PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-4286 Mattermost CVE debrief

CVE-2026-4286 is a low-severity Mattermost authorization issue affecting playbook updates. According to the vendor and NVD data, users with only Manage Playbook Configurations permission could change a playbook’s team through the update API because the application did not verify whether {{team_id}} was being changed. That bypassed the intended manage members restriction for team changes. The affected ranges in the supplied data are Mattermost Server 10.11.0 through 10.11.13 and 11.5.0 through 11.5.1. The issue was published on 2026-05-18 and is not listed as known exploited in the supplied enrichment.

Vendor
Mattermost
Product
Mattermost Server
CVSS
LOW 3.1
CISA KEV
Not listed in stored evidence
Original CVE published
2026-05-18
Original CVE updated
2026-05-18
Advisory published
2026-05-18
Advisory updated
2026-05-18

Who should care

Mattermost administrators, security teams, and anyone delegating Playbook Configuration permissions should review this issue, especially in deployments that separate playbook management from team membership control.

Technical summary

The flaw is an authorization check failure tied to playbook updates: the system did not confirm whether team_id was being modified before accepting the request. As a result, a user who could manage playbook configurations could alter a playbook’s team association even without the broader permissions normally required for team/member management. NVD lists the weakness as CWE-863 (Incorrect Authorization).

Defensive priority

Low, but patch promptly during normal maintenance if your Mattermost deployment uses playbooks and grants Manage Playbook Configurations to non-admin users.

Recommended defensive actions

  • Upgrade Mattermost Server to a fixed release: 10.11.14 or later, or 11.5.2 or later.
  • Review which users or roles have Manage Playbook Configurations permission and reduce it where practical.
  • Audit playbook configuration changes, especially any team reassignment activity, for unexpected modifications.
  • Validate that team membership and playbook configuration permissions are still separated as intended in your deployment.
  • Monitor vendor security updates and confirm all affected instances are updated consistently.

Evidence notes

Based only on the supplied NVD record and the linked Mattermost security updates reference. NVD marks the CVE as analyzed with CVSS 3.1 vector CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N and lists vulnerable CPE ranges for Mattermost Server 10.11.0-10.11.13 and 11.5.0-11.5.1. The supplied vendor reference identifies CWE-863. No KEV listing was provided in the source corpus.

Official resources

Published by NVD on 2026-05-18; modified on 2026-05-18. Vendor advisory was referenced in the supplied record on the same date.