# github.com/mattermost/mattermost-server (Go) vulnerabilities 296 known vulnerabilities (5 critical, 18 high, 147 medium, 62 low), with the versions each affects and the releases that fix them. ## At a glance - Latest release: not known (cve.now hasn't read this package's releases) - Newest unaffected release: not known without release data - Registry: https://pkg.go.dev/github.com/mattermost/mattermost-server ## Advisories (296) ### [CVE-2026-8823](https://cve.now/CVE-2026-8823): User Manager can demote bot accounts to guest without bot-management permission - Severity: Low 3.8 - Published: Jun 22, 2026 - Affected: from 11.7.0, fixed in 11.7.1; from 10.11.0, fixed in 10.11.18; from 10.11.0+incompatible, fixed in 10.11.18+incompatible; from 11.7.0+incompatible, fixed in 11.7.1+incompatible. ### [CVE-2026-6062](https://cve.now/CVE-2026-6062): IDOR in Jira plugin subscription edit endpoint - Severity: Medium 6.4 - Published: Jun 22, 2026 - Affected: from 10.11.0+incompatible, fixed in 10.11.18+incompatible; from 11.5.0+incompatible, fixed in 11.5.6+incompatible; from 11.6.0+incompatible, fixed in 11.6.3+incompatible; from 11.7.0+incompatible, fixed in 11.7.1+incompatible; from 11.7.0, fixed in 11.7.1; from 11.6.0, fixed in 11.6.3; from 11.5.0, fixed in 11.5.6; from 10.11.0, fixed in 10.11.18. ### [CVE-2026-6673](https://cve.now/CVE-2026-6673): Mattermost Jira plugin had unauthenticated {{/ac/installed}} lifecycle callback during pending Jira Cloud install - Severity: Medium 6.4 - Published: Jun 22, 2026 - Affected: from 11.7.0, fixed in 11.7.1; from 11.6.0, fixed in 11.6.3; from 11.5.0, fixed in 11.5.6; from 10.11.0, fixed in 10.11.18; from 10.11.0+incompatible, fixed in 10.11.18+incompatible; from 11.5.0+incompatible, fixed in 11.5.6+incompatible; from 11.6.0+incompatible, fixed in 11.6.3+incompatible; from 11.7.0+incompatible, fixed in 11.7.1+incompatible. ### [CVE-2026-8074](https://cve.now/CVE-2026-8074): Improper Permission Check Allows User Manager to Deactivate Bot Accounts - Severity: Low 3.8 - Published: Jun 22, 2026 - Affected: from 11.7.0, fixed in 11.7.1; from 10.11.0, fixed in 10.11.18; from 10.11.0+incompatible, fixed in 10.11.18+incompatible; from 11.7.0+incompatible, fixed in 11.7.1+incompatible. ### [CVE-2026-9162](https://cve.now/CVE-2026-9162): Global session revocation does not invalidate active WebSocket connections - Severity: Medium 4.3 - Published: Jun 22, 2026 - Affected: from 10.11.0+incompatible, fixed in 10.11.18+incompatible; from 11.5.0+incompatible, fixed in 11.5.6+incompatible; from 11.6.0+incompatible, fixed in 11.6.3+incompatible; from 11.7.0+incompatible, fixed in 11.7.1+incompatible; from 11.7.0, fixed in 11.7.1; from 11.6.0, fixed in 11.6.3; from 11.5.0, fixed in 11.5.6; from 10.11.0, fixed in 10.11.18. ### [CVE-2026-5139](https://cve.now/CVE-2026-5139): GitLab Plugin Allows Non-Admin Users to Modify Default Instance Configuration - Severity: Medium 5.4 - Published: Jun 22, 2026 - Affected: from 11.7.0, fixed in 11.7.1; from 11.6.0, fixed in 11.6.3; from 11.5.0, fixed in 11.5.6; from 10.11.0, fixed in 10.11.18; from 10.11.0+incompatible, fixed in 10.11.18+incompatible; from 11.5.0+incompatible, fixed in 11.5.6+incompatible; from 11.6.0+incompatible, fixed in 11.6.3+incompatible; from 11.7.0+incompatible, fixed in 11.7.1+incompatible. ### [CVE-2026-6961](https://cve.now/CVE-2026-6961): CVE-2026-6961: Path traversal via unsanitized FileInfo.Name in Mattermost federation sync - Severity: High 7.6 - Published: Jun 12, 2026 - Affected: from 10.11.0+incompatible, fixed in 10.11.17+incompatible; from 11.5.0+incompatible, fixed in 11.5.5+incompatible; from 11.6.0+incompatible, fixed in 11.6.1+incompatible; from 11.6.0, fixed in 11.6.1; from 11.5.0, fixed in 11.5.5; from 10.11.0, fixed in 10.11.17. ### [CVE-2026-7387](https://cve.now/CVE-2026-7387): Mattermost group syncable endpoints allow privilege escalation via scheme\_admin - Severity: High 8.8 - Published: Jun 12, 2026 - Affected: from 10.11.0+incompatible, fixed in 10.11.17+incompatible; from 11.5.0+incompatible, fixed in 11.5.5+incompatible; from 11.6.0+incompatible, fixed in 11.6.1+incompatible; from 11.6.0, fixed in 11.6.1; from 11.5.0, fixed in 11.5.5; from 10.11.0, fixed in 10.11.17. ### [CVE-2026-6046](https://cve.now/CVE-2026-6046): Plugin bot username conflict allows user account to be used as bot identity in Mattermost Server - Severity: Medium 5.3 - Published: Jun 12, 2026 - Affected: from 11.6.0, fixed in 11.6.1; from 11.5.0, fixed in 11.5.5; from 10.11.0, fixed in 10.11.17; from 10.11.0+incompatible, fixed in 10.11.17+incompatible; from 11.5.0+incompatible, fixed in 11.5.5+incompatible; from 11.6.0+incompatible, fixed in 11.6.1+incompatible. ### [CVE-2026-6689](https://cve.now/CVE-2026-6689): Missing {{invite\_user}} permission check on team creation allows unprivileged users to set open-invite and allowed-domains team settings - Severity: Medium 4.3 - Published: Jun 12, 2026 - Affected: from 11.6.0, fixed in 11.6.1; from 11.5.0, fixed in 11.5.5; from 10.11.0, fixed in 10.11.17; from 10.11.0+incompatible, fixed in 10.11.17+incompatible; from 11.5.0+incompatible, fixed in 11.5.5+incompatible; from 11.6.0+incompatible, fixed in 