CVE-2026-6541

MediumCVSS 4.3/10Last modified Jul 13, 2026

Description

Mattermost versions 11.7.x <= 11.7.1, 11.6.x <= 11.6.4, 10.11.x <= 10.11.19 fail to restrict metric configuration changes to the playbook being saved, which allows an authenticated user with team access to alter another user’s playbook metric settings via a crafted import or update request with a foreign metric ID. Mattermost Advisory ID: MMSA-2026-00653

Metrics

CVSS 3.1 4.3/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

Weakness enumeration

CWE-639

Affected software

Vendor	Product	Versions
Mattermost	Mattermost	>= 11.7.0, <= 11.7.1; >= 11.6.0, <= 11.6.4; >= 10.11.0, <= 10.11.19

References

https://mattermost.com/security-updatesVendor Advisory

Timeline

Published: Jul 13, 2026
Last modified: Jul 13, 2026
NVD status: Analyzed

Related CVEs from 2026

CVE-2026-654107.5The issue was addressed with improved checks. This issue is fixed in iOS 26.7 and iPadOS 26.7, iOS 27 and iPadOS 27, macOS Golden Gate 27, m CVE-2026-654115.5A path handling issue was addressed with improved validation. This issue is fixed in iOS 26.7 and iPadOS 26.7, iOS 27 and iPadOS 27, visionO CVE-2026-654126.5A null pointer dereference was addressed with improved input validation. This issue is fixed in iOS 26.7 and iPadOS 26.7, iOS 27 and iPadOS CVE-2026-654135.5An integer overflow was addressed with improved input validation. This issue is fixed in macOS Golden Gate 27, macOS Sequoia 15.8, macOS Tah CVE-2026-654149.8An out-of-bounds write issue was addressed with improved bounds checking. This issue is fixed in iOS 26.7 and iPadOS 26.7, iOS 27 and iPadOS CVE-2026-654158.1A race condition was addressed with additional validation. This issue is fixed in iOS 27 and iPadOS 27, macOS Golden Gate 27, tvOS 27, visio CVE-2026-65428.1IBM Langflow OSS 1.0.0 through 1.8.4 could allow any user to supply a flow_id to read transaction logs and vertex build data belonging to ot CVE-2026-654216.5The MMS BER decoder contains a flaw in decoding fixed-width BER fields (boolean/integer): an attacker-supplied length value is not validate CVE-2026-654226.5A flaw in the authorization mechanism for Media Gateway API in Genetec Security Center may allow a user with no playback privileges to gener CVE-2026-654238.8An integer overflow in the UA_Variant arrayDimensions product computation in open62541 may allow a remote attacker to trigger an out-of-bo CVE-2026-65438.8IBM Langflow Desktop 1.0.0 through 1.8.4 Langflow allows an attacker to execute arbitrary commands with the privileges of the process runnin CVE-2026-654307.5Joomla Extension - regularlabs.com - MaxMind Credential leakage in GeoIP extension - MaxMind credentials where leaked in request URLs, causi