CVE-2026-26304

Description

Mattermost fails to verify run_create permission for empty playbookId in github.com/mattermost/mattermost-plugin-playbooks

How to fix CVE-2026-26304

To remediate CVE-2026-26304, upgrade the affected package to a fixed version below.

• Go/github.com/mattermost/mattermost-plugin-playbooks—upgrade to 1.41.1-0.20260316224925-705f54a81841 or later
• —upgrade to 1.41.1-0.20260316224925-705f54a81841 or later

Is CVE-2026-26304 being exploited?

Low — EPSS is 0.0%, meaning exploitation activity has not been observed at scale.

Affected packages (2)

• from 0, < 1.41.1-0.20260316224925-705f54a81841
• from 0, < 1.41.1-0.20260316224925-705f54a81841

CVSS scores

References (5)

• ADVISORYgithub.com/advisories/GHSA-4pmx-622h-x359
• ADVISORYnvd.nist.gov/vuln/detail/CVE-2026-26304
• PATCHgithub.com/mattermost/mattermost-plugin-playbooks
• WEBgithub.com/mattermost/mattermost-plugin-playbooks/commit/705f54a818410f3612df3865bfde608ed471037e