11.6.1+incompatible. ### [CVE-2026-7184](https://cve.now/CVE-2026-7184): Mattermost Remote Cluster PATCH API Leaks Authentication Tokens - Severity: Medium 6.5 - Published: Jun 12, 2026 - Affected: from 10.11.0+incompatible, fixed in 10.11.16+incompatible; from 11.5.0+incompatible, fixed in 11.5.5+incompatible; from 11.6.0+incompatible, fixed in 11.6.1+incompatible; from 11.6.0, fixed in 11.6.1; from 11.5.0, fixed in 11.5.5; from 10.11.0, fixed in 10.11.16. ### [CVE-2026-6739](https://cve.now/CVE-2026-6739): Mattermost: Delegated admins could patch protected default system roles - Severity: Medium 6.7 - Published: Jun 12, 2026 - Affected: from 10.11.0+incompatible, fixed in 10.11.17+incompatible; from 11.5.0+incompatible, fixed in 11.5.5+incompatible; from 11.6.0+incompatible, fixed in 11.6.1+incompatible; from 11.6.0, fixed in 11.6.1; from 11.5.0, fixed in 11.5.5; from 10.11.0, fixed in 10.11.17. ### [CVE-2026-3433](https://cve.now/CVE-2026-3433): Mattermost fails to scope role\_updated websocket events to authorized team and channel members - Severity: Medium 4.3 - Published: Jun 12, 2026 - Affected: from 10.11.0+incompatible, fixed in 10.11.17+incompatible; from 11.5.0+incompatible, fixed in 11.5.5+incompatible; from 11.6.0+incompatible, fixed in 11.6.1+incompatible; from 11.6.0, fixed in 11.6.1; from 11.5.0, fixed in 11.5.5; from 10.11.0, fixed in 10.11.17. ### [CVE-2026-4915](https://cve.now/CVE-2026-4915): Server panic via outgoing webhook responses - Severity: Medium 6.5 - Published: May 25, 2026 - Affected: from 11.6.0, fixed in 11.6.1; from 11.5.0, fixed in 11.5.4; from 11.4.0, fixed in 11.4.5; from 10.11.0, fixed in 10.11.15; from 10.11.0+incompatible, fixed in 10.11.15+incompatible; from 11.4.0+incompatible, fixed in 11.4.5+incompatible; from 11.5.0+incompatible, fixed in 11.5.4+incompatible; from 11.6.0+incompatible, fixed in 11.6.1+incompatible. ### [CVE-2026-28735](https://cve.now/CVE-2026-28735): GitHub OAuth Scope Validation - Severity: Medium 5.4 - Published: May 22, 2026 - Affected: from 11.6.0, fixed in 11.6.1; from 11.5.0, fixed in 11.5.4; from 11.4.0, fixed in 11.4.5; from 10.11.0, fixed in 10.11.15; from 10.11.0+incompatible, fixed in 10.11.15+incompatible; from 11.4.0+incompatible, fixed in 11.4.5+incompatible; from 11.5.0+incompatible, fixed in 11.5.4+incompatible; from 11.6.0+incompatible, fixed in 11.6.1+incompatible. ### [CVE-2026-4635](https://cve.now/CVE-2026-4635): Persistent notification timing attack causing server denial of service - Severity: Medium 6.5 - Published: May 22, 2026 - Affected: from 10.11.0+incompatible, fixed in 10.11.15+incompatible; from 11.4.0+incompatible, fixed in 11.4.5+incompatible; from 11.5.0+incompatible, fixed in 11.5.4+incompatible; from 11.6.0+incompatible, fixed in 11.6.1+incompatible; from 11.6.0, fixed in 11.6.1; from 11.5.0, fixed in 11.5.4; from 11.4.0, fixed in 11.4.5; from 10.11.0, fixed in 10.11.15. ### [CVE-2026-3473](https://cve.now/CVE-2026-3473): Improper file ownership validation in the Boards API allows unauthorised file access - Severity: Medium 5.9 - Published: May 22, 2026 - Affected: from 11.6.0, fixed in 11.6.1; from 11.5.0, fixed in 11.5.4; from 11.4.0, fixed in 11.4.5; from 10.11.0, fixed in 10.11.15; from 10.11.0+incompatible, fixed in 10.11.15+incompatible; from 11.4.0+incompatible, fixed in 11.4.5+incompatible; from 11.5.0+incompatible, fixed in 11.5.4+incompatible; from 11.6.0+incompatible, fixed in 11.6.1+incompatible. ### [CVE-2026-4646](https://cve.now/CVE-2026-4646): Insufficient input validation in GitHub plugin API causes denial of service - Severity: Medium 4.3 - Published: May 22, 2026 - Affected: from 10.11.0+incompatible, fixed in 10.11.15+incompatible; from 11.4.0+incompatible, fixed in 11.4.5+incompatible; from 11.5.0+incompatible, fixed in 11.5.4+incompatible; from 11.6.0+incompatible, fixed in 11.6.1+incompatible; from 11.6.0, fixed in 11.6.1; from 11.5.0, fixed in 11.5.4; from 11.4.0, fixed in 11.4.5; from 10.11.0, fixed in 10.11.15. ### [CVE-2026-3636](https://cve.now/CVE-2026-3636): Sanitize team member data returned by API - Severity: Medium 4.3 - Published: May 22, 2026 - Affected: from 11.6.0, fixed in 11.6.1; from 11.5.0, fixed in 11.5.4; from 11.4.0, fixed in 11.4.5; from 10.11.0, fixed in 10.11.15; from 10.11.0+incompatible, fixed in 10.11.15+incompatible; from 11.4.0+incompatible, fixed in 11.4.5+incompatible; from 11.5.0+incompatible, fixed in 11.5.4+incompatible; from 11.6.0+incompatible, fixed in 11.6.1+incompatible. ### [CVE-2026-5740](https://cve.now/CVE-2026-5740): Unauthenticated WebSocket binary frame causes denial of service in Mattermost Server - Severity: High 7.5 - Published: May 22, 2026 - Affected: from 11.6.0, fixed in 11.6.1; from 11.5.0, fixed in 11.5.4; from 11.4.0, fixed in 11.4.5; from 10.11.0, fixed in 10.11.15; from 10.11.0+incompatible, fixed in 10.11.15+incompatible; from 11.4.0+incompatible, fixed in 11.4.5+incompatible; from 11.5.0+incompatible, fixed in 11.5.4+incompatible; from 11.6.0+incompatible, fixed in 11.6.1+incompatible. ### [CVE-2026-5308](https://cve.now/CVE-2026-5308): Missing request body size limits on Zoom plugin HTTP endpoints - Severity: Medium 4.9 - Published: May 22, 2026 - Affected: from 10.11.0+incompatible, fixed in 10.11.15+incompatible; from 