CVE-2026-6343: Mattermost doesn't check public/private permissions

May 18, 2026 (updated June 1, 2026)

Mattermost versions 11.5.x <= 11.5.1, 10.11.x <= 10.11.13, 11.4.x <= 11.4.3 fail to check public/private permissions which allows members without these permissions to access public playbooks via /get.. Mattermost Advisory ID: MMSA-2026-00591

References

github.com/advisories/GHSA-m79q-8qf5-v622
github.com/mattermost/mattermost-plugin-playbooks/commit/887d9cacb61655d40f20ad9d6e35b408a127c380
mattermost.com/security-updates
nvd.nist.gov/vuln/detail/CVE-2026-6343

Code Behaviors & Features

Detect and mitigate CVE-2026-6343 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →