Mattermost versions 11.5.x up to 11.5.1 allow a team member to create playbook runs in a different team by specifying an alternate team identifier in the run creation API. The backend logic fails to verify that the user has the required permission on the target team, enabling an authenticated attacker to fabricate runs they would otherwise be forbidden from creating. This flaw gives the attacker the ability to initiate potentially sensitive operational processes in teams they do not belong to, undermining confidentiality and integrity of team workflows.

Mattermost, known to affect all deployments of version 11.5.x that are 11.5.1 or earlier. The vulnerability is specific to the playbook run creation endpoint and does not impact other modules.

The CVSS score is 4.3, indicating a moderate impact. EPSS data is not available and the vulnerability is not listed in CISA KEV. The exposure requires authenticated access, and the attacker only needs permissions to call the creation API. Because no high‑value data or system‑wide privileges are stolen, the likelihood of exploitation remains limited but should not be ignored.