GoPackage

github.com/mattermost/mattermost-server

296 known vulnerabilities (5 critical, 18 high, 147 medium, 62 low), with the versions each affects and the releases that fix them.

Latest release: Not known: cve.now hasn't read this package's releases
Newest unaffected release: Not known without release data
Advisories: 296 · 5 critical, 18 high, 147 medium, 62 low

Registry: pkg.go.dev

Advisories 296

CVE-2026-8823Low 3.8
User Manager can demote bot accounts to guest without bot-management permission
Affected: from 11.7.0, fixed in 11.7.1; from 10.11.0, fixed in 10.11.18; from 10.11.0+incompatible, fixed in 10.11.18+incompatible; from 11.7.0+incompatible, fixed in 11.7.1+incompatible.
CVE-2026-6062Medium 6.4
IDOR in Jira plugin subscription edit endpoint
Affected: from 10.11.0+incompatible, fixed in 10.11.18+incompatible; from 11.5.0+incompatible, fixed in 11.5.6+incompatible; from 11.6.0+incompatible, fixed in 11.6.3+incompatible; from 11.7.0+incompatible, fixed in 11.7.1+incompatible; from 11.7.0, fixed in 11.7.1; from 11.6.0, fixed in 11.6.3; from 11.5.0, fixed in 11.5.6; from 10.11.0, fixed in 10.11.18.
CVE-2026-6673Medium 6.4
Mattermost Jira plugin had unauthenticated {{/ac/installed}} lifecycle callback during pending Jira Cloud install
Affected: from 11.7.0, fixed in 11.7.1; from 11.6.0, fixed in 11.6.3; from 11.5.0, fixed in 11.5.6; from 10.11.0, fixed in 10.11.18; from 10.11.0+incompatible, fixed in 10.11.18+incompatible; from 11.5.0+incompatible, fixed in 11.5.6+incompatible; from 11.6.0+incompatible, fixed in 11.6.3+incompatible; from 11.7.0+incompatible, fixed in 11.7.1+incompatible.
CVE-2026-8074Low 3.8
Improper Permission Check Allows User Manager to Deactivate Bot Accounts
Affected: from 11.7.0, fixed in 11.7.1; from 10.11.0, fixed in 10.11.18; from 10.11.0+incompatible, fixed in 10.11.18+incompatible; from 11.7.0+incompatible, fixed in 11.7.1+incompatible.
CVE-2026-9162Medium 4.3
Global session revocation does not invalidate active WebSocket connections
Affected: from 10.11.0+incompatible, fixed in 10.11.18+incompatible; from 11.5.0+incompatible, fixed in 11.5.6+incompatible; from 11.6.0+incompatible, fixed in 11.6.3+incompatible; from 11.7.0+incompatible, fixed in 11.7.1+incompatible; from 11.7.0, fixed in 11.7.1; from 11.6.0, fixed in 11.6.3; from 11.5.0, fixed in 11.5.6; from 10.11.0, fixed in 10.11.18.
CVE-2026-5139Medium 5.4
GitLab Plugin Allows Non-Admin Users to Modify Default Instance Configuration
Affected: from 11.7.0, fixed in 11.7.1; from 11.6.0, fixed in 11.6.3; from 11.5.0, fixed in 11.5.6; from 10.11.0, fixed in 10.11.18; from 10.11.0+incompatible, fixed in 10.11.18+incompatible; from 11.5.0+incompatible, fixed in 11.5.6+incompatible; from 11.6.0+incompatible, fixed in 11.6.3+incompatible; from 11.7.0+incompatible, fixed in 11.7.1+incompatible.
CVE-2026-6961High 7.6
CVE-2026-6961: Path traversal via unsanitized FileInfo.Name in Mattermost federation sync
Affected: from 10.11.0+incompatible, fixed in 10.11.17+incompatible; from 11.5.0+incompatible, fixed in 11.5.5+incompatible; from 11.6.0+incompatible, fixed in 11.6.1+incompatible; from 11.6.0, fixed in 11.6.1; from 11.5.0, fixed in 11.5.5; from 10.11.0, fixed in 10.11.17.
CVE-2026-7387High 8.8
Mattermost group syncable endpoints allow privilege escalation via scheme_admin
Affected: from 10.11.0+incompatible, fixed in 10.11.17+incompatible; from 11.5.0+incompatible, fixed in 11.5.5+incompatible; from 11.6.0+incompatible, fixed in 11.6.1+incompatible; from 11.6.0, fixed in 11.6.1; from 11.5.0, fixed in 11.5.5; from 10.11.0, fixed in 10.11.17.
CVE-2026-6046Medium 5.3
Plugin bot username conflict allows user account to be used as bot identity in Mattermost Server
Affected: from 11.6.0, fixed in 11.6.1; from 11.5.0, fixed in 11.5.5; from 10.11.0, fixed in 10.11.17; from 10.11.0+incompatible, fixed in 10.11.17+incompatible; from 11.5.0+incompatible, fixed in 11.5.5+incompatible; from 11.6.0+incompatible, fixed in 11.6.1+incompatible.
CVE-2026-6689Medium 4.3
Missing {{invite_user}} permission check on team creation allows unprivileged users to set open-invite and allowed-domains team settings
Affected: from 11.6.0, fixed in 11.6.1; from 11.5.0, fixed in 11.5.5; from 10.11.0, fixed in 10.11.17; from 10.11.0+incompatible, fixed in 10.11.17+incompatible; from 11.5.0+incompatible, fixed in 11.5.5+incompatible; from 11.6.0+incompatible, fixed in 11.6.1+incompatible.
CVE-2026-7184Medium 6.5
Mattermost Remote Cluster PATCH API Leaks Authentication Tokens
Affected: from 10.11.0+incompatible, fixed in 10.11.16+incompatible; from 11.5.0+incompatible, fixed in 11.5.5+incompatible; from 11.6.0+incompatible, fixed in 11.6.1+incompatible; from 11.6.0, fixed in 11.6.1; from 11.5.0, fixed in 11.5.5; from 10.11.0, fixed in 10.11.16.
CVE-2026-6739Medium 6.7
Mattermost: Delegated admins could patch protected default system roles
Affected: from 10.11.0+incompatible, fixed in 10.11.17+incompatible; from 11.5.0+incompatible, fixed in 11.5.5+incompatible; from 11.6.0+incompatible, fixed in 11.6.1+incompatible; from 11.6.0, fixed in 11.6.1; from 11.5.0, fixed in 11.5.5; from 10.11.0, fixed in 10.11.17.
CVE-2026-3433Medium 4.3
Mattermost fails to scope role_updated websocket events to authorized team and channel members
Affected: from 10.11.0+incompatible, fixed in 10.11.17+incompatible; from 11.5.0+incompatible, fixed in 11.5.5+incompatible; from 11.6.0+incompatible, fixed in 11.6.1+incompatible; from 11.6.0, fixed in 11.6.1; from 11.5.0, fixed in 11.5.5; from 10.11.0, fixed in 10.11.17.
CVE-2026-4915Medium 6.5
Server panic via outgoing webhook responses
Affected: from 11.6.0, fixed in 11.6.1; from 11.5.0, fixed in 11.5.4; from 11.4.0, fixed in 11.4.5; from 10.11.0, fixed in 10.11.15; from 10.11.0+incompatible, fixed in 10.11.15+incompatible; from 11.4.0+incompatible, fixed in 11.4.5+incompatible; from 11.5.0+incompatible, fixed in 11.5.4+incompatible; from 11.6.0+incompatible, fixed in 11.6.1+incompatible.
CVE-2026-28735Medium 5.4
GitHub OAuth Scope Validation
Affected: from 11.6.0, fixed in 11.6.1; from 11.5.0, fixed in 11.5.4; from 11.4.0, fixed in 11.4.5; from 10.11.0, fixed in 10.11.15; from 10.11.0+incompatible, fixed in 10.11.15+incompatible; from 11.4.0+incompatible, fixed in 11.4.5+incompatible; from 11.5.0+incompatible, fixed in 11.5.4+incompatible; from 11.6.0+incompatible, fixed in 11.6.1+incompatible.

Show all 296 advisoriesShow fewer advisories

CVE-2026-4635Medium 6.5
Persistent notification timing attack causing server denial of service
Affected: from 10.11.0+incompatible, fixed in 10.11.15+incompatible; from 11.4.0+incompatible, fixed in 11.4.5+incompatible; from 11.5.0+incompatible, fixed in 11.5.4+incompatible; from 11.6.0+incompatible, fixed in 11.6.1+incompatible; from 11.6.0, fixed in 11.6.1; from 11.5.0, fixed in 11.5.4; from 11.4.0, fixed in 11.4.5; from 10.11.0, fixed in 10.11.15.
CVE-2026-3473Medium 5.9
Improper file ownership validation in the Boards API allows unauthorised file access
Affected: from 11.6.0, fixed in 11.6.1; from 11.5.0, fixed in 11.5.4; from 11.4.0, fixed in 11.4.5; from 10.11.0, fixed in 10.11.15; from 10.11.0+incompatible, fixed in 10.11.15+incompatible; from 11.4.0+incompatible, fixed in 11.4.5+incompatible; from 11.5.0+incompatible, fixed in 11.5.4+incompatible; from 11.6.0+incompatible, fixed in 11.6.1+incompatible.
CVE-2026-4646Medium 4.3
Insufficient input validation in GitHub plugin API causes denial of service
Affected: from 10.11.0+incompatible, fixed in 10.11.15+incompatible; from 11.4.0+incompatible, fixed in 11.4.5+incompatible; from 11.5.0+incompatible, fixed in 11.5.4+incompatible; from 11.6.0+incompatible, fixed in 11.6.1+incompatible; from 11.6.0, fixed in 11.6.1; from 11.5.0, fixed in 11.5.4; from 11.4.0, fixed in 11.4.5; from 10.11.0, fixed in 10.11.15.
CVE-2026-3636Medium 4.3
Sanitize team member data returned by API
Affected: from 11.6.0, fixed in 11.6.1; from 11.5.0, fixed in 11.5.4; from 11.4.0, fixed in 11.4.5; from 10.11.0, fixed in 10.11.15; from 10.11.0+incompatible, fixed in 10.11.15+incompatible; from 11.4.0+incompatible, fixed in 11.4.5+incompatible; from 11.5.0+incompatible, fixed in 11.5.4+incompatible; from 11.6.0+incompatible, fixed in 11.6.1+incompatible.
CVE-2026-5740High 7.5
Unauthenticated WebSocket binary frame causes denial of service in Mattermost Server
Affected: from 11.6.0, fixed in 11.6.1; from 11.5.0, fixed in 11.5.4; from 11.4.0, fixed in 11.4.5; from 10.11.0, fixed in 10.11.15; from 10.11.0+incompatible, fixed in 10.11.15+incompatible; from 11.4.0+incompatible, fixed in 11.4.5+incompatible; from 11.5.0+incompatible, fixed in 11.5.4+incompatible; from 11.6.0+incompatible, fixed in 11.6.1+incompatible.
CVE-2026-5308Medium 4.9
Missing request body size limits on Zoom plugin HTTP endpoints
Affected: from 10.11.0+incompatible, fixed in 10.11.15+incompatible; from 11.4.0+incompatible, fixed in 11.4.5+incompatible; from 11.5.0+incompatible, fixed in 11.5.4+incompatible; from 11.6.0+incompatible, fixed in 11.6.1+incompatible; from 11.6.0, fixed in 11.6.1; from 11.5.0, fixed in 11.5.4; from 11.4.0, fixed in 11.4.5; from 10.11.0, fixed in 10.11.15.
CVE-2026-5755Medium 6.5
Denial of service via crafted TIFF file upload
Affected: from 10.11.0+incompatible, fixed in 10.11.15+incompatible; from 11.4.0+incompatible, fixed in 11.4.5+incompatible; from 11.5.0+incompatible, fixed in 11.5.4+incompatible; from 11.6.0+incompatible, fixed in 11.6.1+incompatible; from 11.6.0, fixed in 11.6.1; from 11.5.0, fixed in 11.5.4; from 11.4.0, fixed in 11.4.5; from 10.11.0, fixed in 10.11.15.
CVE-2026-4858High 8.0
Path traversal in integration action URL leading to arbitrary API execution via system admin’s auth token.
Affected: from 11.6.0, fixed in 11.6.1; from 11.5.0, fixed in 11.5.4; from 11.4.0, fixed in 11.4.5; from 10.11.0, fixed in 10.11.15; from 10.11.0+incompatible, fixed in 10.11.15+incompatible; from 11.4.0+incompatible, fixed in 11.4.5+incompatible; from 11.5.0+incompatible, fixed in 11.5.4+incompatible; from 11.6.0+incompatible, fixed in 11.6.1+incompatible.
CVE-2026-4055Medium 4.3
Insufficient permission validation on cross-team playbook run creation
Affected: all versions.
CVE-2026-6333Low 3.5
SSRF via Host Header Spoofing in Custom Slash Commands
Affected: fixed in 5.3.2-0.20260325160634-e738016c5920; from 10.11.0+incompatible, fixed in 10.11.14+incompatible; from 11.5.0+incompatible, fixed in 11.5.2+incompatible.
CVE-2026-6345Medium 6.5
Prevent password disclosure and force reset during Slack import
Affected: fixed in 5.3.2-0.20260311102650-3057ae7e83e9; from 10.11.0+incompatible, fixed in 10.11.14+incompatible; from 11.4.0+incompatible, fixed in 11.4.4+incompatible; from 11.5.0+incompatible, fixed in 11.5.2+incompatible.
CVE-2026-6346High 8.7
Sensitive credentials exposed in plaintext in Mattermost support packets
Affected: from 10.11.0+incompatible, fixed in 10.11.14+incompatible; from 11.4.0+incompatible, fixed in 11.4.4+incompatible; from 11.5.0+incompatible, fixed in 11.5.2+incompatible; fixed in 5.3.2-0.20260326202606-fac92f4a71f3.
