Missing property field ownership validation in Playbooks run property update endpoint

Description

Mattermost versions 11.9.x <= 11.9.0, 11.8.x <= 11.8.4, 11.7.x <= 11.7.7, 10.11.x <= 10.11.22 fail to validate that a property field belongs to the specified run before updating its value which allows an authenticated user with run property-management access to crash the Playbooks plugin via a REST request referencing a property field that belongs to a different run. Mattermost Advisory ID: MMSA-2026-00684

Scores

EPSS (exploitation in 30 days)

0.37% · top 69% of all CVEs (6 Nov 2026)

CISA SSVC

Exploitation: none · Automatable: no · Technical impact: partial

The list uses the assigner's score when there is one, then CISA's, then NVD's: Medium 6.5.

Weakness

• CWE-639: Authorization Bypass Through User-Controlled Key (opens in a new tab)All about CWE-639 and its CVEs

Affected products

• Mattermost · Mattermost

  • affected 11.9.0 – ≤ 11.9.0
  • affected 11.8.0 – ≤ 11.8.4
  • affected 11.7.0 – ≤ 11.7.7
  • affected 10.11.0 – ≤ 10.11.22
  • unaffected 11.10.0
  • unaffected 11.9.1
  • unaffected 11.8.5
  • unaffected 11.7.8
  • unaffected 10.11.23

What to do

Solution: Update Mattermost to versions 11.10.0, 11.9.1, 11.8.5, 11.7.8, 10.11.23 or higher.

References (1)

• MMSA-2026-00684 (opens in a new tab)vendor-advisory

Sources

The same CVE in the primary databases and aggregators, to check against.

• CVE.org record (opens in a new tab)
• CVE List JSON (GitHub) (opens in a new tab)
• NVD (opens in a new tab)
• FIRST EPSS (opens in a new tab)
• OSV.dev (opens in a new tab)
• GitHub Advisories (opens in a new tab)
• CIRCL Vulnerability-Lookup (opens in a new tab)

Badge for a README or a ticket

[![CVE-2026-9812](https://trackcve.app/badge/CVE-2026-9812.svg)](https://trackcve.app/cve/CVE-2026-9812)

Record last updated 14 Sept 2026, 11:19 UTC.