CVE-2026-16046

Name of the Vulnerable Software and Affected Versions Mattermost versions 11.7.0 through 11.7.6 Mattermost versions 10.11.0 through 10.11.21

Description Finished playbook runs fail to enforce run-state validation during write operations. This allows a run participant to modify the status, checklists, retrospective content, ownership, and participants of completed runs through REST and GraphQL API requests.

Recommendations Update Mattermost versions 11.7.0 through 11.7.6 to a version newer than 11.7.6. Update Mattermost versions 10.11.0 through 10.11.21 to a version newer than 10.11.21.