MEDIUM
Unscoped updates to other playbooks' metric configuration
Published Jul 13, 2026
4.3
MEDIUMCVSS 3.1
EPSS 0.25%
Description
Mattermost versions 11.7.x <= 11.7.1, 11.6.x <= 11.6.4, 10.11.x <= 10.11.19 fail to restrict metric configuration changes to the playbook being saved, which allows an authenticated user with team access to alter another user’s playbook metric settings via a crafted import or update request with a foreign metric ID. Mattermost Advisory ID: MMSA-2026-00653
Affected products
-
- Version 10.11.0StatusaffectedConstraints<=10.11.19
- Version 11.6.0StatusaffectedConstraints<=11.6.4
- Version 11.7.0StatusaffectedConstraints<=11.7.1
- Version 10.11.20StatusunaffectedConstraints-
- Version 11.6.5StatusunaffectedConstraints-
- Version 11.7.2StatusunaffectedConstraints-
- Version 11.8.0StatusunaffectedConstraints-
- Version
Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).
| Vendor | Product | Default status | Versions | ||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| Mattermost | Mattermost | unaffected |
|
OR
- ≥ 10.11.0 · < 10.11.20
- ≥ 11.6.0 · < 11.6.5
- ≥ 11.7.0 · < 11.7.2
No data.
No Red Hat product state for this CVE.
No package ranges for this CVE.
Remediation
Vendor solution
Update Mattermost to versions 11.8.0, 11.7.2, 11.6.5, 10.11.20 or higher.
Weaknesses (1)
References (2)
- https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-43341 Advisory
- https://mattermost.com/security-updates vendor-advisoryVendor Advisory
| Link | Providers | Tags |
|---|---|---|
| https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-43341 | Advisory | |
| https://mattermost.com/security-updates | vendor-advisoryVendor Advisory |
Change history (0)
No recorded changes yet.
Sources
CVE.org / MITRE
Status PUBLISHED
Assigner Mattermost
Published Jul 13, 2026
Updated Jul 13, 2026
Reserved Apr 17, 2026
Link CVE-2026-6541
CISA Vulnrichment
Updated Jul 13, 2026
ENISA EUVD
EUVD-2026-43341 Assigner Mattermost
Published Jul 13, 2026
Updated Jul 13, 2026
Exploited since n/a
Link EUVD-2026-43341