Unauthorized channel member management through playbook runs

Summary

Mattermost versions 10.5.x <= 10.5.5, 9.11.x <= 9.11.15, 10.8.x <= 10.8.0, 10.7.x <= 10.7.2, 10.6.x <= 10.6.5 fail to properly enforce channel member management permissions in playbook runs, allowing authenticated users without the 'Manage Channel Members' permission to add or remove users from public and private channels by manipulating playbook run participants when the run is linked to a channel.

Timeline

1. Jun 20, 2025, 2:31 PM UTCCVE published
2. Jun 23, 2025, 8:44 PM UTCCISA SSVC assessment

   Exploitation: none · Automatable: no · Technical impact: partial

3. Jun 23, 2025, 8:44 PM UTCRecord last updated

Affected versions

• Mattermost Mattermost

  From 10.5.0 · through 10.5.5; From 9.11.0 · through 9.11.15; From 10.7.0 · through 10.7.2; From 10.6.0 · through 10.6.5

• github.com/mattermost/mattermost-serverGo

  fixed in 0.0.0-20250520060012-d0380305ef7a

• github.com/mattermost/mattermost/server/v8Go

  fixed in 8.0.0-20250520060012-d0380305ef7a

• github.com/mattermost/mattermost/server/v8Go

  From 10.5.0 · fixed in 10.5.6

• github.com/mattermost/mattermost/server/v8Go

  From 9.11.0 · fixed in 9.11.16

• github.com/mattermost/mattermost/server/v8Go

  From 10.8.0 · fixed in 10.8.1

• github.com/mattermost/mattermost/server/v8Go

  From 10.7.0 · fixed in 10.7.3

• github.com/mattermost/mattermost/server/v8Go

  From 10.6.0 · fixed in 10.6.6

• github.com/mattermost/mattermost-serverGo

  fixed in 0.0.0-20250520060012-d0380305ef7a; From 9.11.0+incompatible · fixed in 9.11.16+incompatible; From 10.5.0+incompatible · fixed in 10.5.6+incompatible; From 10.6.0+incompatible · fixed in 10.6.6+incompatible; From 10.7.0+incompatible · fixed in 10.7.3+incompatible; From 10.8.0+incompatible · fixed in 10.8.1+incompatible

• github.com/mattermost/mattermost-server/v5Go

  All versions

• github.com/mattermost/mattermost-server/v6Go

  All versions

References 1