CVE-2023-27263 MEDIUM

CVE-2023-27263: IDOR: Accessing playbook runs via the Playbooks Runs API

Vendor Mattermost
Product Mattermost
Weakness CWE-862 · Missing authorization
Published February 27, 2023
Last update December 6, 2024
View on NVD All CVEs

CVSS base score

4.3/10
Attack vector Network
Attack complexity Low
Privileges required Low
User interaction None
Confidentiality Low
Integrity None

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

What the vulnerability does

01Description

A missing permissions check in the /plugins/playbooks/api/v0/runs API in Mattermost allows an attacker to list and view playbooks belonging to a team they are not a member of.

Key dates

02Disclosure timeline

February 27, 2023 CVE published
December 6, 2024 Record updated

Related vulnerabilities

04Related CVE

CVE-2025-39602 WordPress WooCommerce Product Table Lite plugin <= 3.9.5 - Broken Access Control vulnerability CVE-2026-26104 Udisks: missing authorization check allows unprivileged users to back up luks headers via udisks d-bus api CVE-2025-23613 WordPress WP Journal plugin <= 1.1 - Broken Access Control vulnerability CVE-2023-2556 WPCS – WordPress Currency Switcher Professional <= 1.1.9 - Missing Authorization to Arbitrary Custom Drop-Down Currency Switcher Deletion CVE-2025-8342 WooCommerce OTP Login With Phone Number, OTP Verification <= 1.8.47 - Authentication Bypass