Design/Logic Flaw

2023-02-2715:15:00

PRIOn knowledge base

www.prio-n.com

mattermost

permissions check

api

playbooks

security flaw

6.3 Medium

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

25.8%

JSON

A missing permissions check in the /plugins/playbooks/api/v0/runs API in Mattermost allows an attacker to list and view playbooks belonging to a team they are not a member of.

CPENameOperatorVersion
mattermosteq7.5.0
mattermosteq7.5.1
mattermosteq7.4.0
mattermostle7.1.4

Name	Operator	Version
mattermost	eq	7.5.0
mattermost	eq	7.5.1
mattermost	eq	7.4.0
mattermost	le	7.1.4

References

mattermost.com/security-updates/