CVE-2026-26304: Permission Bypass in Playbook Run Creation

Q: What is the severity of CVE-2026-26304?

CVE-2026-26304 has been classified as a critical severity vulnerability due to its impact on unauthorized playbook run creation.

Q: How do I fix CVE-2026-26304?

To fix CVE-2026-26304, upgrade Mattermost to version 11.3.1 or later, or 11.2.3 or later.

Q: Which Mattermost versions are affected by CVE-2026-26304?

CVE-2026-26304 affects Mattermost versions 11.3.x up to 11.3.0 and 11.2.x up to 11.2.2.

Q: What is the impact of CVE-2026-26304?

CVE-2026-26304 allows team members to bypass permission checks and create unauthorized runs, compromising playbook integrity.

Q: Is there a workaround for CVE-2026-26304?

No official workaround exists for CVE-2026-26304; upgrading is the only recommended solution.

Published Mar 16, 2026

Updated

Mattermost versions 11.3.x <= 11.3.0, 11.2.x <= 11.2.2 fail to verify runcreate permission for empty playbookId, which allows team members to create unauthorized runs via the playbook run API. Mattermost Advisory ID: MMSA-2025-00542

Affected Software

3 affected components

Mattermost Mattermost<=11.3.0, <=11.2.2

Mattermost Mattermost Server>=11.2.0<11.2.3

Mattermost Mattermost Server>=11.3.0<11.3.1

Remediation

Information

Update Mattermost to versions 11.4.0, 11.3.1, 11.2.3 or higher.

Event History

Mar 16, 2026

CVE Published

via MITRE·07:53 PM

Data Sourced

via MITRE·07:53 PM

RemedyDescriptionSeverityWeakness

Data Sourced

via NVD·08:16 PM

DescriptionSeverityWeaknessAffected Software

Frequently Asked Questions

What is the severity of CVE-2026-26304?

CVE-2026-26304 has been classified as a critical severity vulnerability due to its impact on unauthorized playbook run creation.

How do I fix CVE-2026-26304?