Description

Mattermost versions 11.9.x <= 11.9.0, 11.8.x <= 11.8.4, 11.7.x <= 11.7.7, 10.11.x <= 10.11.22 fail to validate channel member-management permission during playbook run creation, allowing an authenticated channel member to add an arbitrary user to a restricted channel via the run owner field.. Mattermost Advisory ID: MMSA-2026-00677

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.1",
  "pubDate": "2026-09-14T11:17:06.153Z",
  "pubdate": "2026-09-14T11:17:06.153Z",
  "executiveSummary": "A critical authorization vulnerability exists within the Mattermost playbook run creation process, identified in advisory MMSA-2026-00677. The vulnerability is classified as an improper access control flaw where the application fails to validate channel member-management permissions.\nThis security weakness allows an authenticated user, who is a member of a channel, to manipulate the 'run owner' field during the initialization of a playbook run. By exploiting this oversight, an attacker can force the addition of arbitrary users to restricted channels, bypassing intended access controls and member-management restrictions.\nThe vulnerability affects multiple branches of Mattermost, specifically versions 11.9.x <= 11.9.0, 11.8.x <= 11.8.4, 11.7.x <= 11.7.7, and 10.11.x <= 10.11.22. The primary risk implication involves unauthorized information disclosure and violation of channel-level access policies. Successful exploitation requires an authenticated session but does not necessitate elevated administrative privileges, making it accessible to any standard channel participant. Organizations relying on Mattermost for secure collaboration or sensitive project management face potential data exposure if unauthorized personnel are granted membership to restricted channels through this vector.",
  "technicalDetails": "The vulnerability resides within the logic governing the creation and initialization of playbook runs. Specifically, the backend fails to perform an authorization check against the user's permissions to manage channel memberships when processing the 'run owner' field during a playbook run creation request.\nIn Mattermost, playbook runs often interface with specific channel architectures. When a user initializes a playbook run, they are permitted to specify an owner for that run. The vulnerability manifests because the API endpoint responsible for creating this run does not verify whether the actor has the necessary 'manage_channel_members' or 'edit_channel' permissions when the system processes the owner-assignment logic. Consequently, the backend logic assumes the input provided in the 'run owner' parameter is authoritative and automatically updates the channel member list to include the specified user if they are not already present.\nThe attack flow is as follows: 1. An authenticated attacker, who is a legitimate member of a target channel, initiates a request to create a new playbook run via the Mattermost API or UI. 2. The attacker crafts a request payload, specifically injecting the User ID of a target victim into the 'run owner' field. 3. The Mattermost server receives the request and proceeds to create the playbook run. 4. Due to the lack of server-side validation regarding member-management permissions, the system grants the target user membership to the channel associated with the playbook run, regardless of whether the channel is restricted or private.\nThis flaw effectively allows an attacker to bypass organizational security policies intended to restrict membership to specific sensitive channels. By manipulating the playbook run metadata, an attacker elevates a target user's privileges to full channel access. Because the application logic fails to validate the context of the 'run owner' field against the channel's current access control list (ACL) or the requester's actual permission level, it creates an insecure state. The impact is significant, as it enables unauthorized access to restricted channel discussions, files, and metadata. No complex payload or advanced exploit techniques are required beyond standard API or interface interaction, as the failure is inherent to the application's core access control enforcement layer during the playbook initialization lifecycle."
}