{"id":"EUVD-2026-30750","enisaUuid":"e352f9ca-08c8-37e5-aef8-330f2cd516c5","description":"Mattermost versions 11.5.x \u003c\u003d 11.5.1, 10.11.x \u003c\u003d 10.11.13 fail to check if {{team_id}} was being changed when updating playbooks, allowing users with only {{Manage Playbook Configurations}} permission to change a playbook\u0027s team, bypassing manage members restriction via PUT api. Mattermost Advisory ID: MMSA-2025-00552","datePublished":"May 18, 2026, 8:07:06 AM","dateUpdated":"May 18, 2026, 12:41:28 PM","baseScore":3.1,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N","references":"https://mattermost.com/security-updates\n","aliases":"CVE-2026-4286\nGHSA-gvg4-jhmr-6j23\n","assigner":"Mattermost","epss":0.14,"enisaIdProduct":[{"id":"54c976f2-66a1-3636-8f44-7cb5f12834c9","product":{"name":"Mattermost","vendor":{"name":"Mattermost"}},"product_version":"11.5.0 ≤11.5.1"},{"id":"6fadcd6c-356e-37ca-ae4f-8f039dc2cc82","product":{"name":"Mattermost","vendor":{"name":"Mattermost"}},"product_version":"10.11.0 ≤10.11.13"}],"enisaIdVendor":[{"id":"8681c884-a8ff-399c-ae49-e55f458cb09f","vendor":{"name":"Mattermost"}}],"enisaIdVulnerability":[{"id":"1555cf4c-f439-37f6-b4e3-1dc6a4c67f6e","vulnerability":{"id":"GHSA-gvg4-jhmr-6j23","description":"Mattermost doesn\u0027t check if {{team_id}} was being changed when updating playbooks","datePublished":"May 18, 2026, 9:31:48 AM","dateUpdated":"Jun 1, 2026, 3:19:14 PM","baseScore":0.0,"references":"https://nvd.nist.gov/vuln/detail/CVE-2026-4286\nhttps://github.com/mattermost/mattermost-plugin-playbooks/commit/e1d6ec2c94e695fb74e0c0c11c0d45e028bb96f3\nhttps://github.com/mattermost/mattermost\nhttps://mattermost.com/security-updates\n","enisa_id":"EUVD-2026-30750\n","aliases":"CVE-2026-4286\nGHSA-gvg4-jhmr-6j23\n","epss":0.0,"dataProcessed":"Oct 25, 2026, 1:55:50 AM","vulnerabilityProduct":[],"vulnerabilityVendor":[]}},{"id":"a41021b6-a70f-3ecb-ad94-cf2e989aa256","vulnerability":{"id":"CVE-2026-4286","description":"Mattermost versions 11.5.x \u003c\u003d 11.5.1, 10.11.x \u003c\u003d 10.11.13 fail to check if {{team_id}} was being changed when updating playbooks, allowing users with only {{Manage Playbook Configurations}} permission to change a playbook\u0027s team, bypassing manage members restriction via PUT api. Mattermost Advisory ID: MMSA-2025-00552","datePublished":"May 18, 2026, 8:07:06 AM","dateUpdated":"May 18, 2026, 12:41:28 PM","status":"PUBLISHED","baseScore":3.1,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N","references":"https://mattermost.com/security-updates\n","enisa_id":"EUVD-2026-30750\n","assigner":"Mattermost","epss":0.14,"dataProcessed":"Oct 27, 2026, 7:17:06 AM","vulnerabilityProduct":[{"id":"13543189-575a-36b3-aeaa-36c636775235","product":{"name":"Mattermost","vendor":{"name":"Mattermost"}},"product_version":"11.5.0 ≤11.5.1"},{"id":"fecb62d3-c9b9-3789-bf15-63de55c60399","product":{"name":"Mattermost","vendor":{"name":"Mattermost"}},"product_version":"10.11.0 ≤10.11.13"}],"vulnerabilityVendor":[{"id":"2ea7842e-c0a9-3721-b1ee-933875c1e18f","vendor":{"name":"Mattermost"}}]}}],"enisaIdAdvisory":[]}