CVE-2026-9812

Executive Summary

CVE-2026-9812 is an authorization validation flaw (CWE-639) in the Mattermost Playbooks plugin affecting multiple server release branches (11.9.x, 11.8.x, 11.7.x, and 10.11.x). The product fails to verify that a property field belongs to the specified run before updating its value, allowing an authenticated user with run property-management access to crash the Playbooks plugin via a crafted REST request. Impact is limited to availability (CVSS 6.5, A:H) — there is no confidentiality or integrity impact — but repeated exploitation can render Playbooks unavailable to the entire workspace.

Technical Analysis

The vulnerability resides in the authorization logic governing property-field updates within the Mattermost Playbooks plugin. Per the NVD description, the plugin "fail[s] to validate that a property field belongs to the specified run before updating its value." This is a classic insecure direct object reference / broken object-level authorization pattern (CWE-639): the server accepts a run identifier and a property-field identifier from the caller but does not confirm that the two are related by ownership or containment before performing the update.

The affected attack surface is the Playbooks REST API. A user who holds "run property-management access" — a privileged-but-not-administrative role within the Playbooks workflow — can craft an HTTP request in which the property field part of the request references a field belonging to a different run. Because the relationship between the run and the field is not validated, the update operation is carried out against an object that is out of scope for the request context. This inconsistent state, or an unhandled condition produced by the mismatched reference, causes the Playbooks plugin process to crash. The CVSS vector (AV:N, AC:L, PR:L, UI:N, S:U, C:N, I:N, A:H) confirms network-reachable, low-complexity, low-privilege exploitation requiring no user interaction, with high availability impact confined to the same security scope.

No public proof-of-concept, Nuclei template, or exploit code exists at the time of writing. Because the advisory is sparse, the specific handler name, request path, and property-field parameter are not disclosed; the mechanism above is described strictly at the vulnerability-class level rather than with invented implementation details. Mattermost's own advisory identifier for this issue is MMSA-2026-00684.

Exploitation Scenarios

1. Reconnaissance / target identification. An attacker locates an internet-exposed Mattermost deployment running an affected version and confirms the Playbooks plugin is enabled. Versions in scope: 11.9.x ≤ 11.9.0, 11.8.x ≤ 11.8.4, 11.7.x ≤ 11.7.7, and 10.11.x ≤ 10.11.22. Public fingerprinting via the standard system ping endpoint and the web UI title/HTML is sufficient.

2. Privilege precondition and trigger. The attacker authenticates with a low-privileged account that holds run property-management access. This role is attainable by ordinary team members in many Playbooks deployments. The attacker identifies at least two run objects and their associated property fields.

3. Payload / execution method at the vulnerability-class level. The attacker sends an authenticated REST request that specifies one run identifier while referencing a property field that belongs to a different run. Because the plugin fails to validate the ownership relationship (CWE-639), the mismatched reference reaches the update routine. No user interaction is required (UI:N), and the request is a single network call at low complexity (AC:L).

4. Post-exploitation impact. The malformed cross-run update causes the Playbooks plugin to crash (A:H). Depending on deployment architecture, this may interrupt playbook execution, checklist updates, and run management for all workspace users until the plugin is restarted. There is no exfiltration or data-modification vector (C:N, I:N); the objective is denial of service. Repeated requests can sustain the outage. No public PoC is available; the attack chain is inferred from the vulnerability class.

Impact Assessment

Business impact is availability-centric. Mattermost Playbooks is used for incident response, security operations, and structured workflow automation; crashing the plugin can blind or stall an organization's operational runbooks at precisely the moment they are needed. The blast radius includes every user in the affected workspace relying on Playbooks, though the core Mattermost messaging service is unaffected. CVSS subscores: AV:N (remotely reachable), AC:L (no special conditions), PR:L (authenticated property-management role required), UI:N (no victim interaction), S:U (impact stays within the vulnerable component), C:N (no data exposure), I:N (no data modification), A:H (full loss of plugin availability), for a base score of 6.5 (Medium). EPSS is 0.00210 (11.4th percentile), indicating low current exploitation likelihood, and the CVE is not in CISA KEV. The absence of a vendor patch raises residual risk for organizations that expose Playbooks to untrusted authenticated users.

