CVE-2023-2783 MEDIUM

CVE-2023-2783: App Framework does not checks for the secret provided in the incoming webhook request

Vendor Mattermost
Product Mattermost App Framework
Weakness CWE-862 · Missing authorization
Published June 16, 2023
Last update December 6, 2024
View on NVD All CVEs

CVSS base score

4.3/10
Attack vector Network
Attack complexity Low
Privileges required Low
User interaction None
Confidentiality None
Integrity Low

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

What the vulnerability does

01Description

Mattermost Apps Framework fails to verify that a secret provided in the incoming webhook request allowing an attacker to modify the contents of the post sent by the Apps.

Key dates

02Disclosure timeline

June 16, 2023 CVE published
December 6, 2024 Record updated

Related vulnerabilities

04Related CVE

CVE-2025-14481 Yoast SEO <= 26.5 - Insecure Direct Object Reference to Authenticated (Contributor+) Sensitive Information Exposure via 'post_id' Parameter CVE-2024-0828 Play.ht – Make Your Blog Posts Accessible With Text to Speech Audio <= 3.6.4 - Missing Authorization CVE-2026-5347 WP Books Gallery <= 4.8.0 - Missing Authorization to Unauthenticated Settings Update via 'permalink_structure' Parameter CVE-2025-24778 WordPress No Spam At All plugin <= 1.3 - Broken Access Control Vulnerability CVE-2025-26368