Mattermost versions 11.7.x <= 11.7.11 fail to validate null elements when decoding playbook import conditions which allows an authenticated attacker… (CVE-2026-13411)

Mattermost versions 11.7.x through 11.7.11 fail to validate null elements during the decoding of playbook import conditions. An authenticated attacker can exploit this by sending a specially crafted import request containing a null condition, causing the Playbooks plugin to crash across the entire instance. This vulnerability is tracked as CVE-2026-13411 and is associated with CWE-754 (Improper Check for Unusual or Exceptional Conditions). The CVSS v3.1 base score is 4.3, indicating a medium severity denial of service vulnerability with network attack vector, low attack complexity, and requiring low privileges but no user interaction.

The vulnerability allows an authenticated attacker to cause a denial of service by crashing the Playbooks plugin instance-wide. There is no impact on confidentiality or integrity. The availability of the Playbooks plugin is affected, potentially disrupting operations relying on this functionality.

Patch status is not yet confirmed — check the vendor advisory (Mattermost Advisory ID: MMSA-2026-00709) for current remediation guidance. Until an official fix is available, restrict access to the Playbooks import functionality to trusted users only and monitor for unusual import requests containing null conditions.