CVE-2023-49607: Mattermost Server

High severity, CVSS 7.5. EPSS: 0.6% chance of exploitation in the next 30 days.

Mattermost fails to validate the type of the "reminder" body request parameter allowing an attacker to crash the Playbook Plugin when updating the status dialog.

Affected products

• Mattermost Mattermost Server: up to and including 7.8.14; from 8.0.0, up to and including 8.1.5; from 9.0.0, up to and including 9.0.3; from 9.1.0, up to and including 9.1.2; from 9.2.0, up to and including 9.2.1; version 9.1.1 only

Published 2023-12-12. Last modified 2026-06-17.