github.com/mattermost/mattermost-plugin-playbooks
Go5 known CVEs affecting this package
Aggregated from OSV, GitHub Security Advisories, NVD, and vendor advisories. Each CVE links to its full detail page with vendor advisories, patches, fixed versions, and remediation guidance.
CVEs affecting github.com/mattermost/mattermost-plugin-playbookspage 1 of 1
- CVE-2025-35965MEDIUMCVSS 6.5EG 6.5✓ Fixed in 1.41.02025-04-24
Mattermost versions 10.4.x <= 10.4.2, 10.5.x <= 10.5.0, 9.11.x <= 9.11.10 fail to validate the uniqueness and quantity of task actions within the UpdateRunTaskActions GraphQL operation, which allows an attacker to create task items contain…
- CVE-2025-41395MEDIUMCVSS 6.5EG 6.5✓ Fixed in 1.41.02025-04-24
Mattermost versions 10.4.x <= 10.4.2, 10.5.x <= 10.5.0, 9.11.x <= 9.11.10 fail to properly validate the props used by the RetrospectivePost custom post type in the Playbooks plugin, which allows an attacker to create a specially crafted p…
- CVE-2025-41423LOWCVSS 3.1EG 3.1✓ Fixed in 1.41.02025-04-24
Mattermost versions 10.4.x <= 10.4.2, 10.5.x <= 10.5.0, 9.11.x <= 9.11.10 fail to properly validate permissions for the API endpoint /plugins/playbooks/api/v0/signal/keywords/ignore-thread, allowing any user or attacker to delete posts co…
- CVE-2026-4286LOWCVSS 3.1EG 3.1✓ Fixed in 1.41.1-0.20260213020129-e1d6ec2c94e62026-05-18
Mattermost versions 11.5.x <= 11.5.1, 10.11.x <= 10.11.13 fail to check if {{team_id}} was being changed when updating playbooks, allowing users with only {{Manage Playbook Configurations}} permission to change a playbook's team, bypassing…
- CVE-2026-6343MEDIUMCVSS 4.3EG 4.3✓ Fixed in 1.41.1-0.20260309184833-887d9cacb6162026-05-18
Mattermost versions 11.5.x <= 11.5.1, 10.11.x <= 10.11.13, 11.4.x <= 11.4.3 fail to check public/private permissions which allows members without these permissions to access public playbooks via /get.. Mattermost Advisory ID: MMSA-2026-005…
Check whether github.com/mattermost/mattermost-plugin-playbooks is used in your infrastructure
EchelonGraph scans your cloud and SBOMs to map every package to your actual deployments. See blast radius for github.com/mattermost/mattermost-plugin-playbooks CVEs against the assets you own.
Start Free Scan →