CVE-2026-28732Medium 4.3
Slash command trigger-word update allowed command hijacking
Affected: fixed in 5.3.2-0.20260306123948-f5fe8ded6b63; from 10.11.0+incompatible, fixed in 10.11.14+incompatible; from 11.4.0+incompatible, fixed in 11.4.4+incompatible; from 11.5.0+incompatible, fixed in 11.5.2+incompatible.
CVE-2026-6343Medium 4.3
Mattermost Playbooks Plugin fails to enforce view permissions in list endpoints, allowing unauthorized access to public playbooks
Affected: from 10.11.0+incompatible, fixed in 10.11.14+incompatible; from 11.4.0+incompatible, fixed in 11.4.4+incompatible; from 11.5.0+incompatible, fixed in 11.5.2+incompatible.
CVE-2026-6347High 7.6
Mattermost Calls plugin exposes TURN server credentials in plaintext in support packets
Affected: from 10.11.0+incompatible, fixed in 10.11.14+incompatible; from 11.4.0+incompatible, fixed in 11.4.4+incompatible; from 11.5.0+incompatible, fixed in 11.5.2+incompatible; from 11.5.0, fixed in 11.5.2; from 10.11.0, fixed in 10.11.14; from 11.4.0, fixed in 11.4.4.
CVE-2026-5163Medium 6.5
Missing authorization check in AI message rewrite endpoint allows access to private thread content
Affected: fixed in 5.3.2-0.20260401090745-f4d1abe7e8f5; from 11.5.0+incompatible, fixed in 11.5.2+incompatible.
CVE-2026-4286Low 3.1
Playbooks Plugin fails to validate team transfers, allowing unauthorized removal of member access via playbook update
Affected: from 10.11.0+incompatible, fixed in 10.11.14+incompatible; from 11.5.0+incompatible, fixed in 11.5.2+incompatible.
CVE-2026-6339Medium 4.3
Missing request origin validation on burn-on-read reveal endpoint
Affected: fixed in 5.3.2-0.20260327001745-7a339a6438f5; from 11.4.0+incompatible, fixed in 11.4.4+incompatible; from 11.5.0+incompatible, fixed in 11.5.2+incompatible.
CVE-2026-6340Medium 4.3
Memory Exhaustion via Malicious 7zip File Upload
Affected: fixed in 5.3.2-0.20260325191733-fb11968f8798; from 10.11.0+incompatible, fixed in 10.11.14+incompatible; from 11.4.0+incompatible, fixed in 11.4.4+incompatible; from 11.5.0+incompatible, fixed in 11.5.2+incompatible.
CVE-2026-3495Low 3.8
Unescaped variables during error page composition
Affected: from 10.11.0+incompatible, fixed in 10.11.14+incompatible; from 11.5.0+incompatible, fixed in 11.5.2+incompatible; fixed in 5.3.2-0.20260310115442-5a1ea95044dc.
CVE-2026-4273Low 3.7
Insufficient token rotation validation in remote cluster invite confirmation
Affected: from 10.11.0+incompatible, fixed in 10.11.14+incompatible; from 11.5.0+incompatible, fixed in 11.5.2+incompatible; fixed in 5.3.2-0.20260313190740-742e0be95074.
CVE-2026-3637Medium 4.3
Mattermost fails to enforce create_post permission when editing posts
Affected: from 10.11.0+incompatible, fixed in 10.11.14+incompatible; from 11.4.0+incompatible, fixed in 11.4.4+incompatible; from 11.5.0+incompatible, fixed in 11.5.2+incompatible; fixed in 5.3.2-0.20260316171743-090408f09f53.
CVE-2026-2325Medium 4.3
Improper Input Validation in MS Teams Meetings API Handler
Affected: from 10.11.0+incompatible, fixed in 10.11.14+incompatible; from 11.4.0+incompatible, fixed in 11.4.4+incompatible; from 11.5.0+incompatible, fixed in 11.5.2+incompatible; from 11.5.0, fixed in 11.5.2; from 10.11.0, fixed in 10.11.14; from 11.4.0, fixed in 11.4.4.
CVE-2026-28759Medium 4.3
Insufficient authorization in shared channel membership sync allows remote cluster to remove users from arbitrary channels
Affected: from 10.11.0+incompatible, fixed in 10.11.14+incompatible; from 11.4.0+incompatible, fixed in 11.4.4+incompatible; from 11.5.0+incompatible, fixed in 11.5.2+incompatible; fixed in 5.3.2-0.20260216150504-8738f8c4b3d4.
CVE-2026-6334Low 3.1
OAuth authorization code client binding not enforced during token redemption in Mattermost
Affected: fixed in 5.3.2-0.20260318173148-e9ae890a013b; from 10.11.0+incompatible, fixed in 10.11.14+incompatible; from 11.5.0+incompatible, fixed in 11.5.2+incompatible.
CVE-2026-4053Low 3.1
post edit time limit is not enforced on some post update operations
Affected: from 0.0.0-20250731163400-5b955468ea1e, fixed in 0.0.0-20260414103857-b21ef302025e; from 11.5.0+incompatible, fixed in 11.5.2+incompatible; from 11.5.0, fixed in 11.5.2; from 0.0.0-20250731163400-5b955468ea1e, fixed in 0.0.0-20260414103857-b21ef302025e.
CVE-2026-4054Medium 4.3
SVG content served through Mattermost image proxy despite Content-Type restrictions causes client-side denial of service
Affected: from 11.5.0, fixed in 11.5.2; from 0.0.0-20250731163400-5b955468ea1e, fixed in 0.0.0-20260414103857-b21ef302025e; from 11.4.0, fixed in 11.4.4; from 0.0.0-20250731163400-5b955468ea1e, fixed in 0.0.0-20260414103857-b21ef302025e; from 11.4.0+incompatible, fixed in 11.4.4+incompatible; from 11.5.0+incompatible, fixed in 11.5.2+incompatible.
CVE-2026-3590Medium 6.5
Race Condition in Guest Magic Link Authentication Allows Token Reuse
Affected: from 10.11.0-rc1, fixed in 10.11.13; from 11.5.0-rc1, fixed in 11.5.0; from 11.4.0-rc1, fixed in 11.4.3; from 11.3.0-rc1, fixed in 11.3.3; from 10.11.0-rc1+incompatible, fixed in 10.11.13+incompatible; from 11.3.0-rc1+incompatible, fixed in 11.3.3+incompatible; from 11.4.0-rc1+incompatible, fixed in 11.4.3+incompatible; from 11.5.0-rc1+incompatible, fixed in 11.5.0+incompatible.
CVE-2026-28741Medium 6.8
CSRF Protection Bypass Allows Updating a User's Authentication Method
Affected: from 11.3.0-rc1+incompatible, fixed in 11.3.3+incompatible; from 11.4.0-rc1+incompatible, fixed in 11.4.3+incompatible; from 11.5.0-rc1+incompatible, fixed in 11.5.0+incompatible.
CVE-2026-27769Low 2.7
Connected Workspaces: Malicious remote server can manipulate arbitrary user's status
Affected: from 8.0.0-20250721062209-4952acea88ce, fixed in 8.0.0-20260316060126-bc1a2b34b1f9; all versions.
CVE-2026-3112Medium 6.8
Arbitrary File Read via Advanced Logging Support Packet
Affected: from 10.11.0-rc1+incompatible, fixed in 10.11.12+incompatible; from 11.2.0-rc1+incompatible, fixed in 11.2.4+incompatible; from 11.3.0-rc1+incompatible, fixed in 11.3.2+incompatible; from 11.4.0-rc1+incompatible, fixed in 11.4.1+incompatible.
CVE-2026-3115Medium 4.3
Guest users can view group member IDs without respecting view restrictions
Affected: from 10.11.0-rc1+incompatible, fixed in 10.11.11+incompatible; from 11.2.0-rc1+incompatible, fixed in 11.2.3+incompatible; from 11.3.0-rc1+incompatible, fixed in 11.3.2+incompatible; from 11.4.0+incompatible, fixed in 11.4.1+incompatible.
CVE-2026-3114Medium 6.5
Zip Bomb Denial of Service via Unrestricted Archive Decompression
Affected: from 10.11.0+incompatible, fixed in 10.11.12+incompatible; from 11.2.0+incompatible, fixed in 11.2.4+incompatible; from 11.3.0+incompatible, fixed in 11.3.2+incompatible; from 11.4.0+incompatible, fixed in 11.4.1+incompatible.
CVE-2026-3113Medium 5.0
mmctl export download command doesn’t restrict permissions to created file to file owner
Affected: from 11.4.0-rc1, fixed in 11.4.1; from 11.3.0-rc1, fixed in 11.3.2; from 11.2.0-rc1, fixed in 11.2.4; from 10.11.0-rc1, fixed in 10.11.12; from 8.0.0-20260105080200-d27a2195068d, fixed in 8.0.0-20260217110922-b7d4a1f1f59b; from 10.11.0-rc1+incompatible, fixed in 10.11.12+incompatible; from 11.2.0-rc1+incompatible, fixed in 11.2.4+incompatible; from 11.3.0-rc1+incompatible, fixed in 11.3.2+incompatible; from 11.4.0-rc1+incompatible, fixed in 11.4.1+incompatible.
CVE-2026-3108High 8.0
Terminal Escape Injection in mmctl Report Posts Command
Affected: from 10.11.0-rc1+incompatible, fixed in 10.11.11+incompatible; from 11.2.0-rc1+incompatible, fixed in 11.2.3+incompatible; from 11.3.0-rc1+incompatible, fixed in 11.3.2+incompatible; from 11.4.0-rc1+incompatible, fixed in 11.4.1+incompatible.
CVE-2026-4274Medium 5.4
Insufficient authorization in shared channel membership sync grants team-level access instead of channel-level access
Affected: from 10.11.0-rc1+incompatible, fixed in 10.11.11+incompatible; from 11.2.0-rc1+incompatible, fixed in 11.2.3+incompatible; from 11.3.0-rc1+incompatible, fixed in 11.3.2+incompatible; from 11.4.0-rc1+incompatible, fixed in 11.4.1+incompatible.
CVE-2026-27659Medium 4.6
CSRF vulnerability in UpdateAccessControlPolicyActiveStatus endpoint
Affected: from 10.11.0-rc1+incompatible, fixed in 10.11.11+incompatible; from 11.2.0-rc1+incompatible, fixed in 11.2.3+incompatible; from 11.3.0-rc1+incompatible, fixed in 11.3.2+incompatible; from 11.4.0-rc1+incompatible, fixed in 11.4.1+incompatible.
CVE-2026-20719Medium 4.3
DoS via URL Previews Rendering Malicious SVGs
Affected: from 10.11.0-rc1+incompatible, fixed in 10.11.2+incompatible; from 11.2.0-rc1+incompatible, fixed in 11.2.4+incompatible; from 11.3.0-rc1+incompatible, fixed in 11.3.2+incompatible; from 11.4.0-rc1+incompatible, fixed in 11.4.1+incompatible.
CVE-2026-27656Medium 5.7
Account Takeover via Substring Matching in OpenID Connect Authentication
Affected: from 10.11.0-rc1+incompatible, fixed in 10.11.12+incompatible; from 11.2.0-rc1+incompatible, fixed in 11.2.4+incompatible; from 11.3.0-rc1+incompatible, fixed in 11.3.2+incompatible; from 11.4.0-rc1+incompatible, fixed in 11.4.1+incompatible; from 11.4.0-rc1, fixed in 11.4.1; from 11.3.0-rc1, fixed in 11.3.2; from 11.2.0-rc1, fixed in 11.2.4; from 10.11.0-rc1, fixed in 10.11.12.
CVE-2026-26233Medium 4.3
Denial of Service via HTTP/2 single packet attack on login endpoint
Affected: from 10.11.0-rc1+incompatible, fixed in 10.11.12+incompatible; from 11.2.0-rc1+incompatible, fixed in 11.2.4+incompatible; from 11.3.0-rc1+incompatible, fixed in 11.3.2+incompatible; from 11.4.0-rc1+incompatible, fixed in 11.4.1+incompatible; from 11.4.0-rc1, fixed in 11.4.1; from 11.3.0-rc1, fixed in 11.3.2; from 11.2.0-rc1, fixed in 11.2.4; from 10.11.0-rc1, fixed in 10.11.12.
CVE-2026-24692Medium 4.3
Guest users can bypass read permissions via search API
Affected: from 10.11.0-rc1+incompatible, fixed in 10.11.11+incompatible; from 11.2.0-rc1+incompatible, fixed in 11.2.3+incompatible; from 11.3.0-rc1+incompatible, fixed in 11.3.1+incompatible; fixed in 5.3.2-0.20260107142155-0481bd1fb045; from 10.11.0-rc1, fixed in 10.11.11; from 11.2.0-rc1, fixed in 11.2.3; from 11.3.0-rc1, fixed in 11.3.1.
CVE-2026-22545Low 3.1
Password Change Bypass via Auth Switch Endpoint
Affected: from 10.11.0-rc1+incompatible, fixed in 10.11.11+incompatible; from 11.2.0-rc1+incompatible, fixed in 11.2.3+incompatible; from 11.3.0-rc1+incompatible, fixed in 11.3.1+incompatible; fixed in 5.3.2-0.20260127144908-ced9a56e3988; from 10.11.0-rc1, fixed in 10.11.11; from 11.2.0-rc1, fixed in 11.2.3; from 11.3.0-rc1, fixed in 11.3.1.
CVE-2026-2455Medium 4.3
SSRF bypass via IPv4-mapped IPv6 literals
Affected: fixed in 5.3.2-0.20260129133647-5d787969c2d5; from 10.11.0-rc1, fixed in 10.11.11; from 11.2.0-rc1, fixed in 11.2.3; from 11.3.0-rc1, fixed in 11.3.1; from 10.11.0-rc1+incompatible, fixed in 10.11.11+incompatible; from 11.2.0-rc1+incompatible, fixed in 11.2.3+incompatible; from 11.3.0-rc1+incompatible, fixed in 11.3.1+incompatible.
