CVE-2023-2791 MEDIUM

CVE-2023-2791: Playbooks lets you edit arbitrary posts

Vendor Mattermost
Product Mattermost
Weakness CWE-862 · Missing authorization
Published June 16, 2023
Last update December 6, 2024
View on NVD All CVEs

CVSS base score

4.3/10
Attack vector Network
Attack complexity Low
Privileges required Low
User interaction None
Confidentiality None
Integrity Low

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

What the vulnerability does

01Description

When creating a playbook run via the /dialog API, Mattermost fails to validate all parameters, allowing an authenticated attacker to edit an arbitrary channel post.

Key dates

02Disclosure timeline

June 16, 2023 CVE published
December 6, 2024 Record updated

Related vulnerabilities

04Related CVE

CVE-2025-41345 Missing Authorization vulnerability in CanalDenuncia.app CVE-2023-35051 WordPress Contact Forms by Cimatti plugin <= 1.5.7 - Broken Access Control vulnerability CVE-2025-64404 Apache OpenOffice: Remote documents loaded without prompt via background and bullet images CVE-2024-42434 Zoom Workplace Apps, SDKs, Rooms Clients, and Rooms Controllers - Missing Authorization CVE-2023-5132 Soisy Pagamento Rateale <= 6.0.1 - Missing Authorization to Sensitive Information Exposure