CVE-2026-4055

Mattermost versions 11.5.x <= 11.5.1 fail to validate team-level run_create permission against the target team when creating a playbook run which allows an authenticated team member to create runs in teams where they lack permission via specifying a different team ID in the run creation API request. Mattermost Advisory ID: MMSA-2026-00629

CVSS v3 4.3 MEDIUM

4.3^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 2.8 / Impact : 1.4

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact LOW

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://mattermost.com/security-updates	Vendor Advisory

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:mattermost:mattermost_server::::::::
	cpe:2.3:a:mattermost:mattermost_server::::::::
	cpe:2.3:a:mattermost:mattermost_server::::::::

History

23 Jul 2026, 16:10

Type	Values Removed	Values Added
Summary		(es) Las versiones de Mattermost 11.5.x <= 11.5.1 fallan al validar el permiso run_create a nivel de equipo contra el equipo de destino al crear una ejecución de playbook, lo que permite a un miembro del equipo autenticado crear ejecuciones en equipos donde carecen de permiso mediante la especificación de un ID de equipo diferente en la solicitud de API de creación de ejecución. ID de Aviso de Mattermost: MMSA-2026-00629

21 May 2026, 19:45

Type	Values Removed	Values Added
CPE		cpe:2.3:a:mattermost:mattermost_server::::::::
References	~~() https://mattermost.com/security-updates -~~	() https://mattermost.com/security-updates - Vendor Advisory
First Time		Mattermost mattermost Server Mattermost

21 May 2026, 08:16

Type	Values Removed	Values Added
New CVE

Information

Published : 2026-05-21 08:16

Updated : 2026-07-23 16:10

NVD link : CVE-2026-4055

Mitre link : CVE-2026-4055

CVE.ORG link : CVE-2026-4055

JSON object : View

Products Affected

mattermost

mattermost_server

CWE

CWE-863

Incorrect Authorization

{"id": "CVE-2026-4055", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-4055", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-05-21T12:39:26.946775Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "responsibledisclosure@mattermost.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 4.3, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "NONE"}, "impactScore": 1.4, "exploitabilityScore": 2.8}]}, "affected": [{"source": "responsibledisclosure@mattermost.com", "affectedData": [{"vendor": "Mattermost", "product": "Mattermost", "versions": [{"status": "affected", "version": "11.5.0", "versionType": "semver", "lessThanOrEqual": "11.5.1"}, {"status": "unaffected", "version": "11.6.0"}, {"status": "unaffected", "version": "11.5.2"}, {"status": "unaffected", "version": "10.11.14"}, {"status": "unaffected", "version": "11.4.4"}], "defaultStatus": "unaffected"}]}], "published": "2026-05-21T08:16:23.130", "references": [{"url": "https://mattermost.com/security-updates", "tags": ["Vendor Advisory"], "source": "responsibledisclosure@mattermost.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "responsibledisclosure@mattermost.com", "description": [{"lang": "en", "value": "CWE-863"}]}], "descriptions": [{"lang": "en", "value": "Mattermost versions 11.5.x <= 11.5.1 fail to validate team-level run_create permission against the target team when creating a playbook run which allows an authenticated team member to create runs in teams where they lack permission via specifying a different team ID in the run creation API request. Mattermost Advisory ID: MMSA-2026-00629"}, {"lang": "es", "value": "Las versiones de Mattermost 11.5.x <= 11.5.1 fallan al validar el permiso run_create a nivel de equipo contra el equipo de destino al crear una ejecuci\u00f3n de playbook, lo que permite a un miembro del equipo autenticado crear ejecuciones en equipos donde carecen de permiso mediante la especificaci\u00f3n de un ID de equipo diferente en la solicitud de API de creaci\u00f3n de ejecuci\u00f3n. ID de Aviso de Mattermost: MMSA-2026-00629"}], "lastModified": "2026-07-23T16:10:00.137", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:mattermost:mattermost_server:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "F9018E52-5C7F-4E59-B637-604B8EECD974", "versionEndExcluding": "10.11.17", "versionStartIncluding": "10.11.0"}, {"criteria": "cpe:2.3:a:mattermost:mattermost_server:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "DF287562-A912-43DD-8FAC-0CD8EC7BEF7E", "versionEndExcluding": "11.5.5", "versionStartIncluding": "11.5.0"}, {"criteria": "cpe:2.3:a:mattermost:mattermost_server:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "AFCFC389-02A5-45CD-8EEB-9ED208C0EE83", "versionEndExcluding": "11.6.2", "versionStartIncluding": "11.6.0"}], "operator": "OR"}]}], "sourceIdentifier": "responsibledisclosure@mattermost.com"}