Launch Week Day 1: Announcing Security Design Review
LOW 3.1 Go

Mattermost Playbooks fails to properly validate permissions

GHSA-fr22-5377-f3p7 · CVE-2025-41423 · GO-2025-3644

Published · Modified

Description

Mattermost versions 10.4.x <= 10.4.2, 10.5.x <= 10.5.0, 9.11.x <= 9.11.10 fail to properly validate permissions for the API endpoint /plugins/playbooks/api/v0/signal/keywords/ignore-thread, allowing any user or attacker to delete posts containing actions created by the Playbooks bot, even without channel access or appropriate permissions.

Ready to move

Start Securing

Free, no credit card | First findings in minutes