Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 3

Export CSV
CVE-2025-41423

Unauthorized Playbooks Post Deletion in Mattermost Playbooks Plugin

Mattermost versions 10.4.x <= 10.4.2, 10.5.x <= 10.5.0, 9.11.x <= 9.11.10 fail to properly validate permissions for the API endpoint /plugins/playbooks/api/v0/signal/keywords/ignore-thread, allowing any user or attacker to delete posts containing actions created by the Playbooks bot, even without channel access or appropriate permissions.

CVSS 3.1 · 3.1 Low EPSS < 1% KEV · Not listed
Vendors
Mattermost
Products
Mattermost Server Playbooks
CVE-2022-1333

A specifically drafted Playbook could trigger large amount of webhook requests leading to Denial of Service

Mattermost Playbooks plugin v1.24.0 and earlier fails to properly check the limit on the number of webhooks, which allows authenticated and authorized users to create a specifically drafted Playbook which could trigger a large amount of webhook requests leading to Denial of Service.

CVSS 3.1 · 3.5 Low EPSS < 1% KEV · Not listed
Vendors
Mattermost
Products
Playbooks
CVE-2022-1548

Playbook members are allowed to escalate their membership privileges and perform actions restricted to playbook admins.

Mattermost Playbooks plugin 1.25 and earlier fails to properly restrict user-level permissions, which allows playbook members to escalate their membership privileges and perform actions restricted to playbook admins.

CVSS 3.1 · 3.7 Low EPSS < 1% KEV · Not listed
Vendors
Mattermost
Products
Playbooks