3.1

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-4286

CVE-2026-4286: Mattermost doesn't check if {{team_id}} was being changed when updating playbooks

Mattermost versions 11.5.x <= 11.5.1, 10.11.x <= 10.11.13 fail to check if {{team_id}} was being changed when updating playbooks, allowing users with only {{Manage Playbook Configurations}} permission to change a playbook's team, bypassing manage members restriction via PUT api. Mattermost Advisory ID: MMSA-2025-00552

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-4286

CVE-2026-4286:

3.1

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
github.com/mattermost/mattermost/server/v8	go	>= 11.5.0, < 11.5.2	11.5.2
github.com/mattermost/mattermost/server/v8	go	>= 10.11.0, < 10.11.14	10.11.14
github.com/mattermost/mattermost-plugin-playbooks	go	< 1.41.1-0.20260213020129-e1d6ec2c94e6	1.41.1-0.20260213020129-e1d6ec2c94e6

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability allows a user with limited permissions ('Manage Playbook Configurations') to change a playbook's team, an action that should require higher privileges ('Manage Playbook Members'). This is due to a missing authorization check in the playbook update logic. The analysis of the security patch commit e1d6ec2c94e695fb74e0c0c11c0d45e028bb96f3 reveals the exact location of the fix. The file server/app/permissions_service.go was modified to add a new check within the PlaybookModifyWithFixes function. This new code block explicitly verifies if the TeamID of the playbook is being changed. If it is, the function now checks if the user has the PlaybookManageMembers permission and if they have access to the destination team. Before this patch, this check was absent, making the PlaybookModifyWithFixes function the vulnerable component that would appear in a runtime profile during exploitation of this vulnerability via the PUT /plugins/playbooks/api/v0/playbooks/{PLAYBOOK_ID} API endpoint.

Vulnerable functions

app.PermissionsService.PlaybookModifyWithFixes

server/app/permissions_service.go

This function is responsible for applying updates to a playbook. Before the patch, it failed to verify if a user had the necessary permissions to change the `TeamID` of a playbook. An attacker with `Manage Playbook Configurations` permission could exploit this by sending a crafted request to the API endpoint that calls this function, thereby moving a playbook to a different team without having the required `Manage Playbook Members` permission.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.