PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-4286 Mattermost CVE debrief

CVE-2026-4286 is a low-severity Mattermost authorization issue affecting playbook updates. According to the vendor and NVD data, users with only Manage Playbook Configurations permission could change a playbook’s team through the update API because the application did not verify whether {{team_id}} was being changed. That bypassed the intended manage members restriction for team changes. The affected ranges in the supplied data are Mattermost Server 10.11.0 through 10.11.13 and 11.5.0 through 11.5.1. The issue was published on 2026-05-18 and is not listed as known exploited in the supplied enrichment.

Vendor
Mattermost
Product
Mattermost Server
CVSS
LOW 3.1
CISA KEV
Not listed in stored evidence
Original CVE published
2026-05-18
Original CVE updated
2026-05-18
Advisory published
2026-05-18
Advisory updated
2026-05-18

Who should care

Mattermost administrators, security teams, and anyone delegating Playbook Configuration permissions should review this issue, especially in deployments that separate playbook management from team membership control.

Technical summary

The flaw is an authorization check failure tied to playbook updates: the system did not confirm whether team_id was being modified before accepting the request. As a result, a user who could manage playbook configurations could alter a playbook’s team association even without the broader permissions normally required for team/member management. NVD lists the weakness as CWE-863 (Incorrect Authorization).

Defensive priority

Low, but patch promptly during normal maintenance if your Mattermost deployment uses playbooks and grants Manage Playbook Configurations to non-admin users.

Recommended defensive actions

  • Upgrade Mattermost Server to a fixed release: 10.11.14 or later, or 11.5.2 or later.
  • Review which users or roles have Manage Playbook Configurations permission and reduce it where practical.
  • Audit playbook configuration changes, especially any team reassignment activity, for unexpected modifications.
  • Validate that team membership and playbook configuration permissions are still separated as intended in your deployment.
  • Monitor vendor security updates and confirm all affected instances are updated consistently.

Evidence notes

Based only on the supplied NVD record and the linked Mattermost security updates reference. NVD marks the CVE as analyzed with CVSS 3.1 vector CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N and lists vulnerable CPE ranges for Mattermost Server 10.11.0-10.11.13 and 11.5.0-11.5.1. The supplied vendor reference identifies CWE-863. No KEV listing was provided in the source corpus.

Sources and references

Verified primary and authoritative sources

  • CVE-2026-4286 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-4286

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-4286 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-4286

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.