CVE-2026-9812

MediumCVSS 6.5

Published: 14/09/2026(UTC)Updated: 06/10/2026(UTC)Translated: 14/09/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.37%

28th percentile - higher than 28% of all known CVEs

Summary

Mattermost versions 11.9.x <= 11.9.0, 11.8.x <= 11.8.4, 11.7.x <= 11.7.7, 10.11.x <= 10.11.22 fail to validate that a property field belongs to the specified run before updating its value. An authenticated user with run property-management access can crash the Playbooks plugin via a REST request referencing a property field that belongs to a different run.

Risk Assessment

An authenticated attacker with the relevant permissions can crash the Playbooks plugin, causing denial of service for users of that feature. The risk applies to Mattermost instances with the Playbooks plugin in the listed versions.

Recommendation

Update Mattermost to a version containing the fix (per advisory MMSA-2026-00684). Restrict run property-management permissions to trusted users.

Other vulnerabilities in Mattermost Playbooks

CVE-2024-47401Medium
Mattermost versions 9.10.x <= 9.10.2, 9.11.x <= 9.11.1 and 9.5.x <= 9.5.9 fail to prevent detailed error messages from being displayed in Playbooks. An attacker can send a specially crafted request to Playbooks to generate a large response and cause an amplified GraphQL response, potentially crashing the application.

Original NVD description (English source)

Mattermost versions 11.9.x <= 11.9.0, 11.8.x <= 11.8.4, 11.7.x <= 11.7.7, 10.11.x <= 10.11.22 fail to validate that a property field belongs to the specified run before updating its value which allows an authenticated user with run property-management access to crash the Playbooks plugin via a REST request referencing a property field that belongs to a different run. Mattermost Advisory ID: MMSA-2026-00684

Vulnerability data from NVD (NIST) · CISA KEV · EPSS