Description

Mattermost versions 11.7.x <= 11.7.6, 10.11.x <= 10.11.21 fail to enforce run-state validation on write operations for finished playbook runs which allows a run participant to modify status, checklists, retrospective content, ownership, and participants on completed runs via REST and GraphQL API requests. Mattermost Advisory ID: MMSA-2026-00675

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "4.3",
  "pubDate": "2026-08-17T15:16:54.083Z",
  "pubdate": "2026-08-17T15:16:54.083Z",
  "executiveSummary": "A missing authorization and run-state validation vulnerability exists in Mattermost playbook implementations across multiple product versions. Specifically, the flaw affects Mattermost versions 11.7.x through 11.7.6 and 10.11.x through 10.11.21. The vulnerability arises because the application fails to enforce proper run-state validation checks on write operations targeting finished playbook runs. Consequently, authenticated users with standard run participant privileges can successfully issue unauthorized write requests to modify sensitive attributes of completed runs, including status values, checklists, retrospective contents, ownership assignments, and participant rosters. The attack vector involves interacting directly with exposed REST and GraphQL APIs designated for playbook management. This security failure undermines the integrity of completed operational workflows and audit trails within the platform, allowing malicious or compromised participants to alter historical incident data and state records post-completion. Exploitation requires authenticated access as a run participant, meaning an attacker must possess baseline privileges within a specific playbook run context but does not require administrative authorization. Mitigating this risk requires updating affected Mattermost deployments to patched versions where strict run-state validation is enforced on all write operations.",
  "technicalDetails": "The vulnerability stems from inadequate backend access control logic and missing state-validation predicates within the Mattermost playbook subsystem. The vulnerable components are responsible for handling write operations for playbook runs exposed via REST and GraphQL API endpoints. Under expected application behavior, once a playbook run reaches a terminal state (finished or completed), write operations modifying critical run metadata—such as operational status, dynamic checklists, retrospective documentation, ownership assignments, and participant lists—should be strictly prohibited to maintain data integrity and prevent unauthorized post-hoc tampering.\nRoot Cause: The API controllers and underlying service logic processing write requests fail to verify the current lifecycle state of the target playbook run before executing state-mutating database transactions. Specifically, the authorization checks validate whether the requesting user is a run participant, but they omit validation checks confirming whether the run is actively ongoing or already finalized.\nExploitation Method: An authenticated attacker possessing standard run participant privileges can craft targeted HTTP requests directed at the REST or GraphQL API. By bypassing client-side interface constraints and directly submitting malicious payloads to write-enabled endpoints for finished runs, the user can manipulate immutable historical records. The attack payload specifies modifications to parameters governing run status, checklist items, retrospective text, owner identifiers, and participant arrays.\nAttack Flow: 1. The attacker identifies or joins a playbook run as a standard participant. 2. The playbook run is subsequently concluded or reaches a finished state. 3. The attacker intercepts or constructs API requests targeting the finished run via REST or GraphQL interfaces. 4. The attacker transmits parameters to alter restricted fields such as checklists or retrospectives. 5. The vulnerable backend processes the request without validating the run-state, applying the unauthorized modifications to the finished run database record.\nAuthentication and Privileges: The attack requires valid authentication and low-privileged access as a run participant. Network exposure encompasses any environment where the Mattermost REST and GraphQL APIs are accessible to authenticated users."
}