CVE-2026-21386Medium 4.3
Private channel enumeration via /mute slash command
Affected: from 10.11.0-rc1+incompatible, fixed in 10.11.11+incompatible; from 11.2.0-rc1+incompatible, fixed in 11.2.3+incompatible; from 11.3.0-rc1+incompatible, fixed in 11.3.1+incompatible; fixed in 5.3.2-0.20260130144323-5bb5261c72fa; from 10.11.0-rc1, fixed in 10.11.11; from 11.2.0-rc1, fixed in 11.2.3; from 11.3.0-rc1, fixed in 11.3.1.
CVE-2026-25780Medium 4.3
Memory Exhaustion via Malformed DOC File Upload
Affected: from 10.11.0-rc1+incompatible, fixed in 10.11.11+incompatible; from 11.2.0-rc1+incompatible, fixed in 11.2.3+incompatible; from 11.3.0-rc1+incompatible, fixed in 11.3.1+incompatible; fixed in 5.3.2-0.20260123215601-86797c508c44; from 10.11.0-rc1, fixed in 10.11.11; from 11.2.0-rc1, fixed in 11.2.3; from 11.3.0-rc1, fixed in 11.3.1.
CVE-2026-4265Medium 4.3
Guest user can upload files without permission across teams
Affected: fixed in 5.3.2-0.20260107144005-c7f6efdfb035; from 10.11.0-rc1, fixed in 10.11.11; from 11.2.0-rc1, fixed in 11.2.3; from 11.3.0-rc1, fixed in 11.3.1; from 10.11.0-rc1+incompatible, fixed in 10.11.11+incompatible; from 11.2.0-rc1+incompatible, fixed in 11.2.3+incompatible; from 11.3.0-rc1+incompatible, fixed in 11.3.1+incompatible.
CVE-2026-25783Medium 4.3
Denial of service via malformed User-Agent header in getBrowserVersion
Affected: fixed in 5.3.2-0.20260129181235-1346cf529aef; from 10.11.0-rc1, fixed in 10.11.11; from 11.2.0-rc1, fixed in 11.2.3; from 11.3.0-rc1, fixed in 11.3.1; from 10.11.0-rc1+incompatible, fixed in 10.11.11+incompatible; from 11.2.0-rc1+incompatible, fixed in 11.2.3+incompatible; from 11.3.0-rc1+incompatible, fixed in 11.3.1+incompatible.
CVE-2026-24458High 7.5
DoS attack via login attempts with multi-megabyte passwords
Affected: fixed in 5.3.2-0.20260129164748-7201f42d955f; from 10.11.0-rc1, fixed in 10.11.11; from 11.2.0-rc1, fixed in 11.2.3; from 11.3.0-rc1, fixed in 11.3.1; from 10.11.0-rc1+incompatible, fixed in 10.11.11+incompatible; from 11.2.0-rc1+incompatible, fixed in 11.2.3+incompatible; from 11.3.0-rc1+incompatible, fixed in 11.3.1+incompatible.
CVE-2026-2578Medium 4.3
Information Disclosure via WebSocket Event When Deleting Unrevealed Burn on Read Posts
Affected: fixed in 5.3.2-0.20260127062706-c6b205f0d770; from 10.11.0-rc1, fixed in 10.11.11; from 11.2.0-rc1, fixed in 11.2.3; from 11.3.0-rc1, fixed in 11.3.1; from 10.11.0-rc1+incompatible, fixed in 10.11.11+incompatible; from 11.2.0-rc1+incompatible, fixed in 11.2.3+incompatible; from 11.3.0-rc1+incompatible, fixed in 11.3.1+incompatible.
CVE-2026-26246Medium 4.3
Memory Exhaustion via Malformed PSD File Upload
Affected: fixed in 5.3.2-0.20260115183946-38b413a27604; from 10.11.0-rc1, fixed in 10.11.11; from 11.2.0-rc1, fixed in 11.2.3; from 11.3.0-rc1, fixed in 11.3.1; from 10.11.0-rc1+incompatible, fixed in 10.11.11+incompatible; from 11.2.0-rc1+incompatible, fixed in 11.2.3+incompatible; from 11.3.0-rc1+incompatible, fixed in 11.3.1+incompatible.
CVE-2026-2458Medium 4.3
Unauthorized channel enumeration in private teams after member removal
Affected: from 10.11.0-rc1+incompatible, fixed in 10.11.11+incompatible; from 11.2.0-rc1+incompatible, fixed in 11.2.3+incompatible; from 11.3.0-rc1+incompatible, fixed in 11.3.1+incompatible; fixed in 5.3.2-0.20260113182106-a18b80ba4c32; from 10.11.0-rc1, fixed in 10.11.11; from 11.2.0-rc1, fixed in 11.2.3; from 11.3.0-rc1, fixed in 11.3.1.
CVE-2026-2457Medium 4.3
WebSocket Message Spoofing via Permalink Embed Manipulation
Affected: from 10.11.0-rc1+incompatible, fixed in 10.11.11+incompatible; from 11.2.0-rc1+incompatible, fixed in 11.2.3+incompatible; from 11.3.0-rc1+incompatible, fixed in 11.3.1+incompatible; fixed in 5.3.2-0.20260123211116-9efe617be8b8; from 10.11.0-rc1, fixed in 10.11.11; from 11.2.0-rc1, fixed in 11.2.3; from 11.3.0-rc1, fixed in 11.3.1.
CVE-2026-2463Medium 4.3
Unauthorized access to invite ID during team creation
Affected: fixed in 5.3.2-0.20260105134819-cc427af41b2a; from 10.11.0-rc1, fixed in 10.11.11; from 11.2.0-rc1, fixed in 11.2.3; from 11.3.0-rc1, fixed in 11.3.1; from 10.11.0-rc1+incompatible, fixed in 10.11.11+incompatible; from 11.2.0-rc1+incompatible, fixed in 11.2.3+incompatible; from 11.3.0-rc1+incompatible, fixed in 11.3.1+incompatible.
CVE-2026-2456Medium 5.3
Denial of Service via Unbounded Memory Allocation in Integration Actions
Affected: fixed in 5.3.2-0.20260127165411-fe3052073dc6; from 10.11.0-rc1, fixed in 10.11.11; from 11.2.0-rc1, fixed in 11.2.3; from 11.3.0-rc1, fixed in 11.3.1; from 10.11.0-rc1+incompatible, fixed in 10.11.11+incompatible; from 11.2.0-rc1+incompatible, fixed in 11.2.3+incompatible; from 11.3.0-rc1+incompatible, fixed in 11.3.1+incompatible.
CVE-2025-14573Low 3.8
Team Admin Bypass of Invite Permissions via allow_open_invite Field
Affected: all versions; from 10.11.0+incompatible; from 11.1.0+incompatible; from 11.2.0+incompatible; from 11.1.0; from 10.11.0; from 11.2.0; fixed in 5.3.2-0.20251215190648-6404ab29acc0.
CVE-2025-14350Medium 4.3
Information disclosure via channel mentions in posts
Affected: from 11.1.0; from 10.11.0; from 11.2.0; fixed in 5.3.2-0.20251209134645-761e56bb11cc; all versions; from 10.11.0+incompatible; from 11.1.0+incompatible; from 11.2.0+incompatible.
CVE-2025-13821Medium 5.7
User profile update exposes password hash and MFA secrets
Affected: from 11.1.0; from 10.11.0; from 11.2.0; fixed in 5.3.2-0.20251210191531-cd17b61de41b; all versions; from 10.11.0+incompatible; from 11.1.0+incompatible; from 11.2.0+incompatible.
CVE-2026-0999Medium 5.4
Authentication bypass via userID login when email and username login are disabled
Affected: from 11.1.0; from 10.11.0; from 11.2.0; fixed in 5.3.2-0.20251212052346-61651b0df7ea; all versions; from 10.11.0+incompatible; from 11.1.0+incompatible; from 11.2.0+incompatible.
CVE-2026-20796Low 3.1
Time-of-check time-of-use vulnerability in common teams API
Affected: from 10.11.0, fixed in 10.11.10; from 10.11.0+incompatible, fixed in 10.11.10+incompatible.
CVE-2026-22892Medium 4.3
Insufficient Authorization in Mattermost Jira Plugin Allows Unauthorized Access to Post Attachments
Affected: from 11.2.0, fixed in 11.2.2; from 11.1.0, fixed in 11.1.3; from 10.11.0, fixed in 10.11.10; from 10.11.0+incompatible, fixed in 10.11.10+incompatible; from 11.1.0+incompatible, fixed in 11.1.3+incompatible; from 11.2.0+incompatible, fixed in 11.2.2+incompatible.
CVE-2025-14435Medium 6.8
Application-Level DoS via infinite re-render loop in user profile handling
Affected: from 10.11.0, fixed in 10.11.9; from 11.1.0, fixed in 11.1.2; from 11.0.0, fixed in 11.0.7; from 10.11.0+incompatible, fixed in 10.11.9+incompatible; from 11.0.1+incompatible, fixed in 11.0.7+incompatible; from 11.1.0+incompatible, fixed in 11.1.2+incompatible.
CVE-2025-14822Low 3.1
DoS from quadratic complexity in model.ParseHashtags
Affected: from 10.11.0, fixed in 10.11.9; from 11.0.0, fixed in 11.2.0; from 10.11.0+incompatible, fixed in 10.11.9+incompatible; from 11.0.1+incompatible, fixed in 11.2.0+incompatible.
CVE-2025-64641Medium 4.1
Mattermost Jira plugin crafted action leaks Jira issue details
Affected: from 10.11.0, fixed in 10.11.8; from 10.12.0, fixed in 10.12.4; from 11.0.0, fixed in 11.0.6; from 11.1.0, fixed in 11.1.1; from 10.11.0+incompatible, fixed in 10.11.8+incompatible; from 10.12.0+incompatible, fixed in 10.12.4+incompatible; from 11.0.1+incompatible, fixed in 11.0.6+incompatible; from 11.1.0+incompatible, fixed in 11.1.1+incompatible.
CVE-2025-13767Medium 4.3
Unauthorized Read Access to Private Channel Posts via Mattermost Jira Plugin
Affected: from 10.11.0, fixed in 10.11.8; from 10.12.0, fixed in 10.12.4; from 11.0.0, fixed in 11.0.6; from 11.1.0, fixed in 11.1.1; from 10.11.0+incompatible, fixed in 10.11.8+incompatible; from 10.12.0+incompatible, fixed in 10.12.4+incompatible; from 11.0.1+incompatible, fixed in 11.0.6+incompatible; from 11.1.0+incompatible, fixed in 11.1.1+incompatible.
CVE-2025-14273High 7.2
Mattermost Jira plugin user spoofing enables Jira request forgery.
Affected: all versions.
CVE-2025-13324Low 3.7
Lack of Invalidation of Legacy Remote Cluster Invite Tokens After Confirmation
Affected: fixed in 11.0.4; fixed in 11.0.4+incompatible.
CVE-2025-62690Low 3.1
Open redirect in error page when link opened in new tab
Affected: all versions.
CVE-2025-13352Low 3.0
Mattermost GitHub Plugin allows unauthorized GitHub reactions via reaction forwarding hijacking
Affected: from 10.11.0-rc1+incompatible.
CVE-2025-13870Low 3.1
Unauthorized access and subscription vulnerability in Boards
Affected: all versions.
CVE-2025-12756Medium 4.3
Insecure Direct Object Reference in Mattermost Boards Plugin Enables Unauthorised Comment Deletion
Affected: all versions.
CVE-2025-12421Critical 9.9
Account Takeover via Code Exchange Endpoint
Affected: from 11.0.0, fixed in 11.0.3; from 10.12.0, fixed in 10.12.2; from 10.11.0, fixed in 10.11.5; from 10.5.0, fixed in 10.5.13; all versions.
CVE-2025-12559Medium 4.3
Information Disclosure in Common Teams API
Affected: from 11.0.0, fixed in 11.0.3; from 10.12.0, fixed in 10.12.2; from 10.11.0, fixed in 10.11.5; from 10.5.0, fixed in 10.5.13; all versions.
CVE-2025-12419Critical 9.9
Account takeover on OAuth/OpenID-enabled servers
Affected: all versions; from 10.12.0, fixed in 10.12.2; from 10.11.0, fixed in 10.11.5; from 10.5.0, fixed in 10.5.13; from 11.0.0, fixed in 11.0.4.
CVE-2025-55074Low 3.0
Channel member objects leak read status
Affected: from 10.5.0+incompatible, fixed in 10.5.12+incompatible; from 10.11.0+incompatible, fixed in 10.11.4+incompatible; from 10.11.0, fixed in 10.11.4; from 10.5.0, fixed in 10.5.12.
CVE-2025-11794Medium 4.9
Password hash and MFA secret returned in user email verification endpoint
Affected: from 10.5.0+incompatible, fixed in 10.5.12+incompatible; from 10.11.0+incompatible, fixed in 10.11.4+incompatible; from 10.12.0+incompatible, fixed in 10.12.1+incompatible; from 10.11.0, fixed in 10.11.4; from 10.5.0, fixed in 10.5.12; from 10.12.0, fixed in 10.12.1.
CVE-2025-55073Medium 5.4
MS Teams plugin OAuth allows editing arbitrary posts
Affected: from 10.5.0+incompatible, fixed in 10.5.12+incompatible; from 10.11.0+incompatible, fixed in 10.11.4+incompatible; from 10.12.0+incompatible, fixed in 10.12.1+incompatible; from 10.11.0, fixed in 10.11.4; from 10.5.0, fixed in 10.5.12; from 10.12.0, fixed in 10.12.1.
CVE-2025-55070Medium 6.5
Lack of MFA enforcement in WebSocket connections
Affected: fixed in 11.1.0+incompatible; fixed in 11.1.0.
