CVE-2023-6727 Leak Inaccessible Playbook Information via Channel Action IDOR

Mattermost fails to perform correct authorization checks when creating a playbook action, allowing users without access to the playbook to create playbook actions. If the playbook action created is to post a message in a channel based on specific keywords in a post, some playbook information, lik...

CVE-2023-6727

Mattermost CVE-2023-6727 describes an authorization flaw in the playbooks feature where creating a playbook action can be performed by users without playbook access. The flaw can lead to leakage of sensitive playbook information (e.g., the playbook name) when actions are configured to post messag...

CVE-2023-6727 Leak Inaccessible Playbook Information via Channel Action IDOR

Mattermost fails to perform correct authorization checks when creating a playbook action, allowing users without access to the playbook to create playbook actions. If the playbook action created is to post a message in a channel based on specific keywords in a post, some playbook information, lik...

CVE-2023-49874

Mattermost fails to check whether a user is a guest when updating the tasks of a private playbook run allowing a guest to update the tasks of a private playbook run if they know the run ID...

CVE-2023-6547

Mattermost fails to validate team membership when a user attempts to access a playbook, allowing a user with permissions to a playbook but no permissions to the team the playbook is on to access and modify the playbook. This can happen if the user was once a member of the team, got permissions to...

CVE-2023-49607

Mattermost fails to validate the type of the "reminder" body request parameter allowing an attacker to crash the Playbook Plugin when updating the status dialog...

Design/Logic Flaw

Mattermost fails to check whether a user is a guest when updating the tasks of a private playbook run allowing a guest to update the tasks of a private playbook run if they know the run ID...

Design/Logic Flaw

Mattermost fails to validate the type of the "reminder" body request parameter allowing an attacker to crash the Playbook Plugin when updating the status dialog...

Code injection

Mattermost fails to validate team membership when a user attempts to access a playbook, allowing a user with permissions to a playbook but no permissions to the team the playbook is on to access and modify the playbook. This can happen if the user was once a member of the team, got permissions to...

CVE-2023-6547

Mattermost is affected by CVE-2023-6547, where a flaw in access control allows a user who has permissions to a specific playbook but not to its hosting team to view/modify the playbook. The root cause is the system failing to validate team membership when accessing a playbook, which can occur if ...

CVE-2023-6547 Playbooks access/modification by removed team member

Mattermost fails to validate team membership when a user attempts to access a playbook, allowing a user with permissions to a playbook but no permissions to the team the playbook is on to access and modify the playbook. This can happen if the user was once a member of the team, got permissions to...

CVE-2023-49607 Playbook plugin crash via missing interface type assertion

Mattermost fails to validate the type of the "reminder" body request parameter allowing an attacker to crash the Playbook Plugin when updating the status dialog...

CVE-2023-49607

Mattermost contains a vulnerability in the Playbook Plugin where the type of the reminder parameter in the request body is not validated. This can cause the Playbook Plugin to crash when updating the status dialog. Technical details across multiple sources confirm the issue is triggered by improp...

CVE-2023-49607 Playbook plugin crash via missing interface type assertion

Mattermost fails to validate the type of the "reminder" body request parameter allowing an attacker to crash the Playbook Plugin when updating the status dialog...

CVE-2023-49874 IDOR when updating the tasks of a private playbook run

Mattermost fails to check whether a user is a guest when updating the tasks of a private playbook run allowing a guest to update the tasks of a private playbook run if they know the run ID...

CVE-2023-49874

CVE-2023-49874 : Mattermost has an access-control flaw in the Playbooks feature where a guest can update tasks of a private playbook run if they know the run ID, due to insufficient verification of guest status. Affected software: Mattermost (Playbooks task-update flow). Root cause: lack of prope...

CVE-2023-49874 IDOR when updating the tasks of a private playbook run

Mattermost fails to check whether a user is a guest when updating the tasks of a private playbook run allowing a guest to update the tasks of a private playbook run if they know the run ID...

CVE-2023-45847 Playbook Plugin Crash via Run Checklist

Mattermost fails to to check the length when setting the title in a run checklist in Playbooks, allowing an attacker to send a specially crafted request and crash the Playbooks plugin...

CVE-2023-45847 Playbook Plugin Crash via Run Checklist

Mattermost fails to to check the length when setting the title in a run checklist in Playbooks, allowing an attacker to send a specially crafted request and crash the Playbooks plugin...

Mattermost Security Vulnerabilities

Mattermost is an open source collaboration platform from Mattermost, Inc. in the United States. Mattermost suffers from a security vulnerability that stems from an inability to check whether a user is a guest when updating a private Playbook run, which can be exploited by an attacker to update a...