11.4.0+incompatible, fixed in 11.4.5+incompatible; from 11.5.0+incompatible, fixed in 11.5.4+incompatible; from 11.6.0+incompatible, fixed in 11.6.1+incompatible; from 11.6.0, fixed in 11.6.1; from 11.5.0, fixed in 11.5.4; from 11.4.0, fixed in 11.4.5; from 10.11.0, fixed in 10.11.15. ### [CVE-2026-5755](https://cve.now/CVE-2026-5755): Denial of service via crafted TIFF file upload - Severity: Medium 6.5 - Published: May 22, 2026 - Affected: from 10.11.0+incompatible, fixed in 10.11.15+incompatible; from 11.4.0+incompatible, fixed in 11.4.5+incompatible; from 11.5.0+incompatible, fixed in 11.5.4+incompatible; from 11.6.0+incompatible, fixed in 11.6.1+incompatible; from 11.6.0, fixed in 11.6.1; from 11.5.0, fixed in 11.5.4; from 11.4.0, fixed in 11.4.5; from 10.11.0, fixed in 10.11.15. ### [CVE-2026-4858](https://cve.now/CVE-2026-4858): Path traversal in integration action URL leading to arbitrary API execution via system admin’s auth token. - Severity: High 8.0 - Published: May 21, 2026 - Affected: from 11.6.0, fixed in 11.6.1; from 11.5.0, fixed in 11.5.4; from 11.4.0, fixed in 11.4.5; from 10.11.0, fixed in 10.11.15; from 10.11.0+incompatible, fixed in 10.11.15+incompatible; from 11.4.0+incompatible, fixed in 11.4.5+incompatible; from 11.5.0+incompatible, fixed in 11.5.4+incompatible; from 11.6.0+incompatible, fixed in 11.6.1+incompatible. ### [CVE-2026-4055](https://cve.now/CVE-2026-4055): Insufficient permission validation on cross-team playbook run creation - Severity: Medium 4.3 - Published: May 21, 2026 - Affected: all versions. ### [CVE-2026-6333](https://cve.now/CVE-2026-6333): SSRF via Host Header Spoofing in Custom Slash Commands - Severity: Low 3.5 - Published: May 18, 2026 - Affected: fixed in 5.3.2-0.20260325160634-e738016c5920; from 10.11.0+incompatible, fixed in 10.11.14+incompatible; from 11.5.0+incompatible, fixed in 11.5.2+incompatible. ### [CVE-2026-6345](https://cve.now/CVE-2026-6345): Prevent password disclosure and force reset during Slack import - Severity: Medium 6.5 - Published: May 18, 2026 - Affected: fixed in 5.3.2-0.20260311102650-3057ae7e83e9; from 10.11.0+incompatible, fixed in 10.11.14+incompatible; from 11.4.0+incompatible, fixed in 11.4.4+incompatible; from 11.5.0+incompatible, fixed in 11.5.2+incompatible. ### [CVE-2026-6346](https://cve.now/CVE-2026-6346): Sensitive credentials exposed in plaintext in Mattermost support packets - Severity: High 8.7 - Published: May 18, 2026 - Affected: from 10.11.0+incompatible, fixed in 10.11.14+incompatible; from 11.4.0+incompatible, fixed in 11.4.4+incompatible; from 11.5.0+incompatible, fixed in 11.5.2+incompatible; fixed in 5.3.2-0.20260326202606-fac92f4a71f3. ### [CVE-2026-28732](https://cve.now/CVE-2026-28732): Slash command trigger-word update allowed command hijacking - Severity: Medium 4.3 - Published: May 18, 2026 - Affected: fixed in 5.3.2-0.20260306123948-f5fe8ded6b63; from 10.11.0+incompatible, fixed in 10.11.14+incompatible; from 11.4.0+incompatible, fixed in 11.4.4+incompatible; from 11.5.0+incompatible, fixed in 11.5.2+incompatible. ### [CVE-2026-6343](https://cve.now/CVE-2026-6343): Mattermost Playbooks Plugin fails to enforce view permissions in list endpoints, allowing unauthorized access to public playbooks - Severity: Medium 4.3 - Published: May 18, 2026 - Affected: from 10.11.0+incompatible, fixed in 10.11.14+incompatible; from 11.4.0+incompatible, fixed in 11.4.4+incompatible; from 11.5.0+incompatible, fixed in 11.5.2+incompatible. ### [CVE-2026-6347](https://cve.now/CVE-2026-6347): Mattermost Calls plugin exposes TURN server credentials in plaintext in support packets - Severity: High 7.6 - Published: May 18, 2026 - Affected: from 10.11.0+incompatible, fixed in 10.11.14+incompatible; from 11.4.0+incompatible, fixed in 11.4.4+incompatible; from 11.5.0+incompatible, fixed in 11.5.2+incompatible; from 11.5.0, fixed in 11.5.2; from 10.11.0, fixed in 10.11.14; from 11.4.0, fixed in 11.4.4. ### [CVE-2026-5163](https://cve.now/CVE-2026-5163): Missing authorization check in AI message rewrite endpoint allows access to private thread content - Severity: Medium 6.5 - Published: May 18, 2026 - Affected: fixed in 5.3.2-0.20260401090745-f4d1abe7e8f5; from 11.5.0+incompatible, fixed in 11.5.2+incompatible. ### [CVE-2026-4286](https://cve.now/CVE-2026-4286): Playbooks Plugin fails to validate team transfers, allowing unauthorized removal of member access via playbook update - Severity: Low 3.1 - Published: May 18, 2026 - Affected: from 10.11.0+incompatible, fixed in 10.11.14+incompatible; from 11.5.0+incompatible, fixed in 11.5.2+incompatible. ### [CVE-2026-6339](https://cve.now/CVE-2026-6339): Missing request origin validation on burn-on-read reveal endpoint - Severity: Medium 4.3 - Published: May 18, 2026 - Affected: fixed in 5.3.2-0.20260327001745-7a339a6438f5; from 11.4.0+incompatible, fixed in 11.4.4+incompatible; from 11.5.0+incompatible, fixed in 11.5.2+incompatible. ### [CVE-2026-6340](https://cve.now/CVE-2026-6340): Memory Exhaustion via Malicious 7zip File Upload - Severity: Medium 4.3 - Published: May 18, 2026 - Affected: fixed in 5.3.2-0.20260325191733-fb11968f8798; from 10.11.0+incompatible, fixed in 10.11.14+incompatible; from 11.4.0+incompatible, fixed in 