CVE-2026-9812
Received Received - Intake

Memory Corruption in Mattermost Playbooks Plugin

Publication date: 2026-09-14

Last updated on: 2026-09-14

Assigner: Mattermost, Inc.

Description
Mattermost versions 11.9.x <= 11.9.0, 11.8.x <= 11.8.4, 11.7.x <= 11.7.7, 10.11.x <= 10.11.22 fail to validate that a property field belongs to the specified run before updating its value which allows an authenticated user with run property-management access to crash the Playbooks plugin via a REST request referencing a property field that belongs to a different run. Mattermost Advisory ID: MMSA-2026-00684

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-14
Last Modified
2026-09-14
Generated
2026-09-14
AI Q&A
2026-09-14
EPSS Evaluated
N/A
NVD
CVE-2026-9812
EUVD
EUVD-2026-77374

Affected Vendors & Products

Showing 4 associated CPEs
Vendor Product Version / Range
mattermost playbooks_plugin to 11.9.0 (inc)
mattermost playbooks_plugin to 11.8.4 (inc)
mattermost playbooks_plugin to 11.7.7 (inc)
mattermost playbooks_plugin to 10.11.22 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-639 The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability affects Mattermost versions 11.9.x <= 11.9.0, 11.8.x <= 11.8.4, 11.7.x <= 11.7.7, and 10.11.x <= 10.11.22. It allows an authenticated user with run property-management access to crash the Playbooks plugin by sending a REST request that references a property field belonging to a different run.

Detection Guidance

This vulnerability can be detected by checking Mattermost server logs for unusual REST requests targeting the Playbooks plugin that reference property fields from different runs. Look for crashes or errors in the Playbooks plugin logs.

Impact Analysis

An attacker could exploit this to cause a denial of service by crashing the Playbooks plugin, disrupting workflows for users with run property-management access. The impact is limited to plugin instability and potential service interruption.

Mitigation Strategies

Upgrade Mattermost to a version that fixes this issue (11.9.1 or later, 11.8.5 or later, 11.7.8 or later, or 10.11.23 or later). Restrict run property-management access to trusted users only.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-9812. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart