CVE-2026-26304: 
vulnerability analysis and mitigation

CVE-2026-26304 is an incorrect authorization vulnerability in Mattermost Server that allows authenticated team members to create unauthorized playbook runs by submitting requests with an empty playbookId parameter. It affects Mattermost Server versions 11.2.0–11.2.2 and 11.3.0, and was published on March 16, 2026 (Mattermost Advisory ID: MMSA-2025-00542). The vulnerability carries a CVSS v3.1 base score of 4.3 (Medium) (Mattermost Security, ENISA EUVD).

The root cause is an incorrect authorization check (CWE-863) in the Mattermost playbook run API. When a request is submitted with an empty playbookId, the server fails to verify the run_create permission, bypassing the intended access control gate. An authenticated team member with low privileges can exploit this over the network without user interaction by crafting a playbook run API request with an empty playbookId field. No public proof-of-concept or detailed technical write-up has been identified beyond the vendor advisory (Mattermost Security, ENISA EUVD).

Successful exploitation allows low-privileged authenticated team members to bypass run_create permission controls and create playbook runs they are not authorized to initiate, compromising data integrity within the Mattermost Playbooks feature. There is no confidentiality or availability impact; the scope is limited to unauthorized modification of playbook run data. The vulnerability does not enable lateral movement or sensitive data exposure beyond the playbook context (Mattermost Security).

1. Authentication: Log in to a vulnerable Mattermost instance (versions 11.2.0–11.2.2 or 11.3.0) as any team member, even one without run_create permissions on any playbook.
2. Craft API request: Construct an HTTP POST request to the Mattermost playbook run API endpoint (e.g., /plugins/playbooks/api/v0/runs) with a JSON body that includes an empty string or null value for the playbookId field.
3. Submit request: Send the crafted request with a valid session token. The server skips the run_create permission check when playbookId is empty, allowing the request to proceed.
4. Unauthorized run created: The server creates a new playbook run without validating the caller's authorization, resulting in an unauthorized entry in the playbook run data (Mattermost Security, ENISA EUVD).

• Logs: Mattermost server logs showing POST requests to /plugins/playbooks/api/v0/runs from users who do not have run_create permissions on any playbook; log entries with empty or null playbookId values in playbook run creation events.
• Application Data: Unexpected or anomalous playbook runs appearing in the Mattermost Playbooks dashboard created by users without assigned playbook access.
• Network: Repeated API calls to the playbook run creation endpoint from the same low-privileged user account in a short time window.

Mattermost has released patched versions: 11.2.3 (for the 11.2.x branch) and 11.3.1 (for the 11.3.x branch). Organizations should upgrade immediately to one of these versions. As a temporary workaround prior to patching, administrators should restrict team member access to playbook APIs where possible and monitor playbook run creation logs for unauthorized activity (Mattermost Security).

A brief technical summary was published by Infinit Security at infinitsec.net shortly after disclosure. The vulnerability was also picked up by openSUSE security announcements and Linux security advisory aggregators, indicating routine downstream packaging attention. No significant broader media coverage or notable researcher commentary has been identified beyond standard CVE tracking and vendor advisory channels (openSUSE Security).