GHSA-fr22-5377-f3p7
Mattermost Playbooks fails to properly validate permissions
Quick fix
GHSA-fr22-5377-f3p7 — github.com/mattermost/mattermost-plugin-playbooks: upgrade to the fixed version with the command below.
go get github.com/mattermost/mattermost-plugin-playbooks@v1.41.0Details
Mattermost versions 10.4.x <= 10.4.2, 10.5.x <= 10.5.0, 9.11.x <= 9.11.10 fail to properly validate permissions for the API endpoint /plugins/playbooks/api/v0/signal/keywords/ignore-thread, allowing any user or attacker to delete posts containing actions created by the Playbooks bot, even without channel access or appropriate permissions.
Are you affected?
Enter the version of the package you're using.
Affected packages
2.0.0No fixed version published yet for github.com/mattermost/mattermost-plugin-playbooks (go modules). Pin to a known-safe version or switch to an alternative.
0Fixed in: 1.41.0go get github.com/mattermost/mattermost-plugin-playbooks@v1.41.00Fixed in: 8.0.0-20250218121836-2b5275d87136go get github.com/mattermost/mattermost/server/v8@v8.0.0-20250218121836-2b5275d8713610.4.0No fixed version published yet for github.com/mattermost/mattermost/server/v8 (go modules). Pin to a known-safe version or switch to an alternative.
10.5.0No fixed version published yet for github.com/mattermost/mattermost/server/v8 (go modules). Pin to a known-safe version or switch to an alternative.
9.11.0No fixed version published yet for github.com/mattermost/mattermost/server/v8 (go modules). Pin to a known-safe version or switch to an alternative.
References
- https://nvd.nist.gov/vuln/detail/CVE-2025-41423[ADVISORY]
- https://github.com/mattermost/mattermost-plugin-playbooks/commit/f9f7064e4d9f3918d66bac1f5f9eb28f0723464b[WEB]
- https://github.com/mattermost/mattermost/commit/2b5275d87136f07e016c8eca09a2f004b31afc8a[WEB]
- https://github.com/mattermost/mattermost-plugin-playbooks[PACKAGE]
- https://mattermost.com/security-updates[WEB]