Zero Day MonitorZDM

← Back to list

4.3

CVE-2026-13411PATCHED

mattermost · mattermost

Null condition in Playbooks import crashes the plugin

Description

Mattermost versions 11.7.x <= 11.7.11 fail to validate null elements when decoding playbook import conditions which allows an authenticated attacker to crash the Playbooks plugin instance-wide via a crafted import request containing a null condition. Mattermost Advisory ID: MMSA-2026-00709

Affected Products

Vendor	Product	Versions
mattermost	mattermost	11.7.0

References

https://mattermost.com/security-updates(vendor-advisory)

Related News (3 articles)

Tier B

BSI Advisories12d ago

[NEU] [mittel] Mattermost Server: Mehrere Schwachstellen ermöglichen nicht spezifizierten Angriff

→ No new info (linked only)

Tier B

CERT-FR12d ago

Vulnérabilité dans Mattermost Server (23 octobre 2026)

→ No new info (linked only)

Tier C

VulDB13d ago

CVE-2026-13411 | Mattermost up to 11.7.11/11.9.x Playbooks input validation

→ No new info (linked only)

Discussion (0)

Loading…

CVSS 3.14.3 MEDIUM

VectorCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L

CISA KEV❌ No

Actively exploited❌ No

Patch available

11.10.011.7.12

CWECWE-754

PublishedOct 22, 2026

Last enriched13d agov2

Trending Score9

Source articles3

Independent3

Info Completeness9/14

Missing: epss, kev, exploit, iocs, mitre_attack

Community Vote

0 upvotes0 downvotes

No votes yet

Related CVEs (5)

HIGHCVE-2026-93851

Path traversal in Mattermost Agents plugin mention reminder allows plugin replacement via crafted post

Multiple vulnerabilities in Mattermost products

HIGHCVE-2026-116516

Insufficient length validation when parsing Zoom chat transcriptions

LOWCVE-2026-93848

Mattermost OpenID discovery endpoint request bypasses outbound connection filtering, allowing SSRF by a System Administrator

MEDIUMCVE-2026-18799

Mattermost Server fails to restrict Slack import account binding, allowing team admins to forge posts as existing users

Pin to Dashboard

Verification

State: unverified

Confidence: 0%

Vulnerability Timeline

CVE Published

Oct 22, 2026

Discovered by ZDM

Oct 22, 2026

Updated: affectedVersions, cweIds

Oct 22, 2026

Patch Available

Oct 22, 2026

Version History

v2

Last enriched 13d ago

v2Tier C13d ago

Added 11.9.x branch to affected versions and added CWE-20 (Improper Input Validation) based on article's description of the vulnerability

affectedVersionscweIds

via VulDB

v113d ago

Initial creation