GHSA-fr22-5377-f3p7
Mattermost Playbooks fails to properly validate permissions
Packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| Go | github.com/mattermost/mattermost-plugin-playbooks | < 2.1.1 | no fix listed |
| Go | github.com/mattermost/mattermost-plugin-playbooks | < 1.41.0 | 1.41.0 |
| Go | github.com/mattermost/mattermost/server/v8 | < 8.0.0-20250218121836-2b5275d87136 | 8.0.0-20250218121836-2b5275d87136 |
| Go | github.com/mattermost/mattermost/server/v8 | < 10.4.3 | no fix listed |
| Go | github.com/mattermost/mattermost/server/v8 | < 10.5.1 | no fix listed |
| Go | github.com/mattermost/mattermost/server/v8 | < 9.11.11 | no fix listed |
Details
As written in the advisory (Markdown source, shown as plain text).
Mattermost versions 10.4.x <= 10.4.2, 10.5.x <= 10.5.0, 9.11.x <= 9.11.10 fail to properly validate permissions for the API endpoint /plugins/playbooks/api/v0/signal/keywords/ignore-thread, allowing any user or attacker to delete posts containing actions created by the Playbooks bot, even without channel access or appropriate permissions.
References
External links from the advisory. They lead to third-party sites.
- https://nvd.nist.gov/vuln/detail/CVE-2025-41423
- https://github.com/mattermost/mattermost-plugin-playbooks/commit/f9f7064e4d9f3918d66bac1f5f9eb28f0723464b
- https://github.com/mattermost/mattermost/commit/2b5275d87136f07e016c8eca09a2f004b31afc8a
- https://github.com/mattermost/mattermost-plugin-playbooks
- https://mattermost.com/security-updates