CVE-2026-9812: Missing property field ownership validation in Playbooks run property update endpoint
Mattermost versions 11.9.x <= 11.9.0, 11.8.x <= 11.8.4, 11.7.x <= 11.7.7, 10.11.x <= 10.11.22 fail to validate that a property field belongs to the specified run before updating its value which allows an authenticated user with run property-management access to crash the Playbooks plugin via a REST request referencing a property field that belongs to a different run. Mattermost Advisory ID: MMSA-2026-00684
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Mattermost (Playbooks plugin)to a version that resolves this vulnerability.Fixed in 11.10.0 - Upgrade
Upgrade
Mattermost (Playbooks plugin)to a version that resolves this vulnerability.Fixed in 11.9.1 - Upgrade
Upgrade
Mattermost (Playbooks plugin)to a version that resolves this vulnerability.Fixed in 11.8.5 - Upgrade
Upgrade
Mattermost (Playbooks plugin)to a version that resolves this vulnerability.Fixed in 11.7.8 - Upgrade
Upgrade
Mattermost (Playbooks plugin)to a version that resolves this vulnerability.Fixed in 10.11.23
Event History
Frequently Asked Questions
Who can exploit this issue?
An attacker must be authenticated and have run property-management access in Mattermost Playbooks. The attack can be performed remotely through a REST request, with no user interaction required.
What is the practical impact?
A user with the required access can cause the Playbooks plugin to crash by updating a property field using a field that belongs to a different run. The reported impact is denial of service; no confidentiality or integrity impact is specified.
Which releases are affected?
Affected versions are Mattermost 11.9.0 and earlier in the 11.9.x line, 11.8.4 and earlier in 11.8.x, 11.7.7 and earlier in 11.7.x, and 10.11.22 and earlier in 10.11.x.