CVE-2024-36255

Post actions can run playbook checklist task commands

MEDIUM

5.7

CVSS Score

Published: May 26, 2024 at 01:32 PM UTC

Updated: June 17, 2026 at 07:36 AM UTC

2 products affected across 1 vendorMattermost ServerMattermost

Using Mattermost by Mattermost?

Get instant alerts when new vulnerabilities affect Mattermost - before attackers find them.

Real-time alertsTrack your software stackFree plan available

Start Free Sign In

Severity

MEDIUM5.7

Exploit prediction

EPSS 0.2%

SSVC

No known exploit

Description

Mattermost versions 9.5.x <= 9.5.3, 9.6.x <= 9.6.1 and 8.1.x <= 8.1.12 fail to perform proper input validation on post actions which allows an attacker to run a playbook checklist task command as another user via creating and sharing a deceptive post action that unexpectedly runs a slash command in some arbitrary channel.

Affected

Our own answer: ranges merged, affected separated from platform-only, with confidence and review flags.

Mattermost · Mattermost

95%

8.1.0 ≤ v ≤ 8.1.128.1.x ≤ v ≤ 8.1.129.5.0 ≤ v ≤ 9.5.39.5.x ≤ v ≤ 9.5.39.6.0 ≤ v ≤ 9.6.19.6.x ≤ v ≤ 9.6.18.1.0 8.1.12 8.1.x 9.5.0 9.5.3 9.5.x 9.6.0 9.6.1 9.6.x

Vendor states this is fixed in 8.1.13 (unaffected)

Vendor states this is fixed in 9.5.4 (unaffected)

Vendor states this is fixed in 9.6.2 (unaffected)

Vendor states this is fixed in 9.7.0 (unaffected)

Mattermost Server · Mattermost

95%

8.1.0 ≤ v < 8.1.139.5.0 ≤ v < 9.5.49.6.0 ≤ v < 9.6.2