11.4.4+incompatible; from 11.5.0+incompatible, fixed in 11.5.2+incompatible. ### [CVE-2026-3495](https://cve.now/CVE-2026-3495): Unescaped variables during error page composition - Severity: Low 3.8 - Published: May 18, 2026 - Affected: from 10.11.0+incompatible, fixed in 10.11.14+incompatible; from 11.5.0+incompatible, fixed in 11.5.2+incompatible; fixed in 5.3.2-0.20260310115442-5a1ea95044dc. ### [CVE-2026-4273](https://cve.now/CVE-2026-4273): Insufficient token rotation validation in remote cluster invite confirmation - Severity: Low 3.7 - Published: May 18, 2026 - Affected: from 10.11.0+incompatible, fixed in 10.11.14+incompatible; from 11.5.0+incompatible, fixed in 11.5.2+incompatible; fixed in 5.3.2-0.20260313190740-742e0be95074. ### [CVE-2026-3637](https://cve.now/CVE-2026-3637): Mattermost fails to enforce create\_post permission when editing posts - Severity: Medium 4.3 - Published: May 18, 2026 - Affected: from 10.11.0+incompatible, fixed in 10.11.14+incompatible; from 11.4.0+incompatible, fixed in 11.4.4+incompatible; from 11.5.0+incompatible, fixed in 11.5.2+incompatible; fixed in 5.3.2-0.20260316171743-090408f09f53. ### [CVE-2026-2325](https://cve.now/CVE-2026-2325): Improper Input Validation in MS Teams Meetings API Handler - Severity: Medium 4.3 - Published: May 18, 2026 - Affected: from 10.11.0+incompatible, fixed in 10.11.14+incompatible; from 11.4.0+incompatible, fixed in 11.4.4+incompatible; from 11.5.0+incompatible, fixed in 11.5.2+incompatible; from 11.5.0, fixed in 11.5.2; from 10.11.0, fixed in 10.11.14; from 11.4.0, fixed in 11.4.4. ### [CVE-2026-28759](https://cve.now/CVE-2026-28759): Insufficient authorization in shared channel membership sync allows remote cluster to remove users from arbitrary channels - Severity: Medium 4.3 - Published: May 18, 2026 - Affected: from 10.11.0+incompatible, fixed in 10.11.14+incompatible; from 11.4.0+incompatible, fixed in 11.4.4+incompatible; from 11.5.0+incompatible, fixed in 11.5.2+incompatible; fixed in 5.3.2-0.20260216150504-8738f8c4b3d4. ### [CVE-2026-6334](https://cve.now/CVE-2026-6334): OAuth authorization code client binding not enforced during token redemption in Mattermost - Severity: Low 3.1 - Published: May 18, 2026 - Affected: fixed in 5.3.2-0.20260318173148-e9ae890a013b; from 10.11.0+incompatible, fixed in 10.11.14+incompatible; from 11.5.0+incompatible, fixed in 11.5.2+incompatible. ### [CVE-2026-4053](https://cve.now/CVE-2026-4053): post edit time limit is not enforced on some post update operations - Severity: Low 3.1 - Published: May 15, 2026 - Affected: from 0.0.0-20250731163400-5b955468ea1e, fixed in 0.0.0-20260414103857-b21ef302025e; from 11.5.0+incompatible, fixed in 11.5.2+incompatible; from 11.5.0, fixed in 11.5.2; from 0.0.0-20250731163400-5b955468ea1e, fixed in 0.0.0-20260414103857-b21ef302025e. ### [CVE-2026-4054](https://cve.now/CVE-2026-4054): SVG content served through Mattermost image proxy despite Content-Type restrictions causes client-side denial of service - Severity: Medium 4.3 - Published: May 15, 2026 - Affected: from 11.5.0, fixed in 11.5.2; from 0.0.0-20250731163400-5b955468ea1e, fixed in 0.0.0-20260414103857-b21ef302025e; from 11.4.0, fixed in 11.4.4; from 0.0.0-20250731163400-5b955468ea1e, fixed in 0.0.0-20260414103857-b21ef302025e; from 11.4.0+incompatible, fixed in 11.4.4+incompatible; from 11.5.0+incompatible, fixed in 11.5.2+incompatible. ### [CVE-2026-3590](https://cve.now/CVE-2026-3590): Race Condition in Guest Magic Link Authentication Allows Token Reuse - Severity: Medium 6.5 - Published: Apr 15, 2026 - Affected: from 10.11.0-rc1, fixed in 10.11.13; from 11.5.0-rc1, fixed in 11.5.0; from 11.4.0-rc1, fixed in 11.4.3; from 11.3.0-rc1, fixed in 11.3.3; from 10.11.0-rc1+incompatible, fixed in 10.11.13+incompatible; from 11.3.0-rc1+incompatible, fixed in 11.3.3+incompatible; from 11.4.0-rc1+incompatible, fixed in 11.4.3+incompatible; from 11.5.0-rc1+incompatible, fixed in 11.5.0+incompatible. ### [CVE-2026-28741](https://cve.now/CVE-2026-28741): CSRF Protection Bypass Allows Updating a User's Authentication Method - Severity: Medium 6.8 - Published: Apr 15, 2026 - Affected: from 11.3.0-rc1+incompatible, fixed in 11.3.3+incompatible; from 11.4.0-rc1+incompatible, fixed in 11.4.3+incompatible; from 11.5.0-rc1+incompatible, fixed in 11.5.0+incompatible. ### [CVE-2026-27769](https://cve.now/CVE-2026-27769): Connected Workspaces: Malicious remote server can manipulate arbitrary user's status - Severity: Low 2.7 - Published: Apr 15, 2026 - Affected: from 8.0.0-20250721062209-4952acea88ce, fixed in 8.0.0-20260316060126-bc1a2b34b1f9; all versions. ### [CVE-2026-3112](https://cve.now/CVE-2026-3112): Arbitrary File Read via Advanced Logging Support Packet - Severity: Medium 6.8 - Published: Mar 26, 2026 - Affected: from 10.11.0-rc1+incompatible, fixed in 10.11.12+incompatible; from 11.2.0-rc1+incompatible, fixed in 11.2.4+incompatible; from 11.3.0-rc1+incompatible, fixed in 11.3.2+incompatible; from 11.4.0-rc1+incompatible, fixed in 11.4.1+incompatible. ### [CVE-2026-3115](https://cve.now/CVE-2026-3115): Guest users can view group member IDs without respecting view restrictions - Severity: Medium 4.3 - Published: Mar 26, 2026 - Affected: from 10.11.0-rc1+incompatible, fixed in 