CVE-2026-6343: Mattermost Playbooks Plugin fails to enforce view permissions in list endpoints, allowing unauthorized access to public playbooks
Mattermost versions 11.5.x <= 11.5.1, 10.11.x <= 10.11.13, 11.4.x <= 11.4.3 fail to check public/private permissions which allows members without these permissions to access public playbooks via /get.. Mattermost Advisory ID: MMSA-2026-00591
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Mattermostto a version that resolves this vulnerability.Fixed in 11.6.0 - Upgrade
Upgrade
Mattermostto a version that resolves this vulnerability.Fixed in 11.5.2 - Upgrade
Upgrade
Mattermostto a version that resolves this vulnerability.Fixed in 10.11.14 - Upgrade
Upgrade
Mattermostto a version that resolves this vulnerability.Fixed in 11.4.4
Event History
Frequently Asked Questions
What is the severity of CVE-2026-6343?
CVE-2026-6343 is classified as a high severity vulnerability due to unauthorized access risks.
How do I fix CVE-2026-6343?
To fix CVE-2026-6343, upgrade to Mattermost Playbooks Plugin version 11.5.2 or later for affected versions.
Which versions are affected by CVE-2026-6343?
CVE-2026-6343 affects Mattermost versions 11.5.0 to 11.5.1, 10.11.0 to 10.11.13, and 11.4.0 to 11.4.3.
What does CVE-2026-6343 enable an attacker to do?
CVE-2026-6343 allows unauthorized access to public playbooks in Mattermost due to insufficient permission checks.
Is user data exposed due to CVE-2026-6343?
Yes, CVE-2026-6343 may expose sensitive user data by allowing unauthorized users to access restricted playbooks.