MEDIUM 4.3 Go
Mattermost allows an unauthorized Guest user access to Playbook
GHSA-4578-6gjh-f2jm · CVE-2025-3228 · GO-2025-3771
Published · Modified
AI SAST
Find this class of vulnerability in your own code
Corgea's AI-native static analysis detects vulnerabilities like this one across your repositories, ranks them by exploitability, and returns review-ready fixes.
Description
Mattermost versions 10.5.x <= 10.5.5, 9.11.x <= 9.11.15, 10.8.x <= 10.8.0, 10.7.x <= 10.7.2, 10.6.x <= 10.6.5 fail to properly retrieve requestorInfo from playbooks handler for guest users which allows an attacker access to the playbook run.
References
Ready to move
Start Securing
Free, no credit card | First findings in minutes