The Mattermost Playbooks plugin, in affected Mattermost server versions, fails to verify whether a requesting user has permission to view public playbooks. The plugin returns a list of public playbooks through its /get endpoints without checking the caller’s role or the playbook’s privacy setting. As a result, any user who can reach these endpoints can read the contents of public playbooks that normal access controls would restrict. The weakness maps to CWE-863, Missing Authorization.

Mattermost. The issue exists in server versions 11.5.0 through 11.5.1, 10.11.0 through 10.11.13, and 11.4.0 through 11.4.3. Users running any of these releases are vulnerable unless the Playbooks plugin is removed or the server is upgraded.

The vulnerability is an authentication/authorization flaw that can be triggered by accessing the plugin’s list endpoints over the network. For an attacker who can reach these endpoints— which could be anyone who has network access to the Mattermost instance— the exploit allows read access to private or public playbooks that should be protected. The EPSS score is unavailable, and the vulnerability is not yet listed in CISA KEV. Given the CVSS of 4.3, the risk is moderate but not critical. Attackers do not need elevated privileges; local or remote access suffices. As it requires only the ability to contact the endpoint, rapid exploitation is possible if the plugin remains unpatched.