CVE-2025-35965: Mattermost Playbooks fails to validate the uniqueness and quantity of task actions

The vulnerability description states that Mattermost Playbooks fails to validate the uniqueness and quantity of task actions within the UpdateRunTaskActions GraphQL operation. The provided commit bf2633dad09f5768ce2bea4b7c5ffb74050052a8 from mattermost/mattermost-plugin-playbooks shows direct modifications to two functions: validateUpdateTaskActions in server/api/graphql_root_playbook.go and validateTaskActions in server/api/playbooks.go.

Both functions had code added to limit the number of task actions to 10. This indicates that, prior to the patch, these functions lacked this crucial validation. When the UpdateRunTaskActions GraphQL operation (or other playbook operations) processed task actions, these validation functions would have been called. Their failure to limit the quantity of actions meant that an attacker could submit a large number of actions, leading to server overload and a Denial of Service, as described.

The functions validateUpdateTaskActions and validateTaskActions are therefore identified as vulnerable because, in their pre-patch state, they directly contained the missing validation logic and would have processed an excessive number of task actions. The UpdateRunTaskActions GraphQL operation is the entry point mentioned in the vulnerability, and these functions are key components in its validation process (or lack thereof).

The function names are constructed using the Go package path convention, which typically includes the module path and the package directory structure (github.com/mattermost/mattermost-plugin-playbooks/server/api) followed by the function name. These are the signatures that would likely appear in runtime profiling or stack traces during exploitation. The second commit (2b5275d87136f07e016c8eca09a2f004b31afc8a) simply updates the plugin version in the main Mattermost server, confirming the patched version of the plugin, but does not reveal additional vulnerable functions in the server code itself related to this specific flaw.