost/mattermost-server/v6	no fix listed	GO-2026-5173
Go	github.com/mattermost/mattermost/server/v8	8.0.0-20260320113102-f2b3d1c6a945	GHSA-6cfr-wp44-6qmv
Go	github.com/mattermost/mattermost/server/v8	8.0.0-20260320113102-f2b3d1c6a945	GO-2026-5173

Affected products (as reported)

Vendor	Product	Versions
Mattermost	Mattermost	11.5.0 – through 11.5.1

Weakness: CWE-863 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

References

MMSA-2026-00629 vendor-advisory