Mattermost Public Playbook Access Vulnerability Due to Improper Permission Checks

A vulnerability exists in Mattermost versions 11.5.x through 11.5.1, 10.11.x through 10.11.13, and 11.4.x through 11.4.3. These versions fail to properly verify public and private permissions, allowing unauthorized members to access public playbooks via the '/get' endpoint. This issue arises from inadequate permission validation, which can be exploited to access restricted content.

Impact

Exploitation of this vulnerability allows unauthorized access to public playbooks, potentially leading to unauthorized information disclosure.

Remediation

Users can upgrade to Mattermost versions 11.7.0, 11.6.1, or 11.4.5 to address this vulnerability.