CVE-2025-41436Low 3.1
Unauthorized access to archived channel content via threads interface
Affected: fixed in 11.0.0-alpha.1; fixed in 11.0.0-alpha.1+incompatible.
CVE-2025-11776Medium 4.3
Guest user can discover archived public channels
Affected: all versions; fixed in 5.3.2-0.20250815165020-c8d66301415d.
CVE-2025-11777Low 3.1
Cross-team channel membership access
Affected: from 10.5.0+incompatible, fixed in 10.5.12+incompatible; from 10.11.0+incompatible, fixed in 10.11.4+incompatible; from 10.11.0, fixed in 10.11.4; from 10.5.0, fixed in 10.5.12; fixed in 5.3.2-0.20250905150616-ba86dfc5876b.
CVE-2025-58073High 8.1
Arbitrary Mattermost Team can be joined by manipulating the OAuth state
Affected: from 10.5.0+incompatible, fixed in 10.5.11+incompatible; from 10.10.0+incompatible, fixed in 10.10.3+incompatible; from 10.11.0+incompatible, fixed in 10.11.2+incompatible; from 10.11.0, fixed in 10.11.2; from 10.10.0, fixed in 10.10.3; from 10.5.0, fixed in 10.5.11.
CVE-2025-41410Medium 5.4
Slack import bypasses email verification for team access controls
Affected: from 10.5.0+incompatible, fixed in 10.5.11+incompatible; from 10.10.0+incompatible, fixed in 10.10.3+incompatible; from 10.11.0+incompatible, fixed in 10.11.3+incompatible; from 10.10.0, fixed in 10.10.3; from 10.5.0, fixed in 10.5.11; from 10.11.0, fixed in 10.11.3.
CVE-2025-10545Low 3.1
Guest user can add unauthorized team users to private channels
Affected: from 10.5.0, fixed in 10.5.11; from 10.11.0, fixed in 10.11.3; from 10.5.0+incompatible, fixed in 10.5.11+incompatible; from 10.11.0+incompatible, fixed in 10.11.3+incompatible.
CVE-2025-58075High 8.1
Arbitrary Mattermost Team can be joined by manipulating the SAML RelayState
Affected: from 10.5.0+incompatible, fixed in 10.5.11+incompatible; from 10.10.0+incompatible, fixed in 10.10.3+incompatible; from 10.11.0+incompatible, fixed in 10.11.2+incompatible; from 10.11.0, fixed in 10.11.2; from 10.10.0, fixed in 10.10.3; from 10.5.0, fixed in 10.5.11.
CVE-2025-54499Low 3.1
Insecure string comparison enables timing attacks
Affected: from 10.5.0+incompatible, fixed in 10.5.11+incompatible; from 10.11.0+incompatible, fixed in 10.11.3+incompatible; from 10.5.0, fixed in 10.5.11; from 10.11.0, fixed in 10.11.3.
CVE-2025-41443Medium 4.3
Guest user can discover active public channels
Affected: all versions; from 10.5.0, fixed in 10.5.11; from 10.11.0, fixed in 10.11.3.
CVE-2025-9081Low 3.1
IDOR in board file download allows any user to download any file by UUID
Affected: from 10.5.0-rc1, fixed in 10.5.9; from 9.11.0-rc1, fixed in 9.11.18; from 9.11.0-rc1+incompatible, fixed in 9.11.18+incompatible; from 10.5.0-rc1+incompatible, fixed in 10.5.9+incompatible.
CVE-2025-9079High 8.0
Admin RCE via prepackaged plugins by way of misconfigured imports directory
Affected: from 9.11.0+incompatible, fixed in 9.11.18+incompatible; from 10.5.0+incompatible, fixed in 10.5.9+incompatible; from 10.8.0+incompatible, fixed in 10.8.4+incompatible; from 10.9.0+incompatible, fixed in 10.9.4+incompatible; from 10.10.0+incompatible, fixed in 10.10.2+incompatible; from 10.8.0, fixed in 10.8.4; from 10.5.0, fixed in 10.5.9; from 9.11.0, fixed in 9.11.18; from 10.10.0, fixed in 10.10.2; from 10.9.0, fixed in 10.9.4.
CVE-2025-9072High 7.6
One-Click Mattermost Account Takeover via Poisoned RelayState SAML Parameter
Affected: from 10.5.0+incompatible, fixed in 10.5.10+incompatible; from 10.9.0+incompatible, fixed in 10.9.5+incompatible; from 10.10.0+incompatible, fixed in 10.10.2+incompatible; from 10.10.0, fixed in 10.10.2; from 10.5.0, fixed in 10.5.10; from 10.9.0, fixed in 10.9.5.
CVE-2025-9084Low 3.1
Open redirect in OAuth login
Affected: from 10.5.0, fixed in 10.5.10; from 10.5.0+incompatible, fixed in 10.5.10+incompatible.
CVE-2025-9078Medium 4.3
Weak cache keys lead to post IDOR and link preview poisoning
Affected: from 10.8.0, fixed in 10.8.4; from 10.5.0, fixed in 10.5.9; from 9.11.0, fixed in 9.11.18; from 10.10.0, fixed in 10.10.2; from 10.9.0, fixed in 10.9.4; from 9.11.0+incompatible, fixed in 9.11.18+incompatible; from 10.5.0+incompatible, fixed in 10.5.9+incompatible; from 10.8.0+incompatible, fixed in 10.8.4+incompatible; from 10.9.0+incompatible, fixed in 10.9.4+incompatible; from 10.10.0+incompatible, fixed in 10.10.2+incompatible.
CVE-2025-9076Medium 6.5
Mattermost Server exposes sensitive user credentials during shared channel membership synchronization
Affected: from 10.10.0+incompatible, fixed in 10.10.2+incompatible; from 10.10.0, fixed in 10.10.2.
CVE-2025-8402Medium 4.9
Nil pointer dereference in bulk import crashes server
Affected: from 9.11.0+incompatible, fixed in 9.11.18+incompatible; from 10.5.0+incompatible, fixed in 10.5.9+incompatible; from 10.8.0+incompatible, fixed in 10.8.4+incompatible; from 10.9.0+incompatible, fixed in 10.9.4+incompatible; from 10.10.0+incompatible, fixed in 10.10.1+incompatible; from 10.8.0, fixed in 10.8.4; from 10.5.0, fixed in 10.5.9; from 10.9.0, fixed in 10.9.4; from 10.10.0, fixed in 10.10.1; from 9.11.0, fixed in 9.11.18.
CVE-2025-6465Medium 4.3
Path traversal in image upload with preview overwrite
Affected: from 10.5.0+incompatible, fixed in 10.5.9+incompatible; from 10.8.0+incompatible, fixed in 10.8.4+incompatible; from 10.9.0+incompatible, fixed in 10.9.4+incompatible; from 10.10.0+incompatible, fixed in 10.10.1+incompatible; from 10.8.0, fixed in 10.8.4; from 10.5.0, fixed in 10.5.9; from 10.9.0, fixed in 10.9.4; from 10.10.0, fixed in 10.10.1.
CVE-2025-47870Medium 4.3
Team invite ID leaked to team admin with no member invite privileges
Affected: from 9.11.0+incompatible, fixed in 9.11.18+incompatible; from 10.5.0+incompatible, fixed in 10.5.9+incompatible; from 10.8.0+incompatible, fixed in 10.8.4+incompatible; from 10.9.0+incompatible, fixed in 10.9.3+incompatible; from 10.8.0, fixed in 10.8.4; from 10.5.0, fixed in 10.5.9; from 9.11.0, fixed in 9.11.18; from 10.9.0, fixed in 10.9.3.
CVE-2025-49222Medium 6.8
Mattermost Shared Channel Upload Type Validation Bypass
Affected: from 9.11.0+incompatible, fixed in 9.11.18+incompatible; from 10.5.0+incompatible, fixed in 10.5.9+incompatible; from 10.8.0+incompatible, fixed in 10.8.4+incompatible; from 10.9.0+incompatible, fixed in 10.9.3+incompatible; from 10.10.0+incompatible, fixed in 10.10.1+incompatible; from 10.8.0, fixed in 10.8.4; from 10.5.0, fixed in 10.5.9; from 9.11.0, fixed in 9.11.18; from 10.9.0, fixed in 10.9.3; from 10.10.0, fixed in 10.10.1.
CVE-2025-8023Medium 6.8
Path Traversal in Template Upload Allows Uploading Files Outside Target Directory
Affected: from 9.11.0+incompatible, fixed in 9.11.18+incompatible; from 10.5.0+incompatible, fixed in 10.5.9+incompatible; from 10.8.0+incompatible, fixed in 10.8.4+incompatible; from 10.9.0+incompatible, fixed in 10.9.3+incompatible; from 10.8.0, fixed in 10.8.4; from 10.5.0, fixed in 10.5.9; from 9.11.0, fixed in 9.11.18; from 10.9.0, fixed in 10.9.3.
CVE-2025-53971Low 3.8
Channel and Team Membership APIs inadvertently allow loss of Member privileges.
Affected: from 10.5.0, fixed in 10.5.9; from 9.11.0, fixed in 9.11.18; from 9.11.0+incompatible, fixed in 9.11.18+incompatible; from 10.5.0+incompatible, fixed in 10.5.9+incompatible.
CVE-2025-47700Low 3.5
AI plugin APIs can be triggered using post actions
Affected: from 10.5.0+incompatible, fixed in 10.5.10+incompatible; from 10.5.0, fixed in 10.5.10.
CVE-2025-49810Low 3.5
Thread summarization allows persistent access to channel
Affected: from 10.5.0, fixed in 10.5.9; from 10.5.0+incompatible, fixed in 10.5.9+incompatible.
CVE-2025-36530Medium 6.8
Import Path Traversal Enables Unauthorized Unsigned Plugin Installation
Affected: from 10.9.0, fixed in 10.9.2; from 10.8.0, fixed in 10.8.4; from 10.5.0, fixed in 10.5.9; from 9.11.0, fixed in 9.11.18; from 9.11.0+incompatible, fixed in 9.11.18+incompatible; from 10.5.0+incompatible, fixed in 10.5.9+incompatible; from 10.8.0+incompatible, fixed in 10.8.4+incompatible; from 10.9.0+incompatible, fixed in 10.9.2+incompatible.
CVE-2025-6227Low 2.2
Invite token is used as part of the secure communication
Affected: from 9.11.0+incompatible, fixed in 9.11.17+incompatible; from 10.5.0+incompatible, fixed in 10.5.8+incompatible; from 10.5.0, fixed in 10.5.8; from 9.11.0, fixed in 9.11.17.
CVE-2025-6233Medium 6.8
Arbitrary file read by system admin via path traversal
Affected: from 9.11.0+incompatible, fixed in 9.11.17+incompatible; from 10.5.0+incompatible, fixed in 10.5.8+incompatible; from 10.7.0+incompatible, fixed in 10.7.4+incompatible; from 10.8.0+incompatible, fixed in 10.8.2+incompatible; from 10.8.0, fixed in 10.8.2; from 10.7.0, fixed in 10.7.4; from 10.5.0, fixed in 10.5.8; from 9.11.0, fixed in 9.11.17.
CVE-2025-6226Medium 6.5
IDOR in CreatePost API allows for timeboxed message disclosure
Affected: from 9.11.0+incompatible, fixed in 9.11.17+incompatible; from 10.5.0+incompatible, fixed in 10.5.7+incompatible; from 10.7.0+incompatible, fixed in 10.7.4+incompatible; from 10.8.0+incompatible, fixed in 10.8.2+incompatible; from 10.5.0, fixed in 10.5.7; from 10.8.0, fixed in 10.8.2; from 10.7.0, fixed in 10.7.4; from 9.11.0, fixed in 9.11.17.
CVE-2025-47871Medium 4.3
Mattermost Playbooks exposes private channel metadata to unauthorized users via run metadata API
Affected: fixed in 0.0.0-20250513065225-4ae5d647fb88; from 9.11.0+incompatible, fixed in 9.11.16+incompatible; from 10.5.0+incompatible, fixed in 10.5.6+incompatible; from 10.6.0+incompatible, fixed in 10.6.6+incompatible; from 10.7.0+incompatible, fixed in 10.7.3+incompatible; from 10.8.0+incompatible, fixed in 10.8.1+incompatible; fixed in 0.0.0-20250513065225-4ae5d647fb88.
CVE-2025-46702Medium 5.4
Mattermost Playbooks allows privilege escalation through improper access control in playbook run participant management
Affected: fixed in 0.0.0-20250513065225-4ae5d647fb88; from 9.11.0+incompatible, fixed in 9.11.16+incompatible; from 10.5.0+incompatible, fixed in 10.5.6+incompatible; from 10.6.0+incompatible, fixed in 10.6.6+incompatible; from 10.7.0+incompatible, fixed in 10.7.3+incompatible; from 10.8.0+incompatible, fixed in 10.8.1+incompatible; fixed in 0.0.0-20250513065225-4ae5d647fb88.
CVE-2025-3228Medium 4.3
Unauthorized Guest user access to Playbook
Affected: fixed in 0.0.0-20250520060012-d0380305ef7a; fixed in 0.0.0-20250520060012-d0380305ef7a; from 9.11.0+incompatible, fixed in 9.11.16+incompatible; from 10.5.0+incompatible, fixed in 10.5.6+incompatible; from 10.6.0+incompatible, fixed in 10.6.6+incompatible; from 10.7.0+incompatible, fixed in 10.7.3+incompatible; from 10.8.0+incompatible, fixed in 10.8.1+incompatible.
CVE-2025-3227Medium 4.3
Unauthorized channel member management through playbook runs
Affected: fixed in 0.0.0-20250520060012-d0380305ef7a; fixed in 0.0.0-20250520060012-d0380305ef7a; from 9.11.0+incompatible, fixed in 9.11.16+incompatible; from 10.5.0+incompatible, fixed in 10.5.6+incompatible; from 10.6.0+incompatible, fixed in 10.6.6+incompatible; from 10.7.0+incompatible, fixed in 10.7.3+incompatible; from 10.8.0+incompatible, fixed in 10.8.1+incompatible.
