CVE-2025-41423

LOW Year: 2025
CVSS v3 Score
3.1
Low
Weakness Type
CWE-863
View all →

Vulnerability Description

Mattermost versions 10.4.x <= 10.4.2, 10.5.x <= 10.5.0, 9.11.x <= 9.11.10 fail to properly validate permissions for the API endpoint /plugins/playbooks/api/v0/signal/keywords/ignore-thread, allowing any user or attacker to delete posts containing actions created by the Playbooks bot, even without channel access or appropriate permissions.

Related Vulnerabilities

CVE-2020-5418

LOW
CVSS:3.1(Low)

Cloud Foundry CAPI (Cloud Controller) versions prior to 1.98.0 allow authenticated users having only the "cloud_controller.read" scope, but no roles in any spaces, to list all droplets in all spaces (...

CWE-8632020

CVE-2023-3584

LOW
CVSS:3.1(Low)

Mattermost fails to properly check the authorization of POST /api/v4/teams when passing a team override scheme ID in the request, allowing an authenticated attacker with knowledge of a Team Override S...

CWE-8632023

CVE-2023-4658

LOW
CVSS:3.1(Low)

An issue has been discovered in GitLab EE affecting all versions starting from 8.13 before 16.4.3, all versions starting from 16.5 before 16.5.3, all versions starting from 16.6 before 16.6.1. It was ...

CWE-8632023

CVE-2024-10043

LOW
CVSS:3.1(Low)

An issue has been discovered in GitLab EE affecting all versions starting from 14.3 before 17.4.6, all versions starting from 17.5 before 17.5.4 all versions starting from 17.6 before 17.6.2, that all...

CWE-8632024

CVE-2024-27288

LOW
CVSS:3.1(Low)

1Panel is an open source Linux server operation and maintenance management panel. Prior to version 1.10.1-lts, users can use Burp to obtain unauthorized access to the console page. The vulnerability h...

CWE-8632024

CVE-2024-47780

LOW
CVSS:3.1(Low)

TYPO3 is a free and open source Content Management Framework. Backend users could see items in the backend page tree without having access if the mounts pointed to pages restricted for their user/grou...

CWE-8632024