10.11.11+incompatible; from 11.2.0-rc1+incompatible, fixed in 11.2.3+incompatible; from 11.3.0-rc1+incompatible, fixed in 11.3.2+incompatible; from 11.4.0+incompatible, fixed in 11.4.1+incompatible. ### [CVE-2026-3114](https://cve.now/CVE-2026-3114): Zip Bomb Denial of Service via Unrestricted Archive Decompression - Severity: Medium 6.5 - Published: Mar 26, 2026 - Affected: from 10.11.0+incompatible, fixed in 10.11.12+incompatible; from 11.2.0+incompatible, fixed in 11.2.4+incompatible; from 11.3.0+incompatible, fixed in 11.3.2+incompatible; from 11.4.0+incompatible, fixed in 11.4.1+incompatible. ### [CVE-2026-3113](https://cve.now/CVE-2026-3113): mmctl export download command doesn’t restrict permissions to created file to file owner - Severity: Medium 5.0 - Published: Mar 26, 2026 - Affected: from 11.4.0-rc1, fixed in 11.4.1; from 11.3.0-rc1, fixed in 11.3.2; from 11.2.0-rc1, fixed in 11.2.4; from 10.11.0-rc1, fixed in 10.11.12; from 8.0.0-20260105080200-d27a2195068d, fixed in 8.0.0-20260217110922-b7d4a1f1f59b; from 10.11.0-rc1+incompatible, fixed in 10.11.12+incompatible; from 11.2.0-rc1+incompatible, fixed in 11.2.4+incompatible; from 11.3.0-rc1+incompatible, fixed in 11.3.2+incompatible; from 11.4.0-rc1+incompatible, fixed in 11.4.1+incompatible. ### [CVE-2026-3108](https://cve.now/CVE-2026-3108): Terminal Escape Injection in mmctl Report Posts Command - Severity: High 8.0 - Published: Mar 26, 2026 - Affected: from 10.11.0-rc1+incompatible, fixed in 10.11.11+incompatible; from 11.2.0-rc1+incompatible, fixed in 11.2.3+incompatible; from 11.3.0-rc1+incompatible, fixed in 11.3.2+incompatible; from 11.4.0-rc1+incompatible, fixed in 11.4.1+incompatible. ### [CVE-2026-4274](https://cve.now/CVE-2026-4274): Insufficient authorization in shared channel membership sync grants team-level access instead of channel-level access - Severity: Medium 5.4 - Published: Mar 26, 2026 - Affected: from 10.11.0-rc1+incompatible, fixed in 10.11.11+incompatible; from 11.2.0-rc1+incompatible, fixed in 11.2.3+incompatible; from 11.3.0-rc1+incompatible, fixed in 11.3.2+incompatible; from 11.4.0-rc1+incompatible, fixed in 11.4.1+incompatible. ### [CVE-2026-27659](https://cve.now/CVE-2026-27659): CSRF vulnerability in UpdateAccessControlPolicyActiveStatus endpoint - Severity: Medium 4.6 - Published: Mar 25, 2026 - Affected: from 10.11.0-rc1+incompatible, fixed in 10.11.11+incompatible; from 11.2.0-rc1+incompatible, fixed in 11.2.3+incompatible; from 11.3.0-rc1+incompatible, fixed in 11.3.2+incompatible; from 11.4.0-rc1+incompatible, fixed in 11.4.1+incompatible. ### [CVE-2026-20719](https://cve.now/CVE-2026-20719): DoS via URL Previews Rendering Malicious SVGs - Severity: Medium 4.3 - Published: Mar 25, 2026 - Affected: from 10.11.0-rc1+incompatible, fixed in 10.11.2+incompatible; from 11.2.0-rc1+incompatible, fixed in 11.2.4+incompatible; from 11.3.0-rc1+incompatible, fixed in 11.3.2+incompatible; from 11.4.0-rc1+incompatible, fixed in 11.4.1+incompatible. ### [CVE-2026-27656](https://cve.now/CVE-2026-27656): Account Takeover via Substring Matching in OpenID Connect Authentication - Severity: Medium 5.7 - Published: Mar 25, 2026 - Affected: from 10.11.0-rc1+incompatible, fixed in 10.11.12+incompatible; from 11.2.0-rc1+incompatible, fixed in 11.2.4+incompatible; from 11.3.0-rc1+incompatible, fixed in 11.3.2+incompatible; from 11.4.0-rc1+incompatible, fixed in 11.4.1+incompatible; from 11.4.0-rc1, fixed in 11.4.1; from 11.3.0-rc1, fixed in 11.3.2; from 11.2.0-rc1, fixed in 11.2.4; from 10.11.0-rc1, fixed in 10.11.12. ### [CVE-2026-26233](https://cve.now/CVE-2026-26233): Denial of Service via HTTP/2 single packet attack on login endpoint - Severity: Medium 4.3 - Published: Mar 25, 2026 - Affected: from 10.11.0-rc1+incompatible, fixed in 10.11.12+incompatible; from 11.2.0-rc1+incompatible, fixed in 11.2.4+incompatible; from 11.3.0-rc1+incompatible, fixed in 11.3.2+incompatible; from 11.4.0-rc1+incompatible, fixed in 11.4.1+incompatible; from 11.4.0-rc1, fixed in 11.4.1; from 11.3.0-rc1, fixed in 11.3.2; from 11.2.0-rc1, fixed in 11.2.4; from 10.11.0-rc1, fixed in 10.11.12. ### [CVE-2026-24692](https://cve.now/CVE-2026-24692): Guest users can bypass read permissions via search API - Severity: Medium 4.3 - Published: Mar 16, 2026 - Affected: from 10.11.0-rc1+incompatible, fixed in 10.11.11+incompatible; from 11.2.0-rc1+incompatible, fixed in 11.2.3+incompatible; from 11.3.0-rc1+incompatible, fixed in 11.3.1+incompatible; fixed in 5.3.2-0.20260107142155-0481bd1fb045; from 10.11.0-rc1, fixed in 10.11.11; from 11.2.0-rc1, fixed in 11.2.3; from 11.3.0-rc1, fixed in 11.3.1. ### [CVE-2026-22545](https://cve.now/CVE-2026-22545): Password Change Bypass via Auth Switch Endpoint - Severity: Low 3.1 - Published: Mar 16, 2026 - Affected: from 10.11.0-rc1+incompatible, fixed in 10.11.11+incompatible; from 11.2.0-rc1+incompatible, fixed in 11.2.3+incompatible; from 11.3.0-rc1+incompatible, fixed in 11.3.1+incompatible; fixed in 5.3.2-0.20260127144908-ced9a56e3988; from 10.11.0-rc1, fixed in 10.11.11; from 11.2.0-rc1, fixed in 11.2.3; from 11.3.0-rc1, fixed in 11.3.1. ### [CVE-2026-2455](https://cve.now/CVE-2026-2455): SSRF bypass via IPv4-mapped IPv6 literals - Severity: Medium 4.3 - Published: Mar 16, 