CVE-2025-41423: 
Chainguard vulnerability analysis and mitigation

Mattermost versions 10.4.x <= 10.4.2, 10.5.x <= 10.5.0, 9.11.x <= 9.11.10 contain a permission validation vulnerability in the API endpoint /plugins/playbooks/api/v0/signal/keywords/ignore-thread. The vulnerability was discovered and disclosed on April 24, 2025 (NVD).

The vulnerability stems from improper permission validation in the API endpoint /plugins/playbooks/api/v0/signal/keywords/ignore-thread. This allows any authenticated user or attacker to delete posts containing actions created by the Playbooks bot, even without having channel access or appropriate permissions. The vulnerability has been assigned a CVSS v3.1 base score of 3.1 LOW with vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N, indicating network attack vector with high complexity, low privileges required, and no user interaction needed (NVD).

The vulnerability allows unauthorized deletion of posts containing Playbooks bot actions, potentially disrupting workflow and communication channels. The impact is limited to integrity (modification/deletion of data) with no confidentiality or availability impacts (NVD).

The vulnerability requires an authenticated user account with low privileges to exploit. While the attack complexity is considered high, no user interaction is needed once the attacker has authentication (NVD).

Users should upgrade to the latest version of Mattermost that contains the fix for this vulnerability. The fixed versions are: 10.4.3+, 10.5.1+, and 9.11.11+ (Mattermost).