CVE-2023-6727 — Leak Inaccessible Playbook Information via Channel Action IDOR
Mattermost fails to perform correct authorization checks when creating a playbook action, allowing users without access to the playbook to create playbook actions. If the playbo…
Published: 2023-12-12 · CVSS: 3.1 · CVSS 3.1
Mattermost fails to perform correct authorization checks when creating a playbook action, allowing users without access to the playbook to create playbook actions. If the playbook action created is to post a message in a channel based on specific keywords in a post, some playbook information, like the name, can be leaked.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7