Mattermost servers version 11.3.x up to 11.3.0 and 11.2.x up to 11.2.2 contain a missing access control flaw. The system incorrectly accepts a run_create request with an empty playbookId, allowing authenticated users to create playbook runs they are not authorized to initiate. This flaw permits arbitrary execution of playbook workflows and can lead to undesired or malicious actions within the application, as identified by CWE‑863.

Mattermost server versions 11.3.x up to 11.3.0 and 11.2.x up to 11.2.2 are affected.

The CVSS score is 4.3, indicating low severity. The EPSS score is less than 1%, showing a very low probability of current exploitation, and the vulnerability is not listed in the CISA KEV catalog. Exploitation requires authenticated API access within a team, suggesting the attack vector is internal or requires compromised credentials. Although the risk appears low, the flaw allows unauthorized execution of playbook runs, potentially compromising application integrity.