Mattermost fails to verify run_create permission for empty playbookId

概要

参考情報

• nvd.nist.gov/vuln/detail/CVE-2026-26304 · ADVISORY
• mattermost/mattermost-plugin-playbooks commit 705f54a · WEB
• mattermost/mattermost-plugin-playbooks · PACKAGE
• mattermost.com/security-updates · WEB
• GitHub Advisory GHSA-4pmx-622h-x359 · ADVISORY

github.com/mattermost/mattermost-plugin-playbooks のその他の脆弱性

• CVE-2026-6343中 4.3Mattermost versions 11.5.x <= 11.5.1, 10.11.x <= 10.11.13, 11.4.x <= 11.4.3 fail to check public/private permissions which allows members wi…
• CVE-2026-4286中 4.3Mattermost versions 11.5.x <= 11.5.1, 10.11.x <= 10.11.13 fail to check if {{team_id}} was being changed when updating playbooks, allowing u…
• CVE-2025-41423中 4.3Mattermost versions 10.4.x <= 10.4.2, 10.5.x <= 10.5.0, 9.11.x <= 9.11.10 fail to properly validate permissions for the API endpoint /plugin…
• CVE-2025-41395高 7.5Mattermost versions 10.4.x <= 10.4.2, 10.5.x <= 10.5.0, 9.11.x <= 9.11.10 fail to properly validate the props used by the RetrospectivePost …
• CVE-2025-35965高 7.5Mattermost versions 10.4.x <= 10.4.2, 10.5.x <= 10.5.0, 9.11.x <= 9.11.10 fail to validate the uniqueness and quantity of task actions withi…