Detection Guidance

Sigma Rule

title: Mattermost Playbooks Cross-Run Property Field Update Attempt
id: 3f7c1a92-9812-4c7d-9b21-0a5d4e11c981
status: experimental
description: Detects authenticated REST requests attempting to update a Playbooks property field that belongs to a different run (CVE-2026-9812)
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-9812
author: valtersit.com
date: 2026/01/01
logsource:
  product: mattermost
  service: audit
detection:
  selection_plugin:
    event_type|contains: 'playbook'
  selection_property:
    request_path|contains:
      - '/properties'
      - '/property'
  selection_run:
    request_path|contains: '/runs/'
  condition: selection_plugin and selection_property and selection_run
fields:
  - user_id
  - request_path
  - source_ip
  - status_code
falsepositives:
  - Legitimate property updates where run and field identifiers are consistent
level: medium
tags:
  - attack.t1190
  - cve.2026.9812

YARA Rule

rule CVE_2026_9812_Mattermost_Playbooks_Cross_Run_Field
{
    meta:
        author = "valtersit.com"
        description = "Detects Mattermost Playbooks REST requests referencing a property field across runs (CVE-2026-9812)"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-9812"
        date = "2026-01-01"
        severity = "medium"

    strings:
        $p1 = "/plugins/playbooks/api" ascii nocase
        $r1 = "/runs/" ascii nocase
        $f1 = "/properties" ascii nocase
        $f2 = "/property" ascii nocase

    condition:
        $p1 and $r1 and 1 of ($f1, $f2)
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2026-9812 Mattermost Playbooks cross-run property field update attempt"; flow:established,to_server; http.method; content:"PUT"; http.uri; content:"/plugins/playbooks/api"; http.uri; content:"/runs/"; http.uri; content:"/properties"; reference:cve,2026-9812; classtype:attempted-dos; sid:20269812; rev:1;)

Elastic Detection

http where
  http.request.method in ("PUT", "PATCH", "POST") and
  stringContains(http.request.uri, "/plugins/playbooks/api") and
  stringContains(http.request.uri, "/runs/") and
  (stringContains(http.request.uri, "/properties") or stringContains(http.request.uri, "/property"))

Splunk SPL Query

index=mattermost sourcetype=mattermost:audit
| search request_path="*/plugins/playbooks/api*" request_path="*/runs/*"
| search (request_path="*/properties*" OR request_path="*/property*")
| stats count min(_time) as first_seen max(_time) as last_seen values(status_code) as codes by user_id, source_ip, request_path
| where count > 5
| sort - count

Wazuh OSSEC Rule

<group name="mattermost,web,">
  <rule id="100981" level="10">
    <decoded_as>json</decoded_as>
    <field name="request_path">/plugins/playbooks/api</field>
    <field name="request_path">/runs/</field>
    <field name="request_path">/properties</field>
    <description>CVE-2026-9812: Mattermost Playbooks cross-run property field update attempt (potential plugin crash/DoS)</description>
    <mitre>
      <id>T1190</id>
    </mitre>
    <group>cve_2026_9812,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 (UNPATCHED — no patch evidence from any tracked source). Mattermost Advisory ID MMSA-2026-00684 should be monitored for a vendor fix.

1. Immediate mitigations. Restrict network exposure of the Mattermost server and Playbooks API to trusted networks or VPN. Audit and least-privilege the "run property-management" role — remove it from accounts that do not require it, since exploitation requires this access level. If Playbooks is not actively used, disable the plugin. Monitor for repeated playbook plugin restarts and unexpected 5xx responses on Playbooks REST endpoints.

2. Patch/upgrade steps. No patch is currently available. Track Mattermost security advisories and the MMSA-2026-00684 advisory for fixed releases in the 11.9.x, 11.8.x, 11.7.x, and 10.11.x branches. When a fixed version is published, upgrade all affected servers and restart the Playbooks plugin.

3. Long-term hardening. Enforce server-side authorization checks that verify parent-child ownership of run and property-field objects (remediating CWE-639 at the code level). Adopt centralized audit logging with alerting on anomalous Playbooks API activity. Apply network segmentation and rate limiting to authenticated API endpoints, and maintain a threat-informed patch cadence with continuous CVE monitoring.

References

• NVD — CVE-2026-9812: https://nvd.nist.gov/vuln/detail/CVE-2026-9812
• Mattermost Security Advisories (MMSA-2026-00684): https://mattermost.com/security-updates/
• CWE-639 — Authorization Bypass Through User-Controlled Key: https://cwe.mitre.org/data/definitions/639.html
• CISA Known Exploited Vulnerabilities Catalog: https://www.cisa.gov/known-exploited-vulnerabilities-catalog
• EPSS — CVE-2026-9812 scoring data: https://www.first.org/epss/

No public proof-of-concept, Nuclei template, or exploit code is available for CVE-2026-9812, and there is no evidence of exploit-in-the-wild activity or known threat actor campaigns targeting this issue at the time of writing. CISA KEV status: NO.