CVE-2023-6547 Playbooks access/modification by removed team member

Low 3.7 Published 12 Dec 2023 Updated 12 May 2025

Removed team members can access and modify playbooks due to missing team membership validation, requiring a patch to enforce proper authorization checks.

Exploited in the wild: Not known
Login needed: Any signed-in user
Attackable: Over the internet
Victim action needed: A user has to click or open something
Fix: Available

What is CVE-2023-6547?

CVE-2023-6547 is a low-severity missing authorization vulnerability in Mattermost Mattermost Server, published on 12 Dec 2023. Any signed-in user can exploit it over the network, and only if a user opens a file or follows a link.

Official description

Mattermost fails to validate team membership when a user attempts to access a playbook, allowing a user with permissions to a playbook but no permissions to the team the playbook is on to access and modify the playbook. This can happen if the user was once a member of the team, got permissions to the playbook and was then removed from the team.

Weakness: CWE-284

Which versions are affected by CVE-2023-6547?

1 open source package ship an affected version, including mattermost. It affects 1 product.

Package	Affected	Fixed in
`mattermost` Bitnami	All versions	`8.1.6, 9.2.2`

Products include Mattermost Mattermost Server.

How do I fix CVE-2023-6547?

Upgrade mattermost to a fixed version for your release line: 8.1.6 or 9.2.2.

Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.

Is CVE-2023-6547 being exploited?

There is no known exploitation of CVE-2023-6547 in the wild and no public exploit code.

All Mattermost Mattermost Server vulnerabilities

Sources

Also known as BIT-mattermost-2023-6547, GHSA-4gj5-jpg2-r4vj.