2 lines
3.1 KiB
JSON
2 lines
3.1 KiB
JSON
{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Mattermost","vendor":"Mattermost","versions":[{"lessThanOrEqual":"11.5.1","status":"affected","version":"11.5.0","versionType":"semver"},{"status":"unaffected","version":"11.6.0"},{"status":"unaffected","version":"11.5.2"},{"status":"unaffected","version":"10.11.14"},{"status":"unaffected","version":"11.4.4"}]}],"source":"responsibledisclosure@mattermost.com"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:a:mattermost:mattermost_server:*:*:*:*:*:*:*:*","matchCriteriaId":"F9018E52-5C7F-4E59-B637-604B8EECD974","versionEndExcluding":"10.11.17","versionStartIncluding":"10.11.0","vulnerable":true},{"criteria":"cpe:2.3:a:mattermost:mattermost_server:*:*:*:*:*:*:*:*","matchCriteriaId":"DF287562-A912-43DD-8FAC-0CD8EC7BEF7E","versionEndExcluding":"11.5.5","versionStartIncluding":"11.5.0","vulnerable":true},{"criteria":"cpe:2.3:a:mattermost:mattermost_server:*:*:*:*:*:*:*:*","matchCriteriaId":"AFCFC389-02A5-45CD-8EEB-9ED208C0EE83","versionEndExcluding":"11.6.2","versionStartIncluding":"11.6.0","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"Mattermost versions 11.5.x <= 11.5.1 fail to validate team-level run_create permission against the target team when creating a playbook run which allows an authenticated team member to create runs in teams where they lack permission via specifying a different team ID in the run creation API request. Mattermost Advisory ID: MMSA-2026-00629"},{"lang":"es","value":"Las versiones de Mattermost 11.5.x <= 11.5.1 fallan al validar el permiso run_create a nivel de equipo contra el equipo de destino al crear una ejecución de playbook, lo que permite a un miembro del equipo autenticado crear ejecuciones en equipos donde carecen de permiso mediante la especificación de un ID de equipo diferente en la solicitud de API de creación de ejecución. ID de Aviso de Mattermost: MMSA-2026-00629"}],"id":"CVE-2026-4055","lastModified":"2026-07-23T16:10:00.137","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":4.3,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"LOW","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N","version":"3.1"},"exploitabilityScore":2.8,"impactScore":1.4,"source":"responsibledisclosure@mattermost.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-4055","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-05-21T12:39:26.946775Z","version":"2.0.3"}}]},"published":"2026-05-21T08:16:23.130","references":[{"source":"responsibledisclosure@mattermost.com","tags":["Vendor Advisory"],"url":"https://mattermost.com/security-updates"}],"sourceIdentifier":"responsibledisclosure@mattermost.com","vulnStatus":"Analyzed","weaknesses":[{"description":[{"lang":"en","value":"CWE-863"}],"source":"responsibledisclosure@mattermost.com","type":"Secondary"}]}
|