PT-2025-26325 · Mattermost · Mattermost
Hackit_Bharat
·
Published
2025-05-21
·
Updated
2025-08-04
·
CVE-2025-3228
CVSS v3.1
4.3
Medium
| Vector | AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N |
Name of the Vulnerable Software and Affected Versions:
Mattermost versions 10.5.x through 10.5.5
Mattermost versions 9.11.x through 9.11.15
Mattermost versions 10.8.x through 10.8.0
Mattermost versions 10.7.x through 10.7.2
Mattermost versions 10.6.x through 10.6.5
Description:
The issue arises from the failure to properly retrieve
requestorInfo from the playbooks handler for guest users, allowing an attacker to access the playbook run.Recommendations:
For Mattermost versions 10.5.x through 10.5.5, update to a version later than 10.5.5.
For Mattermost versions 9.11.x through 9.11.15, update to a version later than 9.11.15.
For Mattermost versions 10.8.x through 10.8.0, update to a version later than 10.8.0.
For Mattermost versions 10.7.x through 10.7.2, update to a version later than 10.7.2.
For Mattermost versions 10.6.x through 10.6.5, update to a version later than 10.6.5.
Fix
Incorrect Authorization
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Mattermost