Description
Mattermost versions 11.5.x <= 11.5.1 fail to validate team-level run_create permission against the target team when creating a playbook run which allows an authenticated team member to create runs in teams where they lack permission via specifying a different team ID in the run creation API request. Mattermost Advisory ID: MMSA-2026-00629
Problem types
CWE-863: Incorrect Authorization
Product status
11.5.0 (semver)
11.6.0
11.5.2
10.11.14
11.4.4
Credits
0x7oda7123
References
mattermost.com/security-updates (MMSA-2026-00629)