CVE-2023-6727
Leak Inaccessible Playbook Information via Channel Action IDOR
Summary
Leak Inaccessible Playbook Information via Channel Action IDOR
Original description
The description as published by the source.
Mattermost fails to perform correct authorization checks when creating a playbook action, allowing users without access to the playbook to create playbook actions. If the playbook action created is to post a message in a channel based on specific keywords in a post, some playbook information, like the name, can be leaked.
References
- advisory github.com
- advisory nvd.nist.gov
- web mattermost.com