
We found results for “”
CVE-2025-41423
Good to know:

Date: April 24, 2025
Mattermost versions 10.4.x <= 10.4.2, 10.5.x <= 10.5.0, 9.11.x <= 9.11.10 fail to properly validate permissions for the API endpoint /plugins/playbooks/api/v0/signal/keywords/ignore-thread, allowing any user or attacker to delete posts containing actions created by the Playbooks bot, even without channel access or appropriate permissions.
Severity Score
Related Resources (7)
Severity Score
Weakness Type (CWE)
Incorrect Authorization
CWE-863Top Fix

Upgrade Version
Upgrade to version github.com/mattermost/mattermost-plugin-playbooks - v1.41.0;github.com/mattermost/mattermost/server/v8 - v8.0.0-20250218121836-2b5275d87136;https://github.com/mattermost/mattermost-plugin-playbooks.git - v1.41.0;https://github.com/mattermost/mattermost-plugin-playbooks.git - v2.1.1
CVSS v3.1
Base Score: |
|
---|---|
Attack Vector (AV): | NETWORK |
Attack Complexity (AC): | HIGH |
Privileges Required (PR): | LOW |
User Interaction (UI): | NONE |
Scope (S): | UNCHANGED |
Confidentiality (C): | NONE |
Integrity (I): | LOW |
Availability (A): | NONE |