CVE-2025-4981Critical 9.9
Path Traversal Leading to RCE by Any Authenticated Mattermost User
Affected: fixed in 0.0.0-20250519205859-65aec10162f6; fixed in 0.0.0-20250519205859-65aec10162f6; from 9.11.0+incompatible, fixed in 9.11.16+incompatible; from 10.5.0+incompatible, fixed in 10.5.6+incompatible; from 10.6.0+incompatible, fixed in 10.6.6+incompatible; from 10.7.0+incompatible, fixed in 10.7.3+incompatible; from 10.8.0+incompatible, fixed in 10.8.1+incompatible.
CVE-2025-4128Low 3.1
Mattermost Guest User Information Disclosure Vulnerability
Affected: from 10.5.0, fixed in 10.5.5; from 9.11.0, fixed in 9.11.14; from 9.11.0+incompatible, fixed in 9.11.14+incompatible; from 10.5.0+incompatible, fixed in 10.5.5+incompatible.
CVE-2025-4573Medium 4.1
LDAP Injection in Mattermost Enterprise Edition When Using Active Directory
Affected: from 9.11.0+incompatible, fixed in 9.11.14+incompatible; from 10.5.0+incompatible, fixed in 10.5.5+incompatible; from 10.6.0+incompatible, fixed in 10.6.4+incompatible; from 10.7.0+incompatible, fixed in 10.7.2+incompatible; from 10.7.0, fixed in 10.7.2; from 10.6.0, fixed in 10.6.4; from 10.5.0, fixed in 10.5.5; from 9.11.0, fixed in 9.11.14.
CVE-2025-3611Low 3.1
Improper Access Control in Mattermost allows System Managers to view team details despite role restrictions
Affected: from 9.0.0-rc1+incompatible, fixed in 9.11.13+incompatible; from 10.0.0-rc1+incompatible, fixed in 10.5.4+incompatible; from 10.6.0-rc1+incompatible, fixed in 10.7.1+incompatible.
CVE-2025-3230Medium 5.4
Bypass of System Admin User Deactivation Controls for Personal Access Tokens in Mattermost Server
Affected: from 9.0.0-rc1+incompatible, fixed in 9.11.13+incompatible; from 10.0.0-rc1+incompatible, fixed in 10.5.4+incompatible; from 10.6.0-rc1+incompatible, fixed in 10.6.3+incompatible; from 10.7.0-rc1+incompatible, fixed in 10.7.1+incompatible.
CVE-2025-2571Medium 4.2
Google OAuth Authentication Bypass for Converted Bot Accounts
Affected: from 9.0.0-rc1+incompatible, fixed in 9.11.13+incompatible; from 10.0.0-rc1+incompatible, fixed in 10.5.4+incompatible; from 10.6.0-rc1+incompatible, fixed in 10.6.3+incompatible; from 10.7.0-rc1+incompatible, fixed in 10.7.1+incompatible.
CVE-2025-1792Low 3.1
Improper Access Control in Mattermost Channel Member API
Affected: from 9.0.0-rc1+incompatible, fixed in 9.11.13+incompatible; from 10.0.0-rc1+incompatible, fixed in 10.5.4+incompatible; from 10.6.0-rc1+incompatible, fixed in 10.7.1+incompatible.
CVE-2025-3913Medium 5.3
Team Privacy Settings Authorization Bypass in Mattermost Server
Affected: from 9.0.0-rc1+incompatible, fixed in 9.11.13+incompatible; from 10.5.0-rc1+incompatible, fixed in 10.5.4+incompatible; from 10.6.0-rc1+incompatible, fixed in 10.6.3+incompatible; from 10.7.0-rc1+incompatible, fixed in 10.7.1+incompatible.
CVE-2025-2570Low 2.7
System Admin Cannot Access Environment settings in System Console While System Manager Can
Affected: from 9.11.0+incompatible, fixed in 9.11.12+incompatible; from 10.5.0+incompatible, fixed in 10.5.3+incompatible.
CVE-2025-2527Medium 4.3
Improper access control to group information
Affected: from 9.11.0+incompatible, fixed in 9.11.12+incompatible; from 10.5.0+incompatible, fixed in 10.5.3+incompatible.
CVE-2025-3446Medium 4.3
Members Without Guest Invite Permissions Can Add Guests to Teams
Affected: from 9.11.0+incompatible, fixed in 9.11.12+incompatible; from 10.4.0+incompatible, fixed in 10.4.5+incompatible; from 10.5.0+incompatible, fixed in 10.5.3+incompatible; from 10.6.0+incompatible, fixed in 10.6.2+incompatible.
CVE-2025-31947Medium 5.8
Repeated LDAP login failures can lock an LDAP account
Affected: from 9.11.0+incompatible, fixed in 9.11.12+incompatible; from 10.4.0+incompatible, fixed in 10.4.5+incompatible; from 10.5.0+incompatible, fixed in 10.5.3+incompatible; from 10.6.0+incompatible, fixed in 10.6.2+incompatible.
CVE-2025-41423Low 3.1
Unauthorized Playbooks Post Deletion in Mattermost Playbooks Plugin
Affected: from 9.11.0+incompatible; from 10.4.0+incompatible; from 10.5.0+incompatible.
CVE-2025-35965Medium 6.5
DoS in Mattermost Playbooks via Excessive Task Actions
Affected: from 9.11.0+incompatible; from 10.4.0+incompatible; from 10.5.0+incompatible.
CVE-2025-41395Medium 6.5
Webapp DoS via malicious retrospective post in Playbooks
Affected: from 9.11.0+incompatible; from 10.4.0+incompatible; from 10.5.0+incompatible.
CVE-2025-2564Medium 4.3
Unauthorized View Access to Archived Channel Member Info
Affected: from 9.11.0+incompatible, fixed in 9.11.10+incompatible; from 10.4.0+incompatible, fixed in 10.4.4+incompatible; from 10.5.0+incompatible, fixed in 10.5.2+incompatible.
CVE-2025-27936Medium 5.3
Webhook Secret Exposure via Timing attack in MSteams plugin
Affected: from 10.5.0+incompatible, fixed in 10.5.2+incompatible.
CVE-2025-31363Low 3.0
Data exfiltration via AI plugin Jira tool
Affected: from 9.11.0+incompatible, fixed in 9.11.10+incompatible; from 10.4.0+incompatible, fixed in 10.4.3+incompatible; from 10.5.0+incompatible, fixed in 10.5.1+incompatible.
CVE-2025-27571Medium 4.3
Channel metadata visible in archived channels despite configuration setting
Affected: from 9.11.0+incompatible, fixed in 9.11.10+incompatible; from 10.4.0+incompatible, fixed in 10.4.4+incompatible; from 10.5.0+incompatible, fixed in 10.5.2+incompatible.
CVE-2025-27538Low 2.2
MFA Enforcement Bypass Allows Unauthorized Removal of MFA for Other Users
Affected: from 9.11.0+incompatible, fixed in 9.11.10+incompatible; from 10.5.0+incompatible, fixed in 10.5.2+incompatible.
CVE-2025-24839Low 3.1
Unauthorized AI bot activation via Wrangler plugin
Affected: from 9.11.0+incompatible, fixed in 9.11.10+incompatible; from 10.4.0+incompatible, fixed in 10.4.4+incompatible; from 10.5.0+incompatible, fixed in 10.5.2+incompatible.
CVE-2025-2475Medium 5.4
Unauthorized Bot Login Using Credentials
Affected: from 9.11.0+incompatible, fixed in 9.11.10+incompatible; from 10.5.0+incompatible, fixed in 10.5.2+incompatible.
CVE-2025-2424Low 3.1
Leaked Metadata of Deleted Files via Bookmark Creation
Affected: from 9.11.0+incompatible, fixed in 9.11.10+incompatible; from 10.5.0+incompatible, fixed in 10.5.2+incompatible.
CVE-2025-32093Medium 4.7
Syatem admin profile modification by delegated granular administration role
Affected: from 10.5.0, fixed in 10.5.2; from 10.4.0, fixed in 10.4.4; from 9.11.0, fixed in 9.11.10; from 9.11.0+incompatible, fixed in 9.11.10+incompatible; from 10.4.0+incompatible, fixed in 10.4.4+incompatible; from 10.5.0+incompatible, fixed in 10.5.2+incompatible.
CVE-2025-24866Low 2.7
Unauthorized Access to User Activity Logs API by delegated granular administration roles
Affected: from 9.11.0+incompatible, fixed in 9.11.9+incompatible.
CVE-2025-25068High 7.5
Bypassing MFA Enforcement on Plugin Endpoints
Affected: from 9.11.0+incompatible, fixed in 9.11.9+incompatible; from 10.3.0+incompatible, fixed in 10.3.4+incompatible; from 10.4.0+incompatible, fixed in 10.4.3+incompatible; from 10.5.0+incompatible, fixed in 10.5.1+incompatible.
CVE-2025-24920Medium 4.3
Unauthorized Bookmark Creation and Modification in Archived Channels
Affected: from 9.11.0+incompatible, fixed in 9.11.9+incompatible; from 10.3.0+incompatible, fixed in 10.3.4+incompatible; from 10.4.0+incompatible, fixed in 10.4.3+incompatible; from 10.5.0+incompatible, fixed in 10.5.1+incompatible.
CVE-2025-30179Medium 4.3
MFA Enforcement Bypass in Search APIs
Affected: from 9.11.0+incompatible, fixed in 9.11.9+incompatible; from 10.3.0+incompatible, fixed in 10.3.4+incompatible; from 10.4.0+incompatible, fixed in 10.4.3+incompatible; from 10.5.0+incompatible, fixed in 10.5.1+incompatible.
CVE-2025-25274Medium 4.3
Unauthorized Command Execution in Archived Channels
Affected: from 9.11.0+incompatible, fixed in 9.11.9+incompatible; from 10.3.0+incompatible, fixed in 10.3.4+incompatible; from 10.4.0+incompatible, fixed in 10.4.3+incompatible; from 10.5.0+incompatible, fixed in 10.5.1+incompatible.
CVE-2025-27933Medium 5.4
Unauthorized Private-to-Public Channel Conversion
Affected: fixed in 9.11.9; from 9.11.0+incompatible, fixed in 9.11.9+incompatible; from 10.3.0+incompatible, fixed in 10.3.4+incompatible; from 10.4.0+incompatible, fixed in 10.4.3+incompatible.
CVE-2025-27715Low 3.3
Auto-Enrollment of Team Admins into Private Channels without explicit consent
Affected: from 9.11.0+incompatible, fixed in 9.11.9+incompatible.
CVE-2025-1472Medium 4.3
Unauthorized View Access to Site Statistics and Team Statistics
Affected: from 9.11.0, fixed in 9.11.9; from 9.11.0+incompatible, fixed in 9.11.9+incompatible.
CVE-2025-20051Critical 9.9
Arbitrary file read via block duplication in Mattermost Boards
Affected: from 9.11.0-rc1+incompatible, fixed in 9.11.8+incompatible; from 10.2.0-rc1+incompatible, fixed in 10.2.3+incompatible; from 10.3.0-rc1+incompatible, fixed in 10.3.3+incompatible; from 10.4.0-rc1+incompatible, fixed in 10.4.2+incompatible.
CVE-2025-25279Critical 9.9
Arbitrary file read in Mattermost Boards via import & export board archive
Affected: from 9.11.0-rc1+incompatible, fixed in 9.11.8+incompatible; from 10.2.0-rc1+incompatible, fixed in 10.2.3+incompatible; from 10.3.0-rc1+incompatible, fixed in 10.3.3+incompatible; from 10.4.0-rc1+incompatible, fixed in 10.4.2+incompatible.
CVE-2025-1412Low 3.1
Session Persistence After User-to-Bot Conversion
Affected: from 9.11.0-rc1+incompatible, fixed in 9.11.7+incompatible; from 10.4.0-rc1+incompatible, fixed in 10.4.2+incompatible.
CVE-2025-24526Medium 4.3
Channel export permitted on archived channel when viewing archived channels is disabled
Affected: from 9.11.0-rc1+incompatible, fixed in 9.11.8+incompatible; from 10.2.0-rc1+incompatible, fixed in 10.2.3+incompatible; from 10.3.0-rc1+incompatible, fixed in 10.3.3+incompatible; from 10.4.0-rc1+incompatible, fixed in 10.4.2+incompatible.
CVE-2025-20621Medium 6.5
Webapp crash via object that can't be cast to String in Attachment Field
Affected: from 9.11.0+incompatible, fixed in 9.11.6+incompatible; from 10.0.0+incompatible, fixed in 10.0.4+incompatible; from 10.1.0+incompatible, fixed in 10.1.4+incompatible; from 10.2.0+incompatible, fixed in 10.2.1+incompatible.
CVE-2025-20088Medium 6.5
Insufficient Input Validation on Post Props
Affected: from 9.11.0+incompatible, fixed in 9.11.6+incompatible; from 10.0.0+incompatible, fixed in 10.0.4+incompatible; from 10.1.0+incompatible, fixed in 10.1.4+incompatible; from 10.2.0+incompatible, fixed in 10.2.1+incompatible.
CVE-2025-20086Medium 6.5
Insufficient Input Validation on Post Props
Affected: from 9.11.0+incompatible, fixed in 9.11.6+incompatible; from 10.0.0+incompatible, fixed in 10.0.4+incompatible; from 10.1.0+incompatible, fixed in 10.1.4+incompatible; from 10.2.0+incompatible, fixed in 10.2.1+incompatible.
CVE-2025-21088Medium 6.5
WebApp crash via improper validation of proto style in attachments
Affected: from 9.11.0+incompatible, fixed in 9.11.6+incompatible; from 10.0.0+incompatible, fixed in 10.0.4+incompatible; from 10.1.0+incompatible, fixed in 10.1.4+incompatible; from 10.2.0+incompatible, fixed in 10.2.1+incompatible.
