PT-2025-17704 · Mattermost · Mattermost

Tobias Weisshaar · Published 2025-04-24 · Updated 2025-04-26 · CVE-2025-41423

Positive Technologies (AI Summary)

CVSS v3.1

4.3

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

Name of the Vulnerable Software and Affected Versions Mattermost versions 9.11.x through 9.11.10 Mattermost versions 10.4.x through 10.4.2 Mattermost versions 10.5.x through 10.5.0

Description The issue concerns the improper validation of permissions for the API endpoint "/plugins/playbooks/api/v0/signal/keywords/ignore-thread". This allows any user or attacker to delete posts containing actions created by the Playbooks bot, even without channel access or appropriate permissions.

Recommendations For versions 9.11.x through 9.11.10, update to a version that properly validates permissions for the API endpoint. For versions 10.4.x through 10.4.2, update to a version that properly validates permissions for the API endpoint. For versions 10.5.x through 10.5.0, update to a version that properly validates permissions for the API endpoint. As a temporary workaround, consider restricting access to the "/plugins/playbooks/api/v0/signal/keywords/ignore-thread" API endpoint until a patch is available.

Fix

Incorrect Authorization

Weakness Enumeration

CWE-863

Related Identifiers

CVE-2025-41423

GHSA-FR22-5377-F3P7

GO-2025-3644

OPENSUSE-SU-2025:15033-1

Affected Products

Mattermost

References · 19

• https://mattermost.com/security-updates · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2025:15033-1 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-fr22-5377-f3p7 · Vendor Advisory
• https://osv.dev/vulnerability/GO-2025-3644 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2025-41423 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-41423 · Security Note
• https://github.com/mattermost/mattermost/commit/2b5275d87136f07e016c8eca09a2f004b31afc8a · Note
• https://github.com/mattermost/mattermost-plugin-playbooks · Note
• https://github.com/mattermost/mattermost-plugin-playbooks/commit/f9f7064e4d9f3918d66bac1f5f9eb28f0723464b · Note
• https://github.com/advisories/GHSA-fr22-5377-f3p7 · Note
• https://twitter.com/CVEnew/status/1915303683635499368 · Twitter Post
• https://suse.com/security/cve/CVE-2025-35965 · Note
• https://suse.com/security/cve/CVE-2017-14992 · Note
• https://suse.com/security/cve/CVE-2017-9232 · Note
• https://suse.com/security/cve/CVE-2025-41423 · Note