CVE-2026-6343

MediumCVSS 4.3/10Last modified Oct 14, 2026

Description

Mattermost versions 11.5.x <= 11.5.1, 10.11.x <= 10.11.13, 11.4.x <= 11.4.3 fail to check public/private permissions which allows members without these permissions to access public playbooks via /get.. Mattermost Advisory ID: MMSA-2026-00591

Metrics

CVSS 3.1 4.3/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Weakness enumeration

CWE-863

Affected software

Vendor	Product	Versions
Mattermost	Mattermost	>= 11.5.0, <= 11.5.1; >= 10.11.0, <= 10.11.13; >= 11.4.0, <= 11.4.3

References

https://mattermost.com/security-updatesVendor Advisory

Timeline

Published: May 18, 2026
Last modified: Oct 14, 2026
NVD status: Analyzed

Related CVEs from 2026

CVE-2026-634306.3ammonia is a Rust library for repairing and securing untrusted HTML. Prior to 3.3.2, 4.0.2, and 4.1.3, applications that explicitly allow th CVE-2026-634316.5Horilla is an HR and CRM software. In 1.5.0-85 and earlier, payroll/views/component_views.py does not consistently authorize access in allow CVE-2026-634326.5Horilla is an HR and CRM software. From 1.0.0 until 1.6.0 and 2.0.0, the get_mail_preview handlers in recruitment/views/actions.py and emplo CVE-2026-634336.8MyTube is a self-hosted downloader and player for several video websites. Prior to 1.10.6, shouldSkipCsrfProtection() in backend/src/middlew CVE-2026-634344.3MyTube is a self-hosted downloader and player for several video websites. Prior to 1.10.6, when statisticsEnabled and statisticsTrackVisitor CVE-2026-634355.3Mail is an internet library for Ruby designed to handle email generation, parsing, and sending. Prior to 2.9.1, Mail::Utilities.q_value_deco CVE-2026-634366.1zt-zip is a Java library that provides convenience methods for ZIP archive manipulation. Prior to 1.18.0, the Zips.get(zip).unpack().destina CVE-2026-634376.52FAuth is a web app to manage Two-Factor Authentication (2FA) accounts and generate their security codes. Prior to 8.0.0, the recipients() m CVE-2026-634389.82FAuth is a web app to manage Two-Factor Authentication (2FA) accounts and generate their security codes. Prior to 8.0.0, when AUTHENTICATIO CVE-2026-634399.82FAuth is a web app to manage Two-Factor Authentication (2FA) accounts and generate their security codes. Prior to 8.0.0, when AUTHENTICATIO CVE-2026-63444.9The Fluent Forms plugin for WordPress is vulnerable to Arbitrary File Read in versions up to and including 6.2.1. This is due to insufficien CVE-2026-634405.92FAuth is a web app to manage Two-Factor Authentication (2FA) accounts and generate their security codes. Prior to 8.0.0, the otpauth image-