A null element is not validated when decoding playbook import conditions, allowing an authenticated user to submit a crafted import request that crashes the Playbooks plugin instance-wide. This defect results in a server‑side denial of service, compromising availability for all users of the affected instance.

Mattermost Mattermost. Versions 11.7.x through 11.7.11 are vulnerable. The fix is delivered in Mattermost 11.7.12 and 11.10.0 or later.

The CVSS score of 4.3 indicates a low severity vulnerability that requires the attacker to be authenticated to the application. Although it is not listed in CISA KEV and the EPSS score is unavailable, the threat is that a single authenticated user can cause the plugin to crash, effectively interrupting service for all users. The exploit path is straightforward: the attacker sends a specially crafted playbook import request containing a null condition, triggering the crash. There is no direct privilege escalation or data breach risk, but the impact on availability can be significant in production environments.