Skip to main content
cve.nowby Sazabi
← Go
GoPackage

github.com/mattermost/mattermost-plugin-playbooks

6 known vulnerabilities (4 medium, 2 low), with the versions each affects and the releases that fix them.

Latest release
Not known: cve.now hasn't read this package's releases
Newest unaffected release
Not known without release data
Advisories
6 · 4 medium, 2 low
Registry
pkg.go.dev

Advisories 6

  • CVE-2026-6343Medium 4.3

    Mattermost Playbooks Plugin fails to enforce view permissions in list endpoints, allowing unauthorized access to public playbooks

    Affected: fixed in 1.41.1-0.20260309184833-887d9cacb616.

  • Playbooks Plugin fails to validate team transfers, allowing unauthorized removal of member access via playbook update

    Affected: fixed in 1.41.1-0.20260213020129-e1d6ec2c94e6.

  • CVE-2026-26304Medium 4.3

    Permission Bypass in Playbook Run Creation

    Affected: fixed in 1.41.1-0.20260316224925-705f54a81841.

  • Unauthorized Playbooks Post Deletion in Mattermost Playbooks Plugin

    Affected: from 2.0.0; fixed in 1.41.0; all versions.

  • CVE-2025-35965Medium 6.5

    DoS in Mattermost Playbooks via Excessive Task Actions

    Affected: all versions; fixed in 1.41.0; from 2.0.0.

  • CVE-2025-41395Medium 6.5

    Webapp DoS via malicious retrospective post in Playbooks

    Affected: all versions; fixed in 1.41.0; from 2.0.0.