| Package | Affected versions | Patched versions |
|---|---|---|
| github.com/mattermost/mattermost-plugin-playbooks | ≥ 2.0.0< 1.41.0all versions | 1.41.0 |
| github.com/mattermost/mattermost-server | ≥ 10.4.0+incompatible≥ 10.5.0+incompatible≥ 9.11.0+incompatible | |
| github.com/mattermost/mattermost-server/v5 | all versions | |
| github.com/mattermost/mattermost-server/v6 | all versions | |
| github.com/mattermost/mattermost/server/v8 | ≥ 10.4.0≥ 10.5.0≥ 9.11.0< 8.0.0-20250218121836-2b5275d87136all versions | 8.0.0-20250218121836-2b5275d87136 |
| mattermost server | = 10.5.0≥ 10.4.0, < 10.4.3≥ 9.11.0, < 9.11.11 | 10.4.39.11.11 |
Mattermost versions 10.4.x <= 10.4.2, 10.5.x <= 10.5.0, 9.11.x <= 9.11.10 fail to properly validate permissions for the API endpoint /plugins/playbooks/api/v0/signal/keywords/ignore-thread, allowing any user or attacker to delete posts containing actions created by the Playbooks bot, even without channel access or appropriate permissions.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free