CVE-2026-9812

Name of the Vulnerable Software and Affected Versions Mattermost version 11.9.0 Mattermost version 11.8.4 Mattermost version 11.7.7 Mattermost version 10.11.22

Description An issue exists where the system fails to validate if a property field belongs to the specified run before updating its value. This allows an authenticated user with run property-management access to crash the Playbooks plugin by sending a REST request that references a property field belonging to a different run.

Recommendations Update Mattermost version 11.9.0 to a newer version. Update Mattermost version 11.8.4 to a newer version. Update Mattermost version 11.7.7 to a newer version. Update Mattermost version 10.11.22 to a newer version.