Description

Mattermost versions 11.9.x <= 11.9.0, 11.8.x <= 11.8.4, 11.7.x <= 11.7.7, 10.11.x <= 10.11.22 fail to validate that a property field belongs to the specified run before updating its value which allows an authenticated user with run property-management access to crash the Playbooks plugin via a REST request referencing a property field that belongs to a different run. Mattermost Advisory ID: MMSA-2026-00684

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.5",
  "pubDate": "2026-09-14T11:17:08.393Z",
  "pubdate": "2026-09-14T11:17:08.393Z",
  "executiveSummary": "A critical validation vulnerability exists in the Mattermost Playbooks plugin affecting multiple release branches (11.9.x, 11.8.x, 11.7.x, and 10.11.x). The flaw is characterized as an Improper Input Validation vulnerability within the property management subsystem.\nThe vulnerability allows an authenticated user, possessing only run property-management privileges, to bypass object ownership checks. By supplying a maliciously crafted REST request, an attacker can reference property fields belonging to arbitrary runs, forcing the application to perform operations on objects outside the user's authorized scope.\nThe primary impact of this vulnerability is a Denial of Service (DoS) condition, which triggers a crash of the Playbooks plugin service. This interruption degrades the operational integrity of the Mattermost environment by rendering the Playbooks functionality unavailable. Exploitation requires the attacker to have an active session with specific, albeit non-administrative, permissions. As this is a logic-based flaw involving cross-run resource reference, it represents a significant risk to service availability and internal data integrity within the plugin's ecosystem.",
  "technicalDetails": "The root cause of this vulnerability lies in the failure of the Mattermost Playbooks plugin to enforce server-side validation regarding the relationship between a property field and its host run object. During the update lifecycle of a property field, the application logic fails to cryptographically or logically verify that the submitted property ID is strictly bound to the specific run ID specified in the API request context.\nWhen a user initiates an update request, the API endpoint fails to validate the ownership hierarchy. An attacker can leverage this flaw by sending a REST request where the 'run_id' parameter is mismatched with the 'property_id'. The system, expecting a trusted relationship between the provided identifiers, proceeds to process the update. Because the system attempts to interact with an object or memory reference that does not align with the intended operational boundaries, it triggers an unhandled exception within the plugin's execution thread.\nThe attack flow follows these steps: 1) The attacker authenticates to the Mattermost platform with valid credentials that grant them 'run property-management' access. 2) The attacker identifies a target 'property_id' belonging to a run they do not own or are not authorized to modify. 3) The attacker crafts a malicious REST payload that includes their authorized 'run_id' but substitutes the target's 'property_id'. 4) The plugin backend processes this request, failing to perform the necessary cross-reference check between the property and the run. 5) The invalid pointer or mismatched state object triggers a runtime crash of the Playbooks plugin process, leading to a localized DoS condition.\nThe affected versions include: Mattermost 11.9.x <= 11.9.0, 11.8.x <= 11.8.4, 11.7.x <= 11.7.7, and 10.11.x <= 10.11.22. The exposure is limited to the Playbooks plugin component within the Mattermost ecosystem. Because the application crashes upon processing the malformed request, the post-exploitation impact includes the total loss of plugin functionality for all users until the service is manually restarted or recovered by the platform orchestrator. This vulnerability does not currently facilitate remote code execution, but the ease of triggering a system-wide plugin crash highlights a critical deficiency in access control enforcement and object association validation."
}