Listen to this Post
How the CVE Works
Mattermost Playbooks fails to enforce proper permission checks on the API endpoint /plugins/playbooks/api/v0/signal/keywords/ignore-thread. This flaw allows unprivileged users or attackers to abuse the endpoint and delete posts containing Playbooks bot actions, even if they lack channel access. The vulnerability stems from missing server-side validation, permitting unauthorized modifications to critical bot-generated content. Affected versions include Mattermost 10.4.x ≤ 10.4.2, 10.5.x ≤ 10.5.0, and 9.11.x ≤ 9.11.10.
DailyCVE Form
Platform: Mattermost
Version: 10.4.0-10.4.2
Vulnerability: Improper Access Control
Severity: Low
Date: 2025-04-24
What Undercode Say:
Exploitation
- Endpoint Abuse: Attackers send crafted POST requests to `/plugins/playbooks/api/v0/signal/keywords/ignore-thread` without proper permissions.
2. Payload Example:
curl -X POST 'http://<target>/plugins/playbooks/api/v0/signal/keywords/ignore-thread' \
-H 'Authorization: Bearer <low-priv-token>' \
-d '{"post_id":"<target_post_id>"}'
3. Impact: Unauthorized deletion of Playbooks bot posts disrupts workflows and audit logs.
Mitigation
- Patch: Upgrade to Mattermost 10.4.3, 10.5.1, or 9.11.11.
- Workaround: Restrict API access via reverse proxy rules:
location ~ /plugins/playbooks/api/v0/signal/keywords/ignore-thread { deny all; }
3. Log Monitoring: Detect abuse via server logs:
grep "POST /plugins/playbooks/api/v0/signal/keywords/ignore-thread" /var/log/mattermost/access.log
Detection
1. Version Check:
mattermost version | grep -E '10.4.[0-2]|10.5.0|9.11.[0-10]'
2. Audit Endpoints:
curl -s http://localhost:8065/api/v4/config | jq '.PluginSettings.Playbooks'
References
Sources:
Reported By: github.com
Extra Source Hub:
Undercode
