CVE Catalog
CVE-2023-4106
MediumCVSS 6.3Exploitation Probability (EPSS)
Low risk0.31%
22th percentile - higher than 22% of all known CVEs
Summary
Mattermost fails to check if the requesting user is a guest, allowing guests to view, join, edit, export, and archive public playbooks.
Risk Assessment
The potential for unauthorized access to public playbooks by guest users may lead to the disclosure of sensitive information and privacy violations for the organization.
Recommendation
It is recommended to implement appropriate access controls to ensure that only authorized users can perform actions on public playbooks.
Original NVD description (English source)
Mattermost fails to check if the requesting user is a guest before performing different actions to public playbooks, resulting a guest being able to view, join, edit, export and archive public playbooks.