Vulnerability in Mattermost Team Management Permissions

CVE-2026-4055

What is CVE-2026-4055?

Mattermost versions 11.5.x up to and including 11.5.1 exhibit a security flaw in validating permissions for team-level actions. Specifically, the issue arises when an authenticated team member can create playbook runs in teams for which they do not possess the necessary permissions. This exploitation occurs via the run creation API, where a different team ID can be specified, potentially allowing unauthorized access to functionalities intended for a different team. Users are advised to update to a patched version to mitigate this risk. For further details, refer to the advisory at the vendor's security updates page.

References