CVE-2026-6541

Unscoped updates to other playbooks' metric configuration

4.3MediumCVSS base score
0.25%Exploitation in 30 daysEPSS · top 83% of all CVEs
NoKnown exploitednot in CISA's KEV catalog
NonePublic exploitsnone known yet

Description

Mattermost versions 11.7.x <= 11.7.1, 11.6.x <= 11.6.4, 10.11.x <= 10.11.19 fail to restrict metric configuration changes to the playbook being saved, which allows an authenticated user with team access to alter another user’s playbook metric settings via a crafted import or update request with a foreign metric ID. Mattermost Advisory ID: MMSA-2026-00653

Timeline

2026
17 Apr 2026
17 Apr 2026
ID reserved
By Mattermost
13 Jul 20263 months later
13 Jul 2026· 3 months later
Published

Changes after publication (a new score, a public exploit, EPSS crossing 1, 10 or 50 %, leaving KEV) are kept since November 2026; earlier ones are not known.

Scores

CVSS scores of CVE-2026-6541, by who scored it
Scored by	CVSS	Score	Vector
MattermostCNA (assigner)	3.1	Medium4.3	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
NVDNVD · Analyzed	3.1	Medium4.3	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

EPSS (exploitation in 30 days): 0.25% · top 83% of all CVEs (11 Nov 2026)
CISA SSVC: Exploitation: none · Automatable: no · Technical impact: partial

The list uses the assigner's score when there is one, then CISA's, then NVD's: Medium 4.3.

Affected products

Mattermost · Mattermost
- affected 11.7.0 – ≤ 11.7.1
- affected 11.6.0 – ≤ 11.6.4
- affected 10.11.0 – ≤ 10.11.19
- unaffected 11.8.0
- unaffected 11.7.2
- unaffected 11.6.5
- unaffected 10.11.20

What to do

Solution: Update Mattermost to versions 11.8.0, 11.7.2, 11.6.5, 10.11.20 or higher.

References1

MMSA-2026-00653 (opens in a new tab)vendor-advisory

Sources

The same CVE in the primary databases and aggregators, to check against.

Badge for a README or a ticket

[![CVE-2026-6541](https://cveledger.app/badge/CVE-2026-6541.svg)](https://cveledger.app/cve/CVE-2026-6541)

Record last updated 13 Jul 2026, 13:09 UTC.