← CVE Intelligence

CVE-2023-49874

IDOR when updating the tasks of a private playbook run PUBLISHED

Description (CNA)

Mattermost fails to check whether a user is a guest when updating the tasks of a private playbook run allowing a guest to update the tasks of a private playbook run if they know the run ID.

Affected (CNA)

Vendor / productVersions
Mattermost / Mattermostaffected 0 through 8.1.5; affected 0 through 9.0.3; affected 0 through 9.1.2; affected 0 through 9.2.1; affected 0 through 7.8.14; unaffected 9.2.2; unaffected 8.1.6; unaffected 9.0.4; unaffected 9.1.3; unaffected 7.8.15

CWE

CWE-284

References

ADP enrichment

CVE

No English description supplied.