Skip to content
Patch Next
Sign inAdd to your agent

← Public intelligence

Go package

github.com/mattermost/mattermost-plugin-playbooks

Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.

Open advisories

3 actionable advisories, newest first. Withdrawn advisories and news are excluded. Coverage is partial.

  1. Low, CVSS 3.1GoPublished

    Mattermost doesn't check if {{team_id}} was being changed when updating playbooks

    CVE-2026-4286 · GHSA-gvg4-jhmr-6j23

    Affected
    • Go github.com/mattermost/mattermost-plugin-playbooks < 1.41.1-0.20260213020129-e1d6ec2c94e6
    Fixed in
    1.41.1-0.20260213020129-e1d6ec2c94e6· Vendor fix available
    Issue
    Mattermost versions 11.5.x <= 11.5.1, 10.11.x <= 10.11.13 fail to check if {{teamid}} was being changed when updating playbooks, allowing users with only {{Manage Playbook Configurations}} permission to change a playbook's team, bypassing manage members restriction via PUT api. Mattermost Advisory ID: MMSA-2025-00552

    Recommended action: Upgrade to 1.41.1-0.20260213020129-e1d6ec2c94e6 (pre-release) or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.

    Sources:github.comSource checked Evidence →
  2. Medium, CVSS 4.3GoPublished

    Mattermost doesn't check public/private permissions

    CVE-2026-6343 · GHSA-m79q-8qf5-v622

    Affected
    • Go github.com/mattermost/mattermost-plugin-playbooks < 1.41.1-0.20260309184833-887d9cacb616
    Fixed in
    1.41.1-0.20260309184833-887d9cacb616· Vendor fix available
    Issue
    Mattermost versions 11.5.x <= 11.5.1, 10.11.x <= 10.11.13, 11.4.x <= 11.4.3 fail to check public/private permissions which allows members without these permissions to access public playbooks via /get.. Mattermost Advisory ID: MMSA-2026-00591

    Recommended action: Upgrade to 1.41.1-0.20260309184833-887d9cacb616 (pre-release) or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.

    Sources:github.comSource checked Evidence →
  3. Medium, CVSS 4.3GoPublished

    Mattermost fails to verify run_create permission for empty playbookId

    CVE-2026-26304 · GHSA-4pmx-622h-x359

    Affected
    • Go github.com/mattermost/mattermost-plugin-playbooks < 1.41.1-0.20260316224925-705f54a81841
    Fixed in
    1.41.1-0.20260316224925-705f54a81841· Vendor fix available
    Issue
    Mattermost versions 11.3.x <= 11.3.0, 11.2.x <= 11.2.2 fail to verify runcreate permission for empty playbookId, which allows team members to create unauthorized runs via the playbook run API. Mattermost Advisory ID: MMSA-2025-00542

    Recommended action: Upgrade to 1.41.1-0.20260316224925-705f54a81841 (pre-release) or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.

    Sources:github.comSource checked Evidence →