2026 - Affected: fixed in 5.3.2-0.20260129133647-5d787969c2d5; from 10.11.0-rc1, fixed in 10.11.11; from 11.2.0-rc1, fixed in 11.2.3; from 11.3.0-rc1, fixed in 11.3.1; from 10.11.0-rc1+incompatible, fixed in 10.11.11+incompatible; from 11.2.0-rc1+incompatible, fixed in 11.2.3+incompatible; from 11.3.0-rc1+incompatible, fixed in 11.3.1+incompatible. ### [CVE-2026-21386](https://cve.now/CVE-2026-21386): Private channel enumeration via /mute slash command - Severity: Medium 4.3 - Published: Mar 16, 2026 - Affected: from 10.11.0-rc1+incompatible, fixed in 10.11.11+incompatible; from 11.2.0-rc1+incompatible, fixed in 11.2.3+incompatible; from 11.3.0-rc1+incompatible, fixed in 11.3.1+incompatible; fixed in 5.3.2-0.20260130144323-5bb5261c72fa; from 10.11.0-rc1, fixed in 10.11.11; from 11.2.0-rc1, fixed in 11.2.3; from 11.3.0-rc1, fixed in 11.3.1. ### [CVE-2026-25780](https://cve.now/CVE-2026-25780): Memory Exhaustion via Malformed DOC File Upload - Severity: Medium 4.3 - Published: Mar 16, 2026 - Affected: from 10.11.0-rc1+incompatible, fixed in 10.11.11+incompatible; from 11.2.0-rc1+incompatible, fixed in 11.2.3+incompatible; from 11.3.0-rc1+incompatible, fixed in 11.3.1+incompatible; fixed in 5.3.2-0.20260123215601-86797c508c44; from 10.11.0-rc1, fixed in 10.11.11; from 11.2.0-rc1, fixed in 11.2.3; from 11.3.0-rc1, fixed in 11.3.1. ### [CVE-2026-4265](https://cve.now/CVE-2026-4265): Guest user can upload files without permission across teams - Severity: Medium 4.3 - Published: Mar 16, 2026 - Affected: fixed in 5.3.2-0.20260107144005-c7f6efdfb035; from 10.11.0-rc1, fixed in 10.11.11; from 11.2.0-rc1, fixed in 11.2.3; from 11.3.0-rc1, fixed in 11.3.1; from 10.11.0-rc1+incompatible, fixed in 10.11.11+incompatible; from 11.2.0-rc1+incompatible, fixed in 11.2.3+incompatible; from 11.3.0-rc1+incompatible, fixed in 11.3.1+incompatible. ### [CVE-2026-25783](https://cve.now/CVE-2026-25783): Denial of service via malformed User-Agent header in getBrowserVersion - Severity: Medium 4.3 - Published: Mar 16, 2026 - Affected: fixed in 5.3.2-0.20260129181235-1346cf529aef; from 10.11.0-rc1, fixed in 10.11.11; from 11.2.0-rc1, fixed in 11.2.3; from 11.3.0-rc1, fixed in 11.3.1; from 10.11.0-rc1+incompatible, fixed in 10.11.11+incompatible; from 11.2.0-rc1+incompatible, fixed in 11.2.3+incompatible; from 11.3.0-rc1+incompatible, fixed in 11.3.1+incompatible. ### [CVE-2026-24458](https://cve.now/CVE-2026-24458): DoS attack via login attempts with multi-megabyte passwords - Severity: High 7.5 - Published: Mar 16, 2026 - Affected: fixed in 5.3.2-0.20260129164748-7201f42d955f; from 10.11.0-rc1, fixed in 10.11.11; from 11.2.0-rc1, fixed in 11.2.3; from 11.3.0-rc1, fixed in 11.3.1; from 10.11.0-rc1+incompatible, fixed in 10.11.11+incompatible; from 11.2.0-rc1+incompatible, fixed in 11.2.3+incompatible; from 11.3.0-rc1+incompatible, fixed in 11.3.1+incompatible. ### [CVE-2026-2578](https://cve.now/CVE-2026-2578): Information Disclosure via WebSocket Event When Deleting Unrevealed Burn on Read Posts - Severity: Medium 4.3 - Published: Mar 16, 2026 - Affected: fixed in 5.3.2-0.20260127062706-c6b205f0d770; from 10.11.0-rc1, fixed in 10.11.11; from 11.2.0-rc1, fixed in 11.2.3; from 11.3.0-rc1, fixed in 11.3.1; from 10.11.0-rc1+incompatible, fixed in 10.11.11+incompatible; from 11.2.0-rc1+incompatible, fixed in 11.2.3+incompatible; from 11.3.0-rc1+incompatible, fixed in 11.3.1+incompatible. ### [CVE-2026-26246](https://cve.now/CVE-2026-26246): Memory Exhaustion via Malformed PSD File Upload - Severity: Medium 4.3 - Published: Mar 16, 2026 - Affected: fixed in 5.3.2-0.20260115183946-38b413a27604; from 10.11.0-rc1, fixed in 10.11.11; from 11.2.0-rc1, fixed in 11.2.3; from 11.3.0-rc1, fixed in 11.3.1; from 10.11.0-rc1+incompatible, fixed in 10.11.11+incompatible; from 11.2.0-rc1+incompatible, fixed in 11.2.3+incompatible; from 11.3.0-rc1+incompatible, fixed in 11.3.1+incompatible. ### [CVE-2026-2458](https://cve.now/CVE-2026-2458): Unauthorized channel enumeration in private teams after member removal - Severity: Medium 4.3 - Published: Mar 16, 2026 - Affected: from 10.11.0-rc1+incompatible, fixed in 10.11.11+incompatible; from 11.2.0-rc1+incompatible, fixed in 11.2.3+incompatible; from 11.3.0-rc1+incompatible, fixed in 11.3.1+incompatible; fixed in 5.3.2-0.20260113182106-a18b80ba4c32; from 10.11.0-rc1, fixed in 10.11.11; from 11.2.0-rc1, fixed in 11.2.3; from 11.3.0-rc1, fixed in 11.3.1. ### [CVE-2026-2457](https://cve.now/CVE-2026-2457): WebSocket Message Spoofing via Permalink Embed Manipulation - Severity: Medium 4.3 - Published: Mar 16, 2026 - Affected: from 10.11.0-rc1+incompatible, fixed in 10.11.11+incompatible; from 11.2.0-rc1+incompatible, fixed in 11.2.3+incompatible; from 11.3.0-rc1+incompatible, fixed in 11.3.1+incompatible; fixed in 5.3.2-0.20260123211116-9efe617be8b8; from 10.11.0-rc1, fixed in 10.11.11; from 11.2.0-rc1, fixed in 11.2.3; from 11.3.0-rc1, fixed in 11.3.1. ### [CVE-2026-2463](https://cve.now/CVE-2026-2463): Unauthorized access to invite ID during team creation - Severity: Medium 4.3 - Published: Mar 16, 2026 - Affected: fixed in 5.3.2-0.20260105134819-cc427af41b2a; from 10.11.0-rc1, fixed in 10.11.11; from 11.2.0-rc1, fixed in 11.2.3; from 11.3.0-rc1, fixed in 11.3.1; from 