CVE-2026-26304: Mattermost fails to verify run_create permission for empty playbookId

March 16, 2026 (updated March 20, 2026)

Mattermost versions 11.3.x <= 11.3.0, 11.2.x <= 11.2.2 fail to verify run_create permission for empty playbookId, which allows team members to create unauthorized runs via the playbook run API. Mattermost Advisory ID: MMSA-2025-00542

References

github.com/advisories/GHSA-4pmx-622h-x359
github.com/mattermost/mattermost-plugin-playbooks
github.com/mattermost/mattermost-plugin-playbooks/commit/705f54a818410f3612df3865bfde608ed471037e
mattermost.com/security-updates
nvd.nist.gov/vuln/detail/CVE-2026-26304

Code Behaviors & Features

Detect and mitigate CVE-2026-26304 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →