CVE-2025-3228

Summary

Mattermost versions 10.5.x <= 10.5.5, 9.11.x <= 9.11.15, 10.8.x <= 10.8.0, 10.7.x <= 10.7.2, 10.6.x <= 10.6.5 fail to properly retrieve requestorInfo from playbooks handler for guest users which allows an attacker access to the playbook run.

Affected Software

VendorProductVersion RangeStatus
MattermostMattermost10.5.0 <= 10.5.5affected
MattermostMattermost9.11.0 <= 9.11.15affected
MattermostMattermost10.8.0affected
MattermostMattermost10.7.0 <= 10.7.2affected
MattermostMattermost10.6.0 <= 10.6.5affected
MattermostMattermost10.9.0unaffected
MattermostMattermost10.5.6unaffected
MattermostMattermost9.11.16unaffected
MattermostMattermost10.8.1unaffected
MattermostMattermost10.7.3unaffected
MattermostMattermost10.6.6unaffected

Weaknesses

  • CWE-863: CWE-863: Incorrect Authorization

ADP Enrichment

CISA ADP Vulnrichment

  • SSVC:
  • Exploitation: none
    • Automatable: no
    • Technical Impact: partial

References