Mattermost (affected: 11.5.x through 11.5.1) has an authorization flaw that lets an authenticated user create a “playbook run” in a team they do not have permission to access. In plain terms, the server fails to correctly verify that the user’s “run_create” permission applies to the specific target team when the user creates a playbook run, allowing the user to supply a different team ID in the run creation API request.
The root cause is a missing/incorrect permission validation at the team level during playbook run creation. Specifically, Mattermost versions 11.5.x <= 11.5.1 “fail to validate team-level run_create permission against the target team” when creating a playbook run. The attack vector is network-based and requires authentication (PR:L). The exploitation mechanism is an API request manipulation: an authenticated team member can create playbook runs in teams where they lack permission by specifying a different team ID in the run creation API request, causing the authorization check to be bypassed for the intended target team.
Impact is limited to authorization bypass for playbook run creation (no direct confidentiality or availability impact is indicated by the CVSS vector: C:N, A:N). The attacker can cause integrity impact (I:L) by creating playbook runs in unauthorized teams. The blast radius is constrained to the ability to create playbook runs in other teams, affecting only authenticated users who can reach the relevant API endpoint and craft the request. The reported severity is medium with CVSS 4.3 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N), indicating a low-complexity, authenticated authorization bypass with limited impact.
Mitigation: upgrade Mattermost to a fixed version that addresses MMSA-2026-00629. The provided reference content does not include the exact patched version number, so the specific upgrade target cannot be stated from the supplied material. As a workaround/detection guidance based on the described behavior, administrators should review and monitor playbook run creation API requests for cases where the requested team ID does not match the teams the authenticated user is authorized to manage (i.e., unexpected team_id values in run creation requests). If you have access to API logs, alert on repeated or anomalous run_create attempts targeting teams outside the user’s permitted scope.
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
CWE-863