10.11.0-rc1+incompatible, fixed in 10.11.11+incompatible; from 11.2.0-rc1+incompatible, fixed in 11.2.3+incompatible; from 11.3.0-rc1+incompatible, fixed in 11.3.1+incompatible. ### [CVE-2026-2456](https://cve.now/CVE-2026-2456): Denial of Service via Unbounded Memory Allocation in Integration Actions - Severity: Medium 5.3 - Published: Mar 16, 2026 - Affected: fixed in 5.3.2-0.20260127165411-fe3052073dc6; from 10.11.0-rc1, fixed in 10.11.11; from 11.2.0-rc1, fixed in 11.2.3; from 11.3.0-rc1, fixed in 11.3.1; from 10.11.0-rc1+incompatible, fixed in 10.11.11+incompatible; from 11.2.0-rc1+incompatible, fixed in 11.2.3+incompatible; from 11.3.0-rc1+incompatible, fixed in 11.3.1+incompatible. ### [CVE-2025-14573](https://cve.now/CVE-2025-14573): Team Admin Bypass of Invite Permissions via allow\_open\_invite Field - Severity: Low 3.8 - Published: Feb 16, 2026 - Affected: all versions; from 10.11.0+incompatible; from 11.1.0+incompatible; from 11.2.0+incompatible; from 11.1.0; from 10.11.0; from 11.2.0; fixed in 5.3.2-0.20251215190648-6404ab29acc0. ### [CVE-2025-14350](https://cve.now/CVE-2025-14350): Information disclosure via channel mentions in posts - Severity: Medium 4.3 - Published: Feb 16, 2026 - Affected: from 11.1.0; from 10.11.0; from 11.2.0; fixed in 5.3.2-0.20251209134645-761e56bb11cc; all versions; from 10.11.0+incompatible; from 11.1.0+incompatible; from 11.2.0+incompatible. ### [CVE-2025-13821](https://cve.now/CVE-2025-13821): User profile update exposes password hash and MFA secrets - Severity: Medium 5.7 - Published: Feb 16, 2026 - Affected: from 11.1.0; from 10.11.0; from 11.2.0; fixed in 5.3.2-0.20251210191531-cd17b61de41b; all versions; from 10.11.0+incompatible; from 11.1.0+incompatible; from 11.2.0+incompatible. ### [CVE-2026-0999](https://cve.now/CVE-2026-0999): Authentication bypass via userID login when email and username login are disabled - Severity: Medium 5.4 - Published: Feb 16, 2026 - Affected: from 11.1.0; from 10.11.0; from 11.2.0; fixed in 5.3.2-0.20251212052346-61651b0df7ea; all versions; from 10.11.0+incompatible; from 11.1.0+incompatible; from 11.2.0+incompatible. ### [CVE-2026-20796](https://cve.now/CVE-2026-20796): Time-of-check time-of-use vulnerability in common teams API - Severity: Low 3.1 - Published: Feb 13, 2026 - Affected: from 10.11.0, fixed in 10.11.10; from 10.11.0+incompatible, fixed in 10.11.10+incompatible. ### [CVE-2026-22892](https://cve.now/CVE-2026-22892): Insufficient Authorization in Mattermost Jira Plugin Allows Unauthorized Access to Post Attachments - Severity: Medium 4.3 - Published: Feb 13, 2026 - Affected: from 11.2.0, fixed in 11.2.2; from 11.1.0, fixed in 11.1.3; from 10.11.0, fixed in 10.11.10; from 10.11.0+incompatible, fixed in 10.11.10+incompatible; from 11.1.0+incompatible, fixed in 11.1.3+incompatible; from 11.2.0+incompatible, fixed in 11.2.2+incompatible. ### [CVE-2025-14435](https://cve.now/CVE-2025-14435): Application-Level DoS via infinite re-render loop in user profile handling - Severity: Medium 6.8 - Published: Jan 16, 2026 - Affected: from 10.11.0, fixed in 10.11.9; from 11.1.0, fixed in 11.1.2; from 11.0.0, fixed in 11.0.7; from 10.11.0+incompatible, fixed in 10.11.9+incompatible; from 11.0.1+incompatible, fixed in 11.0.7+incompatible; from 11.1.0+incompatible, fixed in 11.1.2+incompatible. ### [CVE-2025-14822](https://cve.now/CVE-2025-14822): DoS from quadratic complexity in model.ParseHashtags - Severity: Low 3.1 - Published: Jan 16, 2026 - Affected: from 10.11.0, fixed in 10.11.9; from 11.0.0, fixed in 11.2.0; from 10.11.0+incompatible, fixed in 10.11.9+incompatible; from 11.0.1+incompatible, fixed in 11.2.0+incompatible. ### [CVE-2025-64641](https://cve.now/CVE-2025-64641): Mattermost Jira plugin crafted action leaks Jira issue details - Severity: Medium 4.1 - Published: Dec 24, 2025 - Affected: from 10.11.0, fixed in 10.11.8; from 10.12.0, fixed in 10.12.4; from 11.0.0, fixed in 11.0.6; from 11.1.0, fixed in 11.1.1; from 10.11.0+incompatible, fixed in 10.11.8+incompatible; from 10.12.0+incompatible, fixed in 10.12.4+incompatible; from 11.0.1+incompatible, fixed in 11.0.6+incompatible; from 11.1.0+incompatible, fixed in 11.1.1+incompatible. ### [CVE-2025-13767](https://cve.now/CVE-2025-13767): Unauthorized Read Access to Private Channel Posts via Mattermost Jira Plugin - Severity: Medium 4.3 - Published: Dec 24, 2025 - Affected: from 10.11.0, fixed in 10.11.8; from 10.12.0, fixed in 10.12.4; from 11.0.0, fixed in 11.0.6; from 11.1.0, fixed in 11.1.1; from 10.11.0+incompatible, fixed in 10.11.8+incompatible; from 10.12.0+incompatible, fixed in 10.12.4+incompatible; from 11.0.1+incompatible, fixed in 11.0.6+incompatible; from 11.1.0+incompatible, fixed in 11.1.1+incompatible. ### [CVE-2025-14273](https://cve.now/CVE-2025-14273): Mattermost Jira plugin user spoofing enables Jira request forgery. - Severity: High 7.2 - Published: Dec 22, 2025 - Affected: all versions. ### [CVE-2025-13324](https://cve.now/CVE-2025-13324): Lack of Invalidation of Legacy Remote Cluster Invite Tokens After Confirmation - Severity: Low 3.7 - Published: Dec 17, 2025 - Affected: fixed in 11.0.4; fixed in 11.0.4+incompatible. ### [CVE-2025-62690](https://cve.now/CVE-2025-62690): Open redirect in error page