CVE-2026-9812 in Mattermost
Summary
by MITRE • 09/14/2026
Mattermost versions 11.9.x <= 11.9.0, 11.8.x <= 11.8.4, 11.7.x <= 11.7.7, 10.11.x <= 10.11.22 fail to validate that a property field belongs to the specified run before updating its value which allows an authenticated user with run property-management access to crash the Playbooks plugin via a REST request referencing a property field that belongs to a different run. Mattermost Advisory ID: MMSA-2026-00684
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 09/14/2026
The vulnerability identified in Mattermost versions 11.9.x through 11.7.7, as well as the legacy 10.11.x series up to version 10.11.22, represents a critical logic flaw within the Playbooks plugin architecture. This issue stems from an insufficient validation mechanism when handling updates to property fields associated with workflow runs. Specifically, the application fails to verify that the property field being modified actually belongs to the specific run instance referenced in the REST API request. Instead of enforcing strict ownership or contextual binding between the run identifier and the property schema definition, the system accepts requests where these identifiers are mismatched. This architectural oversight allows an authenticated user who possesses permission to manage run properties to manipulate data outside its intended scope, leading directly to application instability and service disruption.
From a technical perspective, this flaw is classified under CWE-20 Improper Input Validation, as the server does not adequately sanitize or validate the relationship between input parameters before processing them. The attack vector involves sending a crafted REST request that targets a property field belonging to one run while specifying a different run ID in the path or payload. Because the backend logic assumes validity based on user permissions rather than data integrity checks, it attempts to apply updates to incompatible objects within its internal state management system. This mismatch causes unhandled exceptions or memory corruption events within the Go runtime environment powering Mattermost, resulting in the immediate crash of the Playbooks plugin service. The severity is heightened by the fact that authentication is required, but the privilege level needed is relatively low, limited only to run property-management access which is commonly granted to team members involved in workflow coordination.
The operational impact of this vulnerability is significant for organizations relying on Mattermost’s automation and project management features via Playbooks. A successful exploitation results in a Denial of Service condition specifically targeting the plugin subsystem. When the plugin crashes, it not only disrupts ongoing workflows but may also cause instability in the broader application if error handling does not isolate the failure effectively. Users attempting to interact with affected runs will experience service interruptions, and administrators must manually restart or recover the plugin state to restore functionality. This disruption can halt critical business processes that depend on automated notifications, status updates, and task tracking provided by the Playbooks feature set.
Mitigation strategies primarily involve upgrading to a patched version of Mattermost where this validation logic has been corrected. For environments unable to upgrade immediately due to compatibility constraints or operational risks, network-level controls such as Web Application Firewalls can be configured to detect anomalous patterns in REST requests that exhibit mismatched run and property identifiers. Additionally, administrators should review user permissions within the Playbooks plugin, ensuring that only essential personnel have access to manage run properties. Limiting these privileges reduces the attack surface available for exploitation. Regular monitoring of application logs for repeated crash reports or error spikes related to the Playbooks module can also aid in early detection and response to potential abuse attempts.
This vulnerability aligns with MITRE ATT&CK technique T1496, Resource Hijacking, as it allows an attacker to consume system resources through a denial-of-service condition caused by improper input handling. It also reflects CWE-823 Object Reference Without Ownership Validation, highlighting the failure to ensure that operations are performed only on objects owned or authorized for modification by the current context. Addressing this issue requires both immediate patching and long-term architectural reviews of how object relationships are validated in API endpoints to prevent similar logic flaws from emerging in future updates.