CVE-2025-22445Low 3.5
Misleading UI for undefined admin console settings in Calls causes security confusion
Affected: fixed in 10.3.0+incompatible.
CVE-2025-20033Medium 4.3
DoS via custom post type for sysconsole plugin readers
Affected: from 10.0.0+incompatible, fixed in 10.0.4+incompatible; from 10.1.0+incompatible, fixed in 10.1.4+incompatible; from 10.2.0+incompatible, fixed in 10.2.1+incompatible.
CVE-2025-22449Low 3.8
Access control flaw for team admins allows unauthorized team additions
Affected: from 9.11.0+incompatible.
CVE-2024-54682Medium 6.5
Zipbomb DoS via Missing Slack Import Validation
Affected: from 9.5.0+incompatible, fixed in 9.5.13+incompatible; from 9.11.0+incompatible, fixed in 9.11.5+incompatible; from 10.0.0+incompatible, fixed in 10.0.3+incompatible; from 10.1.0+incompatible, fixed in 10.1.3+incompatible.
CVE-2024-54083Medium 6.5
DoS via lack of type validation in Calls
Affected: from 9.5.0+incompatible, fixed in 9.5.13+incompatible; from 9.11.0+incompatible, fixed in 9.11.5+incompatible; from 10.0.0+incompatible, fixed in 10.0.3+incompatible; from 10.1.0+incompatible, fixed in 10.1.3+incompatible.
CVE-2024-48872Medium 4.8
Bypass of "Max failed attempts" restriction via race condition
Affected: from 9.5.0+incompatible, fixed in 9.5.13+incompatible; from 9.11.0+incompatible, fixed in 9.11.5+incompatible; from 10.0.0+incompatible, fixed in 10.0.3+incompatible; from 10.1.0+incompatible, fixed in 10.1.3+incompatible.
CVE-2024-46872Medium 4.6
Client-Side Path Traversal Leading to CSRF in Playbooks
Affected: all versions.
CVE-2024-47401Medium 4.3
DoS via Amplified GraphQL Response in Playbooks
Affected: all versions.
CVE-2024-50052Medium 4.3
Arbitrary post deletion via Playbooks /ignore-thread endpoint
Affected: all versions.
CVE-2024-10241Medium 4.3
Private channel names leaked with Ctrl+K when ElasticSearch is enabled
Affected: all versions.
CVE-2024-10214Low 3.5
Incorrect Session Creation with Desktop SSO
Affected: all versions.
CVE-2024-47003Low 3.1
DoS via non-string message using permalink embed
Affected: all versions.
CVE-2024-43780Medium 4.3
Unauthorized channel file upload
Affected: from 9.5.0+incompatible, fixed in 9.5.8+incompatible; from 9.8.0+incompatible, fixed in 9.8.3+incompatible; from 9.9.0+incompatible, fixed in 9.9.2+incompatible; from 9.10.0+incompatible, fixed in 9.10.1+incompatible.
CVE-2024-42497Medium 6.0
Insufficient permissions checks on teams
Affected: from 9.5.0+incompatible, fixed in 9.5.8+incompatible; from 9.8.0+incompatible, fixed in 9.8.3+incompatible; from 9.9.0+incompatible, fixed in 9.9.2+incompatible; from 9.10.0+incompatible, fixed in 9.10.1+incompatible.
CVE-2024-40884Low 2.7
Unauthorized disabling of invite URL
Affected: from 9.5.0+incompatible, fixed in 9.5.8+incompatible; from 9.10.0+incompatible, fixed in 9.10.1+incompatible.
CVE-2024-8071Medium 4.7
System Role with edit access to permissions can elevate themselves to system admin
Affected: from 9.5.0+incompatible, fixed in 9.5.8+incompatible; from 9.8.0+incompatible, fixed in 9.8.3+incompatible; from 9.9.0+incompatible, fixed in 9.9.2+incompatible; from 9.10.0+incompatible, fixed in 9.10.1+incompatible.
CVE-2024-40886Medium 4.6
One-click Client-Side Path Traversal Leading to CSRF in User Management admin page
Affected: from 9.5.0+incompatible, fixed in 9.5.8+incompatible; from 9.8.0+incompatible, fixed in 9.8.3+incompatible; from 9.9.0+incompatible, fixed in 9.9.2+incompatible; from 9.10.0+incompatible, fixed in 9.10.1+incompatible.
CVE-2024-32939Medium 4.3
Email addresses of remote users visible in props regardless of server settings
Affected: from 9.5.0+incompatible, fixed in 9.5.8+incompatible; from 9.8.0+incompatible, fixed in 9.8.3+incompatible; from 9.9.0+incompatible, fixed in 9.9.2+incompatible; from 9.10.0+incompatible, fixed in 9.10.1+incompatible.
CVE-2024-39836Medium 4.8
Munged email address used for password resets and notifications
Affected: from 9.5.0+incompatible, fixed in 9.5.8+incompatible; from 9.8.0+incompatible, fixed in 9.8.3+incompatible; from 9.9.0+incompatible, fixed in 9.9.2+incompatible; from 9.10.0+incompatible, fixed in 9.10.1+incompatible.
CVE-2024-41926Low 2.7
Malicious remote can claim that a user was synced from another remote
Affected: from 9.5.0+incompatible, fixed in 9.5.7+incompatible; from 9.9.0+incompatible, fixed in 9.9.1+incompatible.
CVE-2024-41162Medium 4.1
Malicious remote can make an arbitrary local channel read-only
Affected: from 9.5.0+incompatible, fixed in 9.5.7+incompatible; from 9.7.0+incompatible, fixed in 9.7.6+incompatible; from 9.8.0+incompatible, fixed in 9.8.2+incompatible; from 9.9.0+incompatible, fixed in 9.9.1+incompatible.
CVE-2024-41144Medium 5.5
Malicious remote can create/update/delete arbitrary posts in arbitrary channels
Affected: from 9.5.0+incompatible, fixed in 9.5.7+incompatible; from 9.7.0+incompatible, fixed in 9.7.6+incompatible; from 9.8.0+incompatible, fixed in 9.8.2+incompatible; from 9.9.0+incompatible, fixed in 9.9.1+incompatible.
CVE-2024-39839Medium 4.3
Remote username set to an arbitrary string by remote user
Affected: from 9.5.0+incompatible, fixed in 9.5.7+incompatible; from 9.7.0+incompatible, fixed in 9.7.6+incompatible; from 9.8.0+incompatible, fixed in 9.8.2+incompatible; from 9.9.0+incompatible, fixed in 9.9.1+incompatible.
CVE-2024-39837Low 3.8
Malicious remote can create arbitrary channels
Affected: from 9.9.0, fixed in 9.9.1; from 9.5.0, fixed in 9.5.7; from 9.5.0+incompatible, fixed in 9.5.7+incompatible; from 9.9.0+incompatible, fixed in 9.9.1+incompatible.
CVE-2024-39832Medium 6.8
Permanently local data deletion by malicious remote
Affected: from 9.5.0+incompatible, fixed in 9.5.7+incompatible; from 9.7.0+incompatible, fixed in 9.7.6+incompatible; from 9.8.0+incompatible, fixed in 9.8.2+incompatible; from 9.9.0+incompatible, fixed in 9.9.1+incompatible.
CVE-2024-39777High 8.7
Malicious remote can invite itself to an arbitrary local channel
Affected: from 9.5.0+incompatible, fixed in 9.5.7+incompatible; from 9.7.0+incompatible, fixed in 9.7.6+incompatible; from 9.8.0+incompatible, fixed in 9.8.1+incompatible; from 9.9.0+incompatible, fixed in 9.9.1+incompatible.
CVE-2024-39274High 8.7
Malicious remote can add users to arbitrary teams and channels
Affected: from 9.5.0+incompatible, fixed in 9.5.7+incompatible; from 9.7.0+incompatible, fixed in 9.7.6+incompatible; from 9.8.0+incompatible, fixed in 9.8.2+incompatible; from 9.9.0+incompatible, fixed in 9.9.1+incompatible.
CVE-2024-36492High 7.4
Existing local user overwritten by malicious remote
Affected: from 9.5.0+incompatible, fixed in 9.5.7+incompatible; from 9.7.0+incompatible, fixed in 9.7.6+incompatible; from 9.8.0+incompatible, fixed in 9.8.2+incompatible; from 9.9.0+incompatible, fixed in 9.9.1+incompatible.
CVE-2024-29977Low 2.7
Malicious remote can create arbitrary reactions on arbitrary posts
Affected: from 9.5.0+incompatible, fixed in 9.5.7+incompatible; from 9.9.0+incompatible, fixed in 9.9.1+incompatible.
CVE-2024-4198Low 2.7
Mattermost versions 9.6.0, 9.5.x before 9.5.3, and 8.1.x before 8.1.12 fail to fully validate role changes which allows an attacker…
Affected: from 8.1.0+incompatible, fixed in 8.1.12+incompatible; from 9.5.0+incompatible, fixed in 9.5.3+incompatible; from 9.6.0-rc1+incompatible, fixed in 9.6.1+incompatible; from 9.6.0-rc1, fixed in 9.6.1; from 9.5.0, fixed in 9.5.3; from 8.1.0, fixed in 8.1.12.
CVE-2024-4195Low 2.7
Mattermost versions 9.6.0, 9.5.x before 9.5.3, and 8.1.x before 8.1.12 fail to fully validate role changes, which allows an attacker…
Affected: from 9.5.0, fixed in 9.5.3; from 8.1.0, fixed in 8.1.12; from 8.1.0+incompatible, fixed in 8.1.12+incompatible; from 9.5.0+incompatible, fixed in 9.5.3+incompatible.
CVE-2024-4183Medium 4.3
Mattermost versions 8.1.x before 8.1.12, 9.6.x before 9.6.1, 9.5.x before 9.5.3, 9.4.x before 9.4.5 fail to limit the number of active…
Affected: from 8.1.0+incompatible, fixed in 8.1.12+incompatible; from 9.4.0+incompatible, fixed in 9.4.5+incompatible; from 9.5.0+incompatible, fixed in 9.5.3+incompatible; from 9.6.0-rc1+incompatible, fixed in 9.6.1+incompatible; from 9.6.0-rc1, fixed in 9.6.1; from 9.5.0, fixed in 9.5.3; from 9.4.0, fixed in 9.4.5; from 8.1.0, fixed in 8.1.12.
CVE-2024-4182Medium 4.3
Mattermost versions 9.6.0, 9.5.x before 9.5.3, 9.4.x before 9.4.5, and 8.1.x before 8.1.12 fail to handle JSON parsing errors in custom…
Affected: from 8.1.0+incompatible, fixed in 8.1.12+incompatible; from 9.4.0+incompatible, fixed in 9.4.5+incompatible; from 9.5.0+incompatible, fixed in 9.5.3+incompatible; from 9.6.0-rc1+incompatible, fixed in 9.6.1+incompatible; from 8.1.0, fixed in 8.1.12; from 9.4.0, fixed in 9.4.5; from 9.5.0, fixed in 9.5.3; from 9.6.0-rc1, fixed in 9.6.1.
CVE-2024-32046Medium 4.3
Detailed error discloses full file path with dev mode off
Affected: from 8.1.0, fixed in 8.1.12; from 9.5.0, fixed in 9.5.3; from 9.6.0-rc1, fixed in 9.6.1; from 9.4.0, fixed in 9.4.5; from 8.1.0+incompatible, fixed in 8.1.12+incompatible; from 9.4.0+incompatible, fixed in 9.4.5+incompatible; from 9.5.0+incompatible, fixed in 9.5.3+incompatible; from 9.6.0-rc1+incompatible, fixed in 9.6.1+incompatible.
CVE-2024-22091Low 3.1
Excessive resource consumption due to lack to request path size limits
Affected: from 8.1.0+incompatible, fixed in 8.1.12+incompatible; from 9.5.0+incompatible, fixed in 9.5.3+incompatible; from 9.6.0-rc1+incompatible, fixed in 9.6.1+incompatible; from 8.1.0, fixed in 8.1.12; from 9.5.0, fixed in 9.5.3; from 9.6.0-rc1, fixed in 9.6.1.
CVE-2024-2447Medium 6.5
Mattermost versions 8.1.x before 8.1.11, 9.3.x before 9.3.3, 9.4.x before 9.4.4, and 9.5.x before 9.5.2 fail to authenticate the source of…
Affected: from 9.3.0+incompatible, fixed in 9.3.3+incompatible; from 9.4.0+incompatible, fixed in 9.4.4+incompatible; from 9.5.0+incompatible, fixed in 9.5.2+incompatible.
CVE-2024-29221Medium 4.7
Invite ID available to team admins even without the "Add Members" permission
Affected: from 9.3.0+incompatible, fixed in 9.3.3+incompatible; from 9.4.0+incompatible, fixed in 9.4.4+incompatible; from 9.5.0+incompatible, fixed in 9.5.2+incompatible.
CVE-2024-28949Medium 4.3
DoS via a large number of User Preferences
Affected: from 9.3.0+incompatible, fixed in 9.3.3+incompatible; from 9.4.0+incompatible, fixed in 9.4.4+incompatible; from 9.5.0+incompatible, fixed in 9.5.2+incompatible.
CVE-2024-21848Low 3.1
Users maintain access to active call after being removed from a channel
Affected: all versions.
CVE-2024-28053Low 3.1
Resource Exhaustion via the Invitation Feature
Affected: fixed in 0.0.0-20240209181221-674f549daf0e.
CVE-2024-1953Medium 4.3
Mattermost versions 8.1.x before 8.1.9, 9.2.x before 9.2.5, 9.3.0, and 9.4.x before 9.4.2 fail to limit the number of role names requested…
Affected: from 9.2.0+incompatible, fixed in 9.2.5+incompatible; from 9.3.0+incompatible, fixed in 9.3.1+incompatible; from 9.4.0+incompatible, fixed in 9.4.2+incompatible.
