Mattermost Playbooks Guest User Access Vulnerability

A vulnerability exists in Mattermost versions 10.5.x through 10.5.5, 9.11.x through 9.11.15, 10.8.x through 10.8.0, 10.7.x through 10.7.2, and 10.6.x through 10.6.5. The issue arises because these versions do not properly retrieve requestor information from the playbooks handler for guest users. This flaw allows an attacker to access playbook runs that should be restricted.

Impact

Exploitation of this vulnerability allows unauthorized access to playbook runs for guest users, potentially leading to exposure of sensitive information or actions within the playbook.

Remediation

Users can upgrade to Mattermost versions 10.9.0, 10.8.2, 10.7.4, 10.6.6, or 9.11.17 to address this vulnerability.