CVE-2026-9812— Missing property field ownership validation in Playbooks run property update endpoint
Quick assessment
Affected
Mattermost Mattermost
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
Mattermost 在以下版本中存在漏洞：11.9.x ≤ 11.9.0、11.8.x ≤ 11.8.4、11.7.x ≤ 11.7.7 以及 10.11.x ≤ 10.11.22。 这些版本在更新属性值之前，未能校验该属性字段是否属于指定的 run（运行实例）。这使得拥有 run 属性管理权限的已认证用户能够通过发送引用了其他 run 的属性字段的 REST 请求，导致 Playbooks 插件崩溃。 Mattermost 安全公告 ID：MMSA-2026-00684
Possible ATT&CK Techniques 1 AI
T1210.004Affected Version Matrix 9
| Vendor | Product | Version Range | Status |
|---|---|---|---|
| Mattermost | Mattermost | 11.9.0≤ 11.9.0 |
affected |
11.8.0≤ 11.8.4 |
affected | ||
11.7.0≤ 11.7.7 |
affected | ||
10.11.0≤ 10.11.22 |
affected | ||
11.10.0 |
unaffected | ||
11.9.1 |
unaffected | ||
11.8.5 |
unaffected | ||
11.7.8 |
unaffected | ||
| … +1 more rows | |||
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-9812
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Missing property field ownership validation in Playbooks run property update endpoint
Source: CVE Program / CVE List V5
Vulnerability Description
Mattermost versions 11.9.x <= 11.9.0, 11.8.x <= 11.8.4, 11.7.x <= 11.7.7, 10.11.x <= 10.11.22 fail to validate that a property field belongs to the specified run before updating its value which allows an authenticated user with run property-management access to crash the Playbooks plugin via a REST request referencing a property field that belongs to a different run. Mattermost Advisory ID: MMSA-2026-00684
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Source: CVE Program / CVE List V5
Vulnerability Type
通过用户控制密钥绕过授权机制
Source: CVE Program / CVE List V5
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| Mattermost | Mattermost | 11.9.0 ~ 11.9.0 | - |
|
II. Public POCs for CVE-2026-9812
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-9812
请登录查看更多情报信息。
Same Patch Batch · Mattermost · 2026-09-14 · 16 CVEs total
| CVE-2026-8821 | 7.1 HIGH | Playbooks run owner channel membership permission bypass |
| CVE-2026-12985 | 6.8 MEDIUM | Mattermost DCR redirect URI allowlist bypass via improper URL component validation |
| CVE-2026-15814 | 6.5 MEDIUM | Uploading a crafted image causes excessive memory allocation in the Mattermost Server |
| CVE-2026-5132 | 6.5 MEDIUM | Unbounded zlib decompression in Calls SDP WebSocket messages |
| CVE-2026-91181 | 6.5 MEDIUM | Data Retention Teams Endpoint Leaks Private Team Invite ID |
| CVE-2026-82920 | 5.5 MEDIUM | Mattermost ABAC parent policy bypass via policy update endpoint |
| CVE-2026-10556 | 5.3 MEDIUM | Unauthenticated webhook request with null notification entry could crash the Microsoft Cal |
| CVE-2026-10542 | 5.0 MEDIUM | Playbooks channel action update validation issue |
| CVE-2026-11993 | 4.3 MEDIUM | Fix authenticated members disabling file content indexing server-wide via extraction pool |
| CVE-2026-14344 | 4.3 MEDIUM | Inconsistent authorization checks in Mattermost Boards endpoints |
| CVE-2026-14259 | 4.3 MEDIUM | Board archive import bypasses team board creation permissions |
| CVE-2026-12882 | 4.3 MEDIUM | Mattermost Markdown autolink parsing denial of service |
| CVE-2026-13417 | 4.3 MEDIUM | Boards plugin denial of service via unvalidated block fields.properties |
| CVE-2026-86348 | 4.3 MEDIUM | MS Calendar plugin: unrecovered handler panics from malformed post-action requests could c |
| CVE-2026-86349 | 4.3 MEDIUM | Mattermost Server Algorithmic DoS via Unbounded Markdown Block Nesting |
IV. Related Vulnerabilities
Same product: Mattermost
-
CVE-2026-93851
Path traversal in Mattermost Agents plugin mention reminder -
CVE-2026-93846
Team admin can escalate a team member's permissions via the -
CVE-2026-93848
Mattermost OpenID discovery endpoint request bypasses outbou -
CVE-2026-93850
Unbounded memory consumption during PDF text extraction -
CVE-2026-93849
Mattermost allows authenticated users to trigger excessive m
Same vendor: Mattermost
-
CVE-2026-93851
Path traversal in Mattermost Agents plugin mention reminder -
CVE-2026-93846
Team admin can escalate a team member's permissions via the -
CVE-2026-93848
Mattermost OpenID discovery endpoint request bypasses outbou -
CVE-2026-93850
Unbounded memory consumption during PDF text extraction -
CVE-2026-93849
Mattermost allows authenticated users to trigger excessive m
Same weakness: CWE-639
-
CVE-2026-119325
Bricks Theme Broken Access Control via load_popup_content -
CVE-2026-118760
Kubeflow Pipelines: Missing namespace authorization permits -
CVE-2026-118084
WordPress Hotel Booking plugin <= 3.8 - Insecure Direct Obje -
CVE-2026-42691
WordPress EventPrime plugin <= 4.3.6.0 - Broken Access Contr -
CVE-2026-115706
Authorization Bypass Through User-Controlled Key in Elastic