The vulnerability lies in Mattermost's playbooks plugin, where playbook updates do not validate changes to the team identifier. Because of this validation gap, a user possessing only the Manage Playbook Configurations permission can modify the team attached to a playbook and, through the standard PUT API, effectively remove or add members from that team without proper authorization. This flaw is categorized as a Cumulative Authorization Problem (CWE‑863) and can lead to unauthorized removal of member access or alteration of playbook scope.

Affected are Mattermost server releases 11.5.x through 11.5.1 and 10.11.x through 10.11.13. Administrators should check installed versions and ensure they are not within the vulnerable range. Versions 11.6.0, 11.5.2, and 10.11.14 and later contain the fix.

The CVSS score of 3.1 indicates low overall severity, but the flaw is still exploitable for users who can obtain Manage Playbook Configurations rights, which may exist in large organizations. With no EPSS data and no KEV listing, the likelihood of public exploitation remains unclear, yet the attack would proceed by sending an authenticated PUT request to the playbook endpoint while supplying a new team ID. Therefore the risk is primarily internal and mitigated by immediate patching and strict permission controls.