CVE-2024-1952Low 3.1
Mattermost version 8.1.x before 8.1.9 fails to sanitize data associated with permalinks when a plugin updates an ephemeral post, allowing…
Affected: from 9.0.0+incompatible, fixed in 9.4.0+incompatible.
CVE-2024-1949Low 2.6
A race condition in Mattermost versions 8.1.x before 8.1.9, and 9.4.x before 9.4.2 allows an authenticated attacker to gain unauthorized…
Affected: from 9.0.0+incompatible, fixed in 9.4.2+incompatible.
CVE-2024-1942Medium 4.3
Mattermost versions 8.1.x before 8.1.9, 9.2.x before 9.2.5, and 9.3.0 fail to sanitize the metadata on posts containing permalinks under…
Affected: from 9.2.0+incompatible, fixed in 9.2.5+incompatible; from 9.3.0+incompatible, fixed in 9.3.1+incompatible.
CVE-2024-1888Medium 4.3
Existing server guests invited to the team by members without "invite_guest" permission
Affected: from 9.2.0+incompatible, fixed in 9.2.5+incompatible; from 9.3.0+incompatible, fixed in 9.3.1+incompatible; from 9.4.0+incompatible, fixed in 9.4.2+incompatible.
CVE-2024-24988Medium 4.3
Excessive resource consumption when sending long emoji names in user custom status
Affected: from 9.2.0+incompatible, fixed in 9.2.5+incompatible; from 9.3.0+incompatible, fixed in 9.3.1+incompatible.
CVE-2024-1887Medium 4.3
Public channel post content accessible without membership when compliance export is enabled
Affected: from 9.2.0+incompatible, fixed in 9.2.5+incompatible; from 9.3.0+incompatible, fixed in 9.3.1+incompatible.
CVE-2024-23488Low 3.1
Files of archived channels accessible with the “Allow users to view archived channels” option disabled
Affected: from 9.0.0+incompatible, fixed in 9.4.2+incompatible.
CVE-2024-23493Medium 4.3
Team associated AD/LDAP Groups Leaked due to missing authorization
Affected: from 9.2.0+incompatible, fixed in 9.2.5+incompatible; from 9.3.0+incompatible, fixed in 9.3.1+incompatible; from 9.4.0+incompatible, fixed in 9.4.2+incompatible.
CVE-2024-1402Medium 4.3
Denial of service in mattermost mobile apps and server via emoji reactions
Affected: from 9.1.0+incompatible, fixed in 9.1.5+incompatible; from 9.2.0+incompatible, fixed in 9.2.4+incompatible.
CVE-2024-24776Low 3.1
Incorrect Authorization leads to Channel Member Count Leak
Affected: from 9.0.0+incompatible, fixed in 9.3.0+incompatible.
CVE-2023-47858Medium 4.3
Details of archived public channels are leaked to members of another team
Affected: all versions.
CVE-2023-50333Low 3.7
Lack of restriction to manage group names for freshly demoted guests
Affected: all versions.
CVE-2023-48732Medium 4.3
Keywords that trigger mentions are leaked to other users
Affected: fixed in 8.1.7+incompatible.
CVE-2023-7113Low 3.7
Mattermost version 8.1.6 and earlier fails to sanitize channel mention data in posts, which allows an attacker to inject markup in the web…
Affected: all versions.
CVE-2023-5968Medium 4.9
Password hash in response body after username update
Affected: fixed in 5.3.2-0.20230825233148-f787fd63368a.
CVE-2023-1777Medium 6.5
Information disclosure in linked message previews
Affected: from 7.8.0, fixed in 7.8.1; from 7.7.0, fixed in 7.7.2; from 7.1.0, fixed in 7.1.6; from 1.4.1-0.20211025164829-f7a8147b825c, fixed in 1.4.1-0.20230301145909-10be118d99a5.
CVE-2023-1776High 7.3
Stored XSS via SVG attachment on Boards
Affected: from 7.7.0, fixed in 7.7.2; from 7.1.0, fixed in 7.1.6; from 7.8.0, fixed in 7.8.1.
CVE-2023-1775Medium 4.3
Unsanitized events sent over Websocket to regular users in a High Availability environment
Affected: from 3.3.0, fixed in 7.1.6; from 7.7.0, fixed in 7.7.2; from 7.1.0, fixed in 7.1.6.
CVE-2023-1774Medium 4.2
Unauthorized email invite to a private channel
Affected: from 3.3.0, fixed in 7.1.6; from 7.7.0, fixed in 7.7.2; from 7.1.0, fixed in 7.1.6.
CVE-2022-4045Low 3.1
Authenticated user could send multiple requests containing a parameter which could fetch a large amount of data and can crash a Mattermost…
Affected: fixed in 7.1.4; from 7.2.0, fixed in 7.2.1; from 7.3.0, fixed in 7.3.1.
CVE-2022-4044Medium 4.3
Authenticated user could send multiple requests containing a large Auto Responder Message payload and can crash a Mattermost server
Affected: fixed in 7.1.4; from 7.2.0, fixed in 7.2.1; from 7.3.0, fixed in 7.3.1.
CVE-2022-2401Medium 6.5
Team members could access sensitive information of other users via an API call
Affected: all versions.
CVE-2022-1982Medium 4.3
A crafted SVG attachment can crash a Mattermost server
Affected: from 6.6.0, fixed in 6.6.1; from 6.5.0, fixed in 6.5.1; from 6.4.0, fixed in 6.4.3; from 5.0.0, fixed in 6.3.8.
CVE-2022-1384Medium 4.7
Authorized users are allowed to install old plugin versions from the Marketplace
Affected: all versions.
CVE-2022-1385Low 3.7
Invitation Email is resent as a Reminder after invalidating pending email invites
Affected: all versions.
CVE-2022-1332Medium 4.3
Restricted custom admin role can bypass the restrictions and view the server logs and server config.json file contents
Affected: all versions.
CVE-2022-1337Medium 4.3
OOM DoS in Mattermost image proxy
Affected: all versions.
CVE-2021-37860Low 3.7
Mattermost 5.38 and earlier fails to sufficiently sanitize clipboard contents, which allows a user-assisted attacker to inject arbitrary…
Affected: all versions.
CVE-2016-11084Unrated
An issue was discovered in Mattermost Server before 2.1.0.
Affected: fixed in 2.1.0+incompatible; fixed in 2.1.0.
CVE-2016-11083Unrated
An issue was discovered in Mattermost Server before 2.2.0.
Affected: fixed in 2.2.0+incompatible; fixed in 2.2.0.
CVE-2016-11082Unrated
An issue was discovered in Mattermost Server before 2.2.0.
Affected: fixed in 2.2.0+incompatible; fixed in 2.2.0.
CVE-2016-11081Unrated
An issue was discovered in Mattermost Server before 2.2.0.
Affected: fixed in 2.2.0+incompatible; fixed in 2.2.0.
CVE-2016-11080Unrated
An issue was discovered in Mattermost Server before 3.0.0.
Affected: fixed in 3.0.0; fixed in 3.0.0+incompatible.
CVE-2016-11079Unrated
An issue was discovered in Mattermost Server before 3.0.0.
Affected: fixed in 3.0.0+incompatible; fixed in 3.0.0.
CVE-2016-11078Unrated
An issue was discovered in Mattermost Server before 3.0.0.
Affected: fixed in 3.0.0; fixed in 3.0.0+incompatible.
CVE-2016-11077Unrated
An issue was discovered in Mattermost Server before 3.0.0.
Affected: fixed in 3.0.0; fixed in 3.0.0+incompatible.
CVE-2016-11076Unrated
An issue was discovered in Mattermost Server before 3.0.0.
Affected: fixed in 3.0.0; fixed in 3.0.0+incompatible.
CVE-2016-11075Unrated
An issue was discovered in Mattermost Server before 3.0.0.
Affected: fixed in 2.0.1-0.20160310160916-26ad6d2c7696; all versions.
CVE-2016-11074Unrated
An issue was discovered in Mattermost Server before 3.0.0.
Affected: fixed in 3.0.0+incompatible; fixed in 3.0.0.
CVE-2016-11073Unrated
An issue was discovered in Mattermost Server before 3.0.0.
Affected: fixed in 3.0.0+incompatible; fixed in 3.0.0.
CVE-2016-11072Unrated
An issue was discovered in Mattermost Server before 3.0.2.
Affected: fixed in 3.0.2+incompatible; fixed in 3.0.2.
CVE-2016-11071Unrated
An issue was discovered in Mattermost Server before 3.1.0.
Affected: fixed in 3.1.0+incompatible; fixed in 3.1.0.
CVE-2016-11070Unrated
An issue was discovered in Mattermost Server before 3.1.0.
Affected: fixed in 3.1.0; fixed in 3.1.0+incompatible.
CVE-2016-11069Unrated
An issue was discovered in Mattermost Server before 3.2.0.
Affected: fixed in 3.2.0; fixed in 3.2.0+incompatible.
CVE-2016-11068Unrated
An issue was discovered in Mattermost Server before 3.2.0.
Affected: fixed in 3.2.0+incompatible; fixed in 3.2.0.
CVE-2016-11067Unrated
An issue was discovered in Mattermost Server before 3.2.0.
Affected: fixed in 3.2.0; fixed in 3.2.0+incompatible.
CVE-2016-11066Unrated
An issue was discovered in Mattermost Server before 3.2.0.
Affected: all versions; fixed in 3.1.1.
CVE-2016-11063Unrated
An issue was discovered in Mattermost Server before 3.5.1.
Affected: fixed in 3.5.1+incompatible; fixed in 3.5.1.
CVE-2017-18918Unrated
An issue was discovered in Mattermost Server before 3.7.3 and 3.6.5.
Affected: fixed in 3.6.5+incompatible; from 3.7.0+incompatible, fixed in 3.7.3+incompatible; fixed in 3.6.5; from 3.7.0, fixed in 3.7.3.
CVE-2017-18907Unrated
An issue was discovered in Mattermost Server before 4.0.0, 3.10.2, and 3.9.2.
Affected: fixed in 3.9.2-0.20170714014920-312269ad0bd1; from 3.10.0, fixed in 3.10.2; from 3.10.0+incompatible, fixed in 3.10.2+incompatible.
CVE-2017-18916Unrated
An issue was discovered in Mattermost Server before 3.8.2, 3.7.5, and 3.6.7.
Affected: fixed in 3.6.7-0.20170420152529-0968e4079e0a; from 3.7.0, fixed in 3.7.5; from 3.8.0, fixed in 3.8.2; from 3.7.0+incompatible, fixed in 3.7.5+incompatible; from 3.8.0+incompatible, fixed in 3.8.2+incompatible.
CVE-2017-18917Unrated
An issue was discovered in Mattermost Server before 3.8.2, 3.7.5, and 3.6.7.
Affected: from 3.8.0+incompatible, fixed in 3.8.2+incompatible; fixed in 3.7.5-0.20170421192444-247cd1e51a8c; from 3.8.0, fixed in 3.8.2.
CVE-2017-18906Unrated
An issue was discovered in Mattermost Server before 4.0.0, 3.10.2, and 3.9.2, when Single Sign-On OAuth2 is used.
Affected: fixed in 3.9.2-0.20170714134023-b17fca0d5ee7; from 3.10.0, fixed in 3.10.2; from 3.10.0+incompatible, fixed in 3.10.2+incompatible.
CVE-2017-18905Unrated
An issue was discovered in Mattermost Server before 4.0.0, 3.10.2, and 3.9.2, when used as an OAuth 2.0 service provider, Session…
Affected: fixed in 3.9.2+incompatible; from 3.10.0+incompatible, fixed in 3.10.2+incompatible; fixed in 3.9.2; from 3.10.0, fixed in 3.10.2.
CVE-2017-18908Unrated
An issue was discovered in Mattermost Server before 4.0.0, 3.10.2, and 3.9.2.
Affected: fixed in 3.9.1-rc1; from 3.10.0, fixed in 3.10.1; fixed in 3.9.1-rc1+incompatible; from 3.10.0+incompatible, fixed in 3.10.1+incompatible.
CVE-2017-18915Unrated
An issue was discovered in Mattermost Server before 3.8.2, 3.7.5, and 3.6.7.
Affected: fixed in 3.6.7-0.20170420152529-0968e4079e0a; from 3.7.0, fixed in 3.7.5; from 3.8.0, fixed in 3.8.2; from 3.7.0+incompatible, fixed in 3.7.5+incompatible; from 3.8.0+incompatible, fixed in 3.8.2+incompatible.
CVE-2017-18909Unrated
An issue was discovered in Mattermost Server before 3.9.0 when SAML is used.
Affected: all versions; fixed in 3.8.1-0.20170504181128-4f074fed0d65.
CVE-2017-18911Unrated
An issue was discovered in Mattermost Server before 3.8.2, 3.7.5, and 3.6.7.
Affected: fixed in 3.6.7-rc1; from 3.7.0, fixed in 3.7.5; from 3.8.0, fixed in 3.8.2; fixed in 3.6.7-rc1+incompatible; from 3.7.0+incompatible, fixed in 3.7.5+incompatible; from 3.8.0+incompatible, fixed in 3.8.2+incompatible.
CVE-2017-18912Unrated
An issue was discovered in Mattermost Server before 3.8.2, 3.7.5, and 3.6.7.
Affected: all versions; fixed in 3.7.4-0.20170404171331-0b5c0794fdcb.
CVE-2017-18904Unrated
An issue was discovered in Mattermost Server before 4.0.0, 3.10.2, and 3.9.2.
Affected: fixed in 3.9.2+incompatible; from 3.10.0+incompatible, fixed in 3.10.2+incompatible; fixed in 3.9.2; from 3.10.0, fixed in 3.10.2.
CVE-2017-18903Unrated
An issue was discovered in Mattermost Server before 4.0.0, 3.10.2, and 3.9.2.
