CVE-2024-47401

MediumCVSS 4.3

Published: 29/10/2024(UTC)Updated: 17/06/2026(UTC)Translated: 31/10/2026(UTC)NVD NIST

Summary

Mattermost versions 9.10.x <= 9.10.2, 9.11.x <= 9.11.1 and 9.5.x <= 9.5.9 fail to prevent detailed error messages from being displayed in Playbooks. An attacker can send a specially crafted request to Playbooks to generate a large response and cause an amplified GraphQL response, potentially crashing the application.

Risk Assessment

Potential remote Denial of Service by an attacker with access to Playbooks, disrupting teams using Mattermost.

Recommendation

Update Mattermost to a version later than 9.10.2, 9.11.1 or 9.5.9 as recommended by the vendor. Consider restricting Playbooks access for untrusted users.

Other vulnerabilities in Mattermost Playbooks

CVE-2026-9812Medium
Mattermost versions 11.9.x <= 11.9.0, 11.8.x <= 11.8.4, 11.7.x <= 11.7.7, 10.11.x <= 10.11.22 fail to validate that a property field belongs to the specified run before updating its value. An authenticated user with run property-management access can crash the Playbooks plugin via a REST request referencing a property field that belongs to a different run.

Original NVD description (English source)

Mattermost versions 9.10.x <= 9.10.2, 9.11.x <= 9.11.1 and 9.5.x <= 9.5.9 fail to prevent detailed error messages from being displayed in Playbooks which allows an attacker to generate a large response and cause an amplified GraphQL response which in turn could cause the application to crash by sending a specially crafted request to Playbooks.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS