MEDIUM6.5Go
GHSA-3g36-gf7c-75qw· CVE-2025-41395, GO-2025-3642Mattermost Playbooks fails to properly validate the props used by the RetrospectivePost custom post type
Modified: 9/10/2026
package
Go/github.com/mattermost/mattermost-plugin-playbooks
pkg:go/github.com/mattermost/mattermost-plugin-playbooks
MEDIUM4.3Go
GHSA-4pmx-622h-x359· CVE-2026-26304, GO-2026-4812Mattermost fails to verify run_create permission for empty playbookId
Modified: 3/23/2026
MEDIUM6.5Go
GHSA-689c-xq7x-xjwf· CVE-2025-35965, GO-2025-3643Mattermost Playbooks fails to validate the uniqueness and quantity of task actions
Modified: 9/10/2026
LOW3.1Go
GHSA-fr22-5377-f3p7· CVE-2025-41423, GO-2025-3644Mattermost Playbooks fails to properly validate permissions
Modified: 9/10/2026
LOW3.1Go
GHSA-gvg4-jhmr-6j23· CVE-2026-4286, GO-2026-5404Mattermost doesn't check if {{team_id}} was being changed when updating playbooks
Modified: 6/25/2026
MEDIUM4.3Go
GHSA-m79q-8qf5-v622· CVE-2026-6343, GO-2026-5494Mattermost doesn't check public/private permissions
Modified: 6/25/2026
—Go
GO-2025-3642· CVE-2025-41395, GHSA-3g36-gf7c-75qwMattermost Playbooks fails to properly validate the props used by the RetrospectivePost custom post type in github.com/mattermost/mattermost-plugin-playbooks
Modified: 2/4/2026
—Go
GO-2025-3643· CVE-2025-35965, GHSA-689c-xq7x-xjwfMattermost Playbooks fails to validate the uniqueness and quantity of task actions in github.com/mattermost/mattermost-plugin-playbooks
Modified: 2/4/2026
—Go
GO-2025-3644· CVE-2025-41423, GHSA-fr22-5377-f3p7Mattermost Playbooks fails to properly validate permissions in github.com/mattermost/mattermost-plugin-playbooks
Modified: 2/4/2026
—Go
GO-2026-4812· CVE-2026-26304, GHSA-4pmx-622h-x359Mattermost fails to verify run_create permission for empty playbookId in github.com/mattermost/mattermost-plugin-playbooks
Modified: 3/23/2026
—Go
GO-2026-5404· CVE-2026-4286, GHSA-gvg4-jhmr-6j23Mattermost doesn't check if {{team_id}} was being changed when updating playbooks in github.com/mattermost/mattermost-plugin-playbooks
Modified: 6/25/2026
—Go
GO-2026-5494· CVE-2026-6343, GHSA-m79q-8qf5-v622Mattermost doesn't check public/private permissions in github.com/mattermost/mattermost-plugin-playbooks
Modified: 6/25/2026