CVE-2023-49874 (published 2023-12-12T08:17:53.947Z)
Mattermost fails to check whether a user is a guest when updating the tasks of a private playbook run allowing a guest to update the tasks of a private playbook run if they know the run ID.


Affected products: Vendor: Mattermost
Product: Mattermost
Versions: 0, 0, 0, 0, 0, 9.2.2, 8.1.6, 9.0.4, 9.1.3, 7.8.15