UpHeron
All vulnerabilities

Servers and applications

CVE-2023-6547

Mattermost fails to validate team membership when a user attempts to access a playbook, allowing a user with permissions to a playbook but no permissions to the team the playbook is on to access and modify the playbook. This can happen if the user was once a member of the team, got permissions to the playbook and was then removed from the team.

Severity
Medium 5.4
Published
12 Dec 2023
Last changed
17 Jun 2026
Added to UpHeron
1 Nov 2026
Sources
NVD

Affected software

SoftwareAffected versions
MattermostServers and applications · cpe:a:mattermost:mattermost_server
  • Every version up to 8.1.5
  • From 9.2.0 up to 9.2.1

References

  • NVD https://nvd.nist.gov/vuln/detail/CVE-2023-6547
  • CVE.org https://www.cve.org/CVERecord?id=CVE-2023-6547