Affected: fixed in 3.9.2+incompatible; from 3.10.0+incompatible, fixed in 3.10.2+incompatible; fixed in 3.9.2; from 3.10.0-rc1, fixed in 3.10.2.
CVE-2017-18902Unrated
An issue was discovered in Mattermost Server before 4.1.0, 4.0.4, and 3.10.3.
Affected: fixed in 3.10.3; from 4.0.0, fixed in 4.0.4; from 4.0.5-rc1, fixed in 4.1.0; fixed in 3.10.3+incompatible; from 4.0.0+incompatible, fixed in 4.0.4+incompatible; from 4.0.5-rc1+incompatible, fixed in 4.1.0+incompatible.
CVE-2017-18898Unrated
An issue was discovered in Mattermost Server before 4.2.0, 4.1.1, and 4.0.5.
Affected: fixed in 4.0.5; from 4.1.0, fixed in 4.1.1; from 4.2.0-rc1, fixed in 4.2.0; fixed in 4.0.5+incompatible; from 4.1.0+incompatible, fixed in 4.1.1+incompatible; from 4.2.0-rc1+incompatible, fixed in 4.2.0+incompatible.
CVE-2017-18900Unrated
An issue was discovered in Mattermost Server before 4.1.0, 4.0.4, and 3.10.3.
Affected: fixed in 3.10.3+incompatible; from 4.0.0+incompatible, fixed in 4.0.3+incompatible; fixed in 3.10.3; from 4.0.0, fixed in 4.0.3.
CVE-2017-18886Unrated
An issue was discovered in Mattermost Server before 4.3.0, 4.2.1, and 4.1.2.
Affected: fixed in 4.1.2; from 4.2.0-rc1, fixed in 4.2.1; from 4.3.0-rc1, fixed in 4.3.0; fixed in 4.1.2+incompatible; from 4.2.0-rc1+incompatible, fixed in 4.2.1+incompatible; from 4.3.0-rc1+incompatible, fixed in 4.3.0+incompatible.
CVE-2017-18895Unrated
An issue was discovered in Mattermost Server before 4.2.0, 4.1.1, and 4.0.5.
Affected: fixed in 4.0.5; from 4.1.0, fixed in 4.1.1; from 4.2.0-rc1, fixed in 4.2.0; fixed in 4.0.5+incompatible; from 4.1.0+incompatible, fixed in 4.1.1+incompatible; from 4.2.0-rc1+incompatible, fixed in 4.2.0+incompatible.
CVE-2017-18887Unrated
An issue was discovered in Mattermost Server before 4.3.0, 4.2.1, and 4.1.2.
Affected: fixed in 4.1.2+incompatible; from 4.2.0-rc1+incompatible, fixed in 4.2.1+incompatible; from 4.3.0-rc1+incompatible, fixed in 4.3.0+incompatible; fixed in 4.1.2; from 4.2.0-rc1, fixed in 4.2.1; from 4.3.0-rc1, fixed in 4.3.0.
CVE-2017-18888Unrated
An issue was discovered in Mattermost Server before 4.3.0, 4.2.1, and 4.1.2.
Affected: fixed in 4.1.2+incompatible; from 4.2.0-rc1+incompatible, fixed in 4.2.1+incompatible; from 4.3.0-rc1+incompatible, fixed in 4.3.0+incompatible; fixed in 4.1.2; from 4.2.0-rc1, fixed in 4.2.1; from 4.3.0-rc1, fixed in 4.3.0.
CVE-2017-18893Unrated
An issue was discovered in Mattermost Server before 4.2.0, 4.1.1, and 4.0.5.
Affected: fixed in 4.0.5+incompatible; from 4.1.0+incompatible, fixed in 4.1.1+incompatible; from 4.2.0-rc1+incompatible, fixed in 4.2.0+incompatible; fixed in 4.0.5; from 4.1.0, fixed in 4.1.1; from 4.2.0-rc1, fixed in 4.2.0.
CVE-2017-18894Unrated
An issue was discovered in Mattermost Server before 4.2.0, 4.1.1, and 4.0.5, when used as an OAuth 2.0 service provider.
Affected: fixed in 4.0.5+incompatible; from 4.1.0+incompatible, fixed in 4.1.1+incompatible; from 4.2.0-rc1+incompatible, fixed in 4.2.0+incompatible; fixed in 4.0.5; from 4.1.0, fixed in 4.1.1; from 4.2.0-rc1, fixed in 4.2.0.
CVE-2017-18896Unrated
An issue was discovered in Mattermost Server before 4.2.0, 4.1.1, and 4.0.5.
Affected: from 4.1.0, fixed in 4.1.1; fixed in 4.0.5; from 4.2.0-rc1, fixed in 4.2.0; fixed in 4.0.5+incompatible; from 4.1.0+incompatible, fixed in 4.1.1+incompatible; from 4.2.0-rc1+incompatible, fixed in 4.2.0+incompatible.
CVE-2017-18897Unrated
An issue was discovered in Mattermost Server before 4.2.0, 4.1.1, and 4.0.5, when used as an OAuth 2.0 service provider.
Affected: fixed in 4.0.5; from 4.1.0, fixed in 4.1.1; from 4.2.0-rc1, fixed in 4.2.0; fixed in 4.0.5+incompatible; from 4.1.0+incompatible, fixed in 4.1.1+incompatible; from 4.2.0-rc1+incompatible, fixed in 4.2.0+incompatible.
CVE-2017-18885Unrated
An issue was discovered in Mattermost Server before 4.3.0, 4.2.1, and 4.1.2.
Affected: fixed in 4.1.2+incompatible; from 4.2.0-rc1+incompatible, fixed in 4.2.1+incompatible; from 4.3.0-rc1+incompatible, fixed in 4.3.0+incompatible; fixed in 4.1.2; from 4.2.0-rc1, fixed in 4.2.1; from 4.3.0-rc1, fixed in 4.3.0.
CVE-2017-18901Unrated
An issue was discovered in Mattermost Server before 4.1.0, 4.0.4, and 3.10.3.
Affected: all versions; fixed in 3.10.3; from 4.0.0, fixed in 4.0.4.
CVE-2017-18889Unrated
An issue was discovered in Mattermost Server before 4.3.0, 4.2.1, and 4.1.2.
Affected: fixed in 4.1.2; from 4.2.0-rc1, fixed in 4.2.1; from 4.3.0-rc1, fixed in 4.3.0; fixed in 4.1.2+incompatible; from 4.2.0-rc1+incompatible, fixed in 4.2.1+incompatible; from 4.3.0-rc1+incompatible, fixed in 4.3.0+incompatible.
CVE-2017-18890Unrated
An issue was discovered in Mattermost Server before 4.3.0, 4.2.1, and 4.1.2.
Affected: fixed in 4.1.2+incompatible; from 4.2.0-rc1+incompatible, fixed in 4.2.1+incompatible; from 4.3.0-rc1+incompatible, fixed in 4.3.0+incompatible; fixed in 4.1.2; from 4.2.0-rc1, fixed in 4.2.1; from 4.3.0-rc1, fixed in 4.3.0.
CVE-2017-18892Unrated
An issue was discovered in Mattermost Server before 4.2.0, 4.1.1, and 4.0.5.
Affected: fixed in 4.0.5; from 4.1.0, fixed in 4.1.1; from 4.2.0-rc1, fixed in 4.2.0; fixed in 4.0.5+incompatible; from 4.1.0+incompatible, fixed in 4.1.1+incompatible; from 4.2.0-rc1+incompatible, fixed in 4.2.0+incompatible.
CVE-2017-18891Unrated
An issue was discovered in Mattermost Server before 4.2.0, 4.1.1, and 4.0.5.
Affected: fixed in 4.0.5; from 4.1.0, fixed in 4.1.1; from 4.2.0-rc1, fixed in 4.2.0; fixed in 4.0.5+incompatible; from 4.1.0+incompatible, fixed in 4.1.1+incompatible; from 4.2.0-rc1+incompatible, fixed in 4.2.0+incompatible.
CVE-2017-18884Unrated
An issue was discovered in Mattermost Server before 4.3.0, 4.2.1, and 4.1.2.
Affected: fixed in 4.1.2+incompatible; from 4.2.0-rc1+incompatible, fixed in 4.2.1+incompatible; from 4.3.0-rc1+incompatible, fixed in 4.3.0+incompatible; fixed in 4.1.2; from 4.2.0-rc1, fixed in 4.2.1; from 4.3.0-rc1, fixed in 4.3.0.
CVE-2017-18883Unrated
An issue was discovered in Mattermost Server before 4.3.0, 4.2.1, and 4.1.2, when serving as an OAuth 2.0 Service Provider.
Affected: fixed in 4.1.2+incompatible; from 4.2.0-rc1+incompatible, fixed in 4.2.1+incompatible; from 4.3.0-rc1+incompatible, fixed in 4.3.0+incompatible; fixed in 4.1.2; from 4.2.0-rc1, fixed in 4.2.1; from 4.3.0-rc1, fixed in 4.3.0.
CVE-2017-18879Unrated
An issue was discovered in Mattermost Server before 4.3.0, 4.2.1, and 4.1.2.
Affected: fixed in 4.1.2+incompatible; from 4.2.0+incompatible, fixed in 4.2.1+incompatible; from 4.3.0-rc1+incompatible, fixed in 4.3.0+incompatible; fixed in 4.1.2; from 4.2.0, fixed in 4.2.1; from 4.3.0-rc1, fixed in 4.3.0.
CVE-2017-18878Unrated
An issue was discovered in Mattermost Server before 4.3.0, 4.2.1, and 4.1.2.
Affected: from 4.3.0-rc1+incompatible, fixed in 4.3.0+incompatible; fixed in 4.1.2-0.20171004201910-6be8113eb60c; from 4.2.0-rc1, fixed in 4.2.1-0.20171004192657-8fbbd688ea24; from 4.3.0-rc1, fixed in 4.3.0.
CVE-2017-18874Unrated
An issue was discovered in Mattermost Server before 4.3.0, 4.2.1, and 4.1.2 when local storage for files is used.
Affected: from 4.2.0-rc1+incompatible, fixed in 4.2.0+incompatible; from 4.3.0-rc1+incompatible, fixed in 4.3.0+incompatible; fixed in 4.1.2-0.20171004201910-6be8113eb60; from 4.2.0-rc1, fixed in 4.2.1-0.20171004194140-6d3cb2ce07fc; from 4.3.0-rc1, fixed in 4.3.0.
CVE-2017-18873Unrated
An issue was discovered in Mattermost Server before 4.3.0, 4.2.1, and 4.1.2.
Affected: fixed in 4.1.2-0.20171013141717-ee57a5829ab1; from 4.2.0, fixed in 4.2.1-0.20171013140502-b3e4b0ac9168; from 4.3.0-rc1, fixed in 4.3.0; fixed in 4.1.2-0.20171013141717-ee57a5829ab1+incompatible; from 4.2.0+incompatible, fixed in 4.2.1-0.20171013140502-b3e4b0ac9168+incompatible; from 4.3.0-rc1+incompatible, fixed in 4.3.0+incompatible.
CVE-2017-18872Unrated
An issue was discovered in Mattermost Server before 4.4.3 and 4.3.3.
Affected: fixed in 4.3.3+incompatible; from 4.4.0-rc1+incompatible, fixed in 4.4.3+incompatible; fixed in 4.3.3; from 4.4.0-rc1, fixed in 4.4.3.
CVE-2017-18871Unrated
An issue was discovered in Mattermost Server before 4.5.0, 4.4.5, 4.3.4, and 4.2.2.
Affected: fixed in 4.2.2+incompatible; from 4.3.0-rc1+incompatible, fixed in 4.3.4+incompatible; from 4.4.0-rc1+incompatible, fixed in 4.4.5+incompatible; from 4.5.0-rc1+incompatible, fixed in 4.5.0+incompatible; fixed in 4.2.2; from 4.3.0-rc1, fixed in 4.3.4; from 4.4.0-rc1, fixed in 4.4.5; from 4.5.0-rc1, fixed in 4.5.0.
CVE-2017-18877Unrated
An issue was discovered in Mattermost Server before 4.3.0, 4.2.1, and 4.1.2.
Affected: fixed in 4.1.2; from 4.2.0, fixed in 4.2.1; from 4.3.0-rc1, fixed in 4.3.0; fixed in 4.1.2+incompatible; from 4.2.0+incompatible, fixed in 4.2.1+incompatible; from 4.3.0-rc1+incompatible, fixed in 4.3.0+incompatible.
CVE-2017-18876Unrated
An issue was discovered in Mattermost Server before 4.3.0, 4.2.1, and 4.1.2 when local storage for files is used.
Affected: fixed in 4.1.2-0.20171004201910-6be8113eb60c; from 4.2.0-rc1.0.20171004154238-fadd9514f6e7, fixed in 4.2.1-0.20171004194140-6d3cb2ce07fc; from 4.3.0-rc1, fixed in 4.3.0; from 4.3.0-rc1+incompatible, fixed in 4.3.0+incompatible.
CVE-2017-18875Unrated
An issue was discovered in Mattermost Server before 4.3.0, 4.2.1, and 4.1.2 when local storage for files is used.
Affected: fixed in 4.1.2-0.20171004201910-6be8113eb60c; from 4.2.0-rc1.0.20171004154238-fadd9514f6e7, fixed in 4.2.1-0.20171004194140-6d3cb2ce07fc; from 4.3.0-rc1, fixed in 4.3.0; from 4.3.0-rc1+incompatible, fixed in 4.3.0+incompatible.
CVE-2017-18870Unrated
An issue was discovered in Mattermost Server before 4.5.0, 4.4.5, and 4.3.4.
Affected: all versions.
CVE-2018-21258Unrated
An issue was discovered in Mattermost Server before 5.1.
Affected: all versions; fixed in 5.1.0.
CVE-2020-14457Unrated
An issue was discovered in Mattermost Server before 5.20.0.
Affected: all versions.