CVE-2025-41423: 
Chainguard vulnerability analysis and mitigation

Mattermost versions 10.4.x <= 10.4.2, 10.5.x <= 10.5.0, 9.11.x <= 9.11.10 contain a permission validation vulnerability in the API endpoint /plugins/playbooks/api/v0/signal/keywords/ignore-thread. The vulnerability was discovered and disclosed on April 24, 2025 (NVD).

The vulnerability stems from improper permission validation in the API endpoint /plugins/playbooks/api/v0/signal/keywords/ignore-thread. This allows any authenticated user or attacker to delete posts containing actions created by the Playbooks bot, even without having channel access or appropriate permissions. The vulnerability has been assigned a CVSS v3.1 base score of 3.1 LOW with vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N, indicating network attack vector with high complexity, low privileges required, and no user interaction needed (NVD).

The vulnerability allows unauthorized deletion of posts containing Playbooks bot actions, potentially disrupting workflow and communication channels. The impact is limited to integrity (modification/deletion of data) with no confidentiality or availability impacts (NVD).

Users should upgrade to the latest version of Mattermost that contains the fix for this vulnerability. The fixed versions are: 10.4.3+, 10.5.1+, and 9.11.11+ (Mattermost).