Skip to content
CVE PROGRAM SOURCE RECORD4.3 Medium

CVE-2024-5272

Run Details leak to guest via webhook event "custom_playbooks_playbook_run_updated"

Description

Mattermost versions 9.5.x <= 9.5.3, 9.6.x <= 9.6.1, 8.1.x <= 8.1.12 fail to restrict the audience of the "custom_playbooks_playbook_run_updated" webhook event, which allows a guest on a channel with a playbook run linked to see all the details of the playbook run when the run is marked by finished.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

Mattermost Mattermost

Default version status: unaffected

  • 9.5.0 to ≤ 9.5.3affected
  • 9.6.0 to ≤ 9.6.1affected
  • 8.1.0 to ≤ 8.1.12affected
  • 9.7.0unaffected
  • 9.5.4unaffected
  • 9.6.2unaffected
  • 8.1.13unaffected

References