CVE-2026-6541

Name of the Vulnerable Software and Affected Versions Mattermost versions 11.7.0 through 11.7.1 Mattermost versions 11.6.0 through 11.6.4 Mattermost versions 10.11.0 through 10.11.19

Description An issue exists where the system fails to restrict metric configuration changes to the specific playbook being saved. This allows an authenticated user with team access to modify the playbook metric settings of another user by sending a crafted import or update request containing a foreign metric ID.

Recommendations Update Mattermost versions 11.7.0 through 11.7.1 to a version newer than 11.7.1. Update Mattermost versions 11.6.0 through 11.6.4 to a version newer than 11.6.4. Update Mattermost versions 10.11.0 through 10.11.19 to a version newer than 10.11.19.