CVE-2025-41423

Unauthorized Playbooks Post Deletion in Mattermost Playbooks Plugin

3.1 LowFix available

Mattermost versions 10.4.x <= 10.4.2, 10.5.x <= 10.5.0, 9.11.x <= 9.11.10 fail to properly validate permissions for the API endpoint /plugins/playbooks/api/v0/signal/keywords/ignore-thread, allowing any user or attacker to delete posts containing actions created by the Playbooks bot, even without channel access or appropriate permissions.

Attack profile

How easy it is to exploit

Attack vector: Network
Complexity: High
Privileges needed: Low
User interaction: None

What an attacker can affect

Confidentiality: None
Integrity: Low
Availability: None

Exploit likelihood

0.28%Up 0.3 points since Apr 24, 2025

What each source reports

CVE List Score used 3.1

Unauthorized Playbooks Post Deletion in Mattermost Playbooks Plugin

Record: CVE-2025-41423
CVSS 3.1: 3.1 LowCVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N
Weakness: CWE-863
Updated: 2026-11-02

EUVDEUVD-2025-12103 3.1

Record: EUVD-2025-12103
CVSS 3.1: 3.1 LowCVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N
Updated: 2026-11-02

GitHub AdvisoriesGHSA-fr22-5377-f3p7 3.1

Mattermost Playbooks fails to properly validate permissions

Record: GHSA-fr22-5377-f3p7
CVSS 3.1: 3.1 LowCVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N
Weakness: CWE-863
Updated: 2026-11-02

NVD 3.1

Record: CVE-2025-41423
CVSS 3.1: 3.1 LowCVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N
CVSS 3.1: 4.3 MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
Weakness: CWE-863
Updated: 2026-11-02

OSV 3.1

Unauthorized Playbooks Post Deletion in Mattermost Playbooks Plugin

Record: CVE-2025-41423
CVSS 3.1: 3.1 LowCVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N
Weakness: CWE-863
Updated: 2026-11-02

OSVGHSA-fr22-5377-f3p7 3.1

Mattermost Playbooks fails to properly validate permissions

Record: GHSA-fr22-5377-f3p7
CVSS 3.1: 3.1 LowCVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N
Weakness: CWE-863
Updated: 2026-11-02

OSVGO-2025-3644 No score

Mattermost Playbooks fails to properly validate permissions in github.com/mattermost/mattermost-plugin-playbooks

Mattermost Playbooks fails to properly validate permissions in github.com/mattermost/mattermost-plugin-playbooks.

NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions.

(If this is causing false-positive reports from vulnerability scanners, please suggest an edit to the report.)

The additional affected modules and versions are: .

Record: GO-2025-3644
Updated: 2026-11-02

OSVopenSUSE-SU-2025:15033-1 No score

govulncheck-vulndb-0.0.20250424T181457-1.1 on GA media

These are all security issues fixed in the govulncheck-vulndb-0.0.20250424T181457-1.1 package on the GA media of openSUSE Tumbleweed.

Record: openSUSE-SU-2025:15033-1
Updated: 2026-11-02

Affected products

Affected packages

Affected packages
Package	Affected	Fixed
`github.com/mattermost/mattermost-plugin-playbooks` Go	2.0.0 up to 2.1.1	2.1.1
`github.com/mattermost/mattermost-plugin-playbooks` Go	before 1.41.0	1.41.0
`github.com/mattermost/mattermost/server/v8` Go	before 8.0.0-20250218121836-2b5275d87136	8.0.0-20250218121836-2b5275d87136
`github.com/mattermost/mattermost/server/v8` Go	10.4.0 up to 10.4.3	10.4.3
`github.com/mattermost/mattermost/server/v8` Go	10.5.0 up to 10.5.1	10.5.1
`github.com/mattermost/mattermost/server/v8` Go	9.11.0 up to 9.11.11	9.11.11
`github.com/mattermost/mattermost-plugin-playbooks` Go	2.0.0 and later	None known
`github.com/mattermost/mattermost/server/v8` Go	10.4.0 and later	None known
`github.com/mattermost/mattermost/server/v8` Go	10.5.0 and later	None known
`github.com/mattermost/mattermost/server/v8` Go	9.11.0 and later	None known

Show 8 moreShow less

Affected packages
Package	Affected	Fixed
`github.com/mattermost/mattermost-plugin-playbooks` Go	All versions	None known
`github.com/mattermost/mattermost-server` Go	9.11.0+incompatible and later	None known
`github.com/mattermost/mattermost-server` Go	10.4.0+incompatible and later	None known
`github.com/mattermost/mattermost-server` Go	10.5.0+incompatible and later	None known
`github.com/mattermost/mattermost-server/v5` Go	All versions	None known
`github.com/mattermost/mattermost-server/v6` Go	All versions	None known
`github.com/mattermost/mattermost/server/v8` Go	All versions	None known
`govulncheck-vulndb` openSUSE:Tumbleweed From an advisory covering 5 CVEs	before 0.0.20250424T181457-1.1	0.0.20250424T181457-1.1

History

History
Recorded	Changed	Sources
Nov 6, 2026	affected, facts
Nov 2, 2026	first indexed	CVE List, EUVD, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2025-41423 is a low vulnerability (CVSS 3.1) in Mattermost, published April 24, 2025. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.28%, the 20th percentile. Fixed in github.com/mattermost/mattermost-plugin-playbooks 2.1.1.

References

Show 7 moreShow less