CVE-2026-13411Medium· 4.3▾ SunlitMattermost versions 11.7.x <= 11.7.11 fail to validate null elements when decoding playbook import conditions which allows an authenticated attacker to crash the Playbooks plugin instance-wide via a crafted import request containing a nu…
▾ Sunlit zone — Low / medium · no exploitation signal
impact 23.7 · likelihood 0 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Mattermost versions 11.7.x <= 11.7.11 fail to validate null elements when decoding playbook import conditions which allows an authenticated attacker to crash the Playbooks plugin instance-wide via a crafted import request containing a null condition. Mattermost Advisory ID: MMSA-2026-00709
Mattermost >= 11.7.0 <= 11.7.11Update Mattermost to versions 11.10.0, 11.7.12 or higher.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-19541Medium· 6.5Outgoing OAuth connection client secret exposure during connection validation
CVE-2026-19601Medium· 4.9Disclosure of AD/LDAP bind password via Test Connection
CVE-2026-18551Medium· 6.5Mattermost guest account privilege escalation via member roles API
CVE-2026-19867Medium· 4.3Uncapped mention keys in user notification properties allow CPU exhaustion during post processing
CVE-2026-18795Medium· 6.4Missing server side validation allowed user to quarantine a DM and GM post
CVE-2026-19621Medium· 6.5Mattermost leaks interactive-message integration secrets to non-admin users via post-deletion events and thread reads