CVE-2025-41423
published 2025-04-24CVE-2025-41423: Mattermost versions 10.4.x <= 10.4.2, 10.5.x <= 10.5.0, 9.11.x <= 9.11.10 fail to properly validate permissions for the API endpoint…
PriorityP423medium4.3CVSS 3.1
AVNACLPRLUINSUCNILAN
EPSS
0.26%
17.8th percentile
Mattermost versions 10.4.x <= 10.4.2, 10.5.x <= 10.5.0, 9.11.x <= 9.11.10 fail to properly validate permissions for the API endpoint /plugins/playbooks/api/v0/signal/keywords/ignore-thread, allowing any user or attacker to delete posts containing actions created by the Playbooks bot, even without channel access or appropriate permissions.
Affected
15 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| github.com | mattermost_mattermost-plugin-playbooks | >= 0 < 1.41.0 | 1.41.0 |
| github.com | mattermost_mattermost-plugin-playbooks | >= 2.0.0 | — |
| github.com | mattermost_mattermost-server | >= 10.4.0+incompatible | — |
| github.com | mattermost_mattermost-server | >= 10.5.0+incompatible | — |
| github.com | mattermost_mattermost-server | >= 9.11.0+incompatible | — |
| github.com | mattermost_mattermost_server_v8 | >= 0 < 8.0.0-20250218121836-2b5275d87136 | 8.0.0-20250218121836-2b5275d87136 |
| github.com | mattermost_mattermost_server_v8 | >= 10.4.0 | — |
| github.com | mattermost_mattermost_server_v8 | >= 10.5.0 | — |
| github.com | mattermost_mattermost_server_v8 | >= 9.11.0 | — |
| mattermost | mattermost | — | — |
| mattermost | mattermost | 10.4.0 – 10.4.2 | — |
| mattermost | mattermost | 9.11.0 – 9.11.10 | — |
| mattermost | mattermost_server | — | — |
| mattermost | mattermost_server | >= 10.4.0 < 10.4.3 | 10.4.3 |
| mattermost | mattermost_server | >= 9.11.0 < 9.11.11 | 9.11.11 |
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
Mattermost Playbooks fails to properly validate permissions
ghsa·2025-04-24
CVE-2025-41423 [LOW] CWE-863 Mattermost Playbooks fails to properly validate permissions
Mattermost Playbooks fails to properly validate permissions
Mattermost versions 10.4.x <= 10.4.2, 10.5.x <= 10.5.0, 9.11.x <= 9.11.10 fail to properly validate permissions for the API endpoint /plugins/playbooks/api/v0/signal/keywords/ignore-thread, allowing any user or attacker to delete posts containing actions created by the Playbooks bot, even without channel access or appropriate permissions.
OSV
Mattermost Playbooks fails to properly validate permissions in github.com/mattermost/mattermost-plugin-playbooks
osv·2025-04-24
CVE-2025-41423 Mattermost Playbooks fails to properly validate permissions in github.com/mattermost/mattermost-plugin-playbooks
Mattermost Playbooks fails to properly validate permissions in github.com/mattermost/mattermost-plugin-playbooks
Mattermost Playbooks fails to properly validate permissions in github.com/mattermost/mattermost-plugin-playbooks.
NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions.
(If this is causing false-positive reports from vulnerability scanners, please suggest an edit to the report.)
The additional affected modules and versions are: .
OSV
Mattermost Playbooks fails to properly validate permissions
osv·2025-04-24
CVE-2025-41423 [LOW] Mattermost Playbooks fails to properly validate permissions
Mattermost Playbooks fails to properly validate permissions
Mattermost versions 10.4.x <= 10.4.2, 10.5.x <= 10.5.0, 9.11.x <= 9.11.10 fail to properly validate permissions for the API endpoint /plugins/playbooks/api/v0/signal/keywords/ignore-thread, allowing any user or attacker to delete posts containing actions created by the Playbooks bot, even without channel access or appropriate permissions.
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
2025-04-24
Published