Vulnerability Details CVE-2026-6541
Mattermost versions 11.7.x <= 11.7.1, 11.6.x <= 11.6.4, 10.11.x <= 10.11.19 fail to restrict metric configuration changes to the playbook being saved, which allows an authenticated user with team access to alter another user’s playbook metric settings via a crafted import or update request with a foreign metric ID. Mattermost Advisory ID: MMSA-2026-00653
Exploit prediction scoring system (EPSS) score
CVSS Severity
CVSS v3 Score 4.3
References
Products affected by CVE-2026-6541
-
cpe:2.3:a:mattermost:mattermost_server:10.11.0
-
cpe:2.3:a:mattermost:mattermost_server:10.11.1
-
cpe:2.3:a:mattermost:mattermost_server:10.11.10
-
cpe:2.3:a:mattermost:mattermost_server:10.11.11
-
cpe:2.3:a:mattermost:mattermost_server:10.11.12
-
cpe:2.3:a:mattermost:mattermost_server:10.11.13
-
cpe:2.3:a:mattermost:mattermost_server:10.11.14
-
cpe:2.3:a:mattermost:mattermost_server:10.11.15
-
cpe:2.3:a:mattermost:mattermost_server:10.11.16
-
cpe:2.3:a:mattermost:mattermost_server:10.11.17
-
cpe:2.3:a:mattermost:mattermost_server:10.11.18
-
cpe:2.3:a:mattermost:mattermost_server:10.11.19
-
cpe:2.3:a:mattermost:mattermost_server:10.11.2
-
cpe:2.3:a:mattermost:mattermost_server:10.11.3
-
cpe:2.3:a:mattermost:mattermost_server:10.11.4
-
cpe:2.3:a:mattermost:mattermost_server:10.11.5
-
cpe:2.3:a:mattermost:mattermost_server:10.11.6
-
cpe:2.3:a:mattermost:mattermost_server:10.11.7
-
cpe:2.3:a:mattermost:mattermost_server:10.11.8
-
cpe:2.3:a:mattermost:mattermost_server:10.11.9
-
cpe:2.3:a:mattermost:mattermost_server:11.6.0
-
cpe:2.3:a:mattermost:mattermost_server:11.6.1
-
cpe:2.3:a:mattermost:mattermost_server:11.6.2
-
cpe:2.3:a:mattermost:mattermost_server:11.6.3
-
cpe:2.3:a:mattermost:mattermost_server:11.6.4
-
cpe:2.3:a:mattermost:mattermost_server:11.7.0
-
cpe:2.3:a:mattermost:mattermost_server:11.7.1