when link opened in new tab - Severity: Low 3.1 - Published: Dec 17, 2025 - Affected: all versions. ### [CVE-2025-13352](https://cve.now/CVE-2025-13352): Mattermost GitHub Plugin allows unauthorized GitHub reactions via reaction forwarding hijacking - Severity: Low 3.0 - Published: Dec 17, 2025 - Affected: from 10.11.0-rc1+incompatible. ### [CVE-2025-13870](https://cve.now/CVE-2025-13870): Unauthorized access and subscription vulnerability in Boards - Severity: Low 3.1 - Published: Dec 2, 2025 - Affected: all versions. ### [CVE-2025-12756](https://cve.now/CVE-2025-12756): Insecure Direct Object Reference in Mattermost Boards Plugin Enables Unauthorised Comment Deletion - Severity: Medium 4.3 - Published: Dec 1, 2025 - Affected: all versions. ### [CVE-2025-12421](https://cve.now/CVE-2025-12421): Account Takeover via Code Exchange Endpoint - Severity: Critical 9.9 - Published: Nov 27, 2025 - Affected: from 11.0.0, fixed in 11.0.3; from 10.12.0, fixed in 10.12.2; from 10.11.0, fixed in 10.11.5; from 10.5.0, fixed in 10.5.13; all versions. ### [CVE-2025-12559](https://cve.now/CVE-2025-12559): Information Disclosure in Common Teams API - Severity: Medium 4.3 - Published: Nov 27, 2025 - Affected: from 11.0.0, fixed in 11.0.3; from 10.12.0, fixed in 10.12.2; from 10.11.0, fixed in 10.11.5; from 10.5.0, fixed in 10.5.13; all versions. ### [CVE-2025-12419](https://cve.now/CVE-2025-12419): Account takeover on OAuth/OpenID-enabled servers - Severity: Critical 9.9 - Published: Nov 27, 2025 - Affected: all versions; from 10.12.0, fixed in 10.12.2; from 10.11.0, fixed in 10.11.5; from 10.5.0, fixed in 10.5.13; from 11.0.0, fixed in 11.0.4. ### [CVE-2025-55074](https://cve.now/CVE-2025-55074): Channel member objects leak read status - Severity: Low 3.0 - Published: Nov 18, 2025 - Affected: from 10.5.0+incompatible, fixed in 10.5.12+incompatible; from 10.11.0+incompatible, fixed in 10.11.4+incompatible; from 10.11.0, fixed in 10.11.4; from 10.5.0, fixed in 10.5.12. ### [CVE-2025-11794](https://cve.now/CVE-2025-11794): Password hash and MFA secret returned in user email verification endpoint - Severity: Medium 4.9 - Published: Nov 14, 2025 - Affected: from 10.5.0+incompatible, fixed in 10.5.12+incompatible; from 10.11.0+incompatible, fixed in 10.11.4+incompatible; from 10.12.0+incompatible, fixed in 10.12.1+incompatible; from 10.11.0, fixed in 10.11.4; from 10.5.0, fixed in 10.5.12; from 10.12.0, fixed in 10.12.1. ### [CVE-2025-55073](https://cve.now/CVE-2025-55073): MS Teams plugin OAuth allows editing arbitrary posts - Severity: Medium 5.4 - Published: Nov 14, 2025 - Affected: from 10.5.0+incompatible, fixed in 10.5.12+incompatible; from 10.11.0+incompatible, fixed in 10.11.4+incompatible; from 10.12.0+incompatible, fixed in 10.12.1+incompatible; from 10.11.0, fixed in 10.11.4; from 10.5.0, fixed in 10.5.12; from 10.12.0, fixed in 10.12.1. ### [CVE-2025-55070](https://cve.now/CVE-2025-55070): Lack of MFA enforcement in WebSocket connections - Severity: Medium 6.5 - Published: Nov 14, 2025 - Affected: fixed in 11.1.0+incompatible; fixed in 11.1.0. ### [CVE-2025-41436](https://cve.now/CVE-2025-41436): Unauthorized access to archived channel content via threads interface - Severity: Low 3.1 - Published: Nov 14, 2025 - Affected: fixed in 11.0.0-alpha.1; fixed in 11.0.0-alpha.1+incompatible. ### [CVE-2025-11776](https://cve.now/CVE-2025-11776): Guest user can discover archived public channels - Severity: Medium 4.3 - Published: Nov 14, 2025 - Affected: all versions; fixed in 5.3.2-0.20250815165020-c8d66301415d. ### [CVE-2025-11777](https://cve.now/CVE-2025-11777): Cross-team channel membership access - Severity: Low 3.1 - Published: Nov 13, 2025 - Affected: from 10.5.0+incompatible, fixed in 10.5.12+incompatible; from 10.11.0+incompatible, fixed in 10.11.4+incompatible; from 10.11.0, fixed in 10.11.4; from 10.5.0, fixed in 10.5.12; fixed in 5.3.2-0.20250905150616-ba86dfc5876b. ### [CVE-2025-58073](https://cve.now/CVE-2025-58073): Arbitrary Mattermost Team can be joined by manipulating the OAuth state - Severity: High 8.1 - Published: Oct 16, 2025 - Affected: from 10.5.0+incompatible, fixed in 10.5.11+incompatible; from 10.10.0+incompatible, fixed in 10.10.3+incompatible; from 10.11.0+incompatible, fixed in 10.11.2+incompatible; from 10.11.0, fixed in 10.11.2; from 10.10.0, fixed in 10.10.3; from 10.5.0, fixed in 10.5.11. ### [CVE-2025-41410](https://cve.now/CVE-2025-41410): Slack import bypasses email verification for team access controls - Severity: Medium 5.4 - Published: Oct 16, 2025 - Affected: from 10.5.0+incompatible, fixed in 10.5.11+incompatible; from 10.10.0+incompatible, fixed in 10.10.3+incompatible; from 10.11.0+incompatible, fixed in 10.11.3+incompatible; from 10.10.0, fixed in 10.10.3; from 10.5.0, fixed in 10.5.11; from 10.11.0, fixed in 10.11.3. ### [CVE-2025-10545](https://cve.now/CVE-2025-10545): Guest user can add unauthorized team users to private channels - Severity: Low 3.1 - Published: Oct 16, 2025 - Affected: from 10.5.0, fixed in 10.5.11; from 10.11.0, fixed in 10.11.3; from 10.5.0+incompatible, fixed in 10.5.11+incompatible; from 10.11.0+incompatible, fixed in 10.11.3+incompatible. ### [CVE-2025-58075](https://cve.now/CVE-2025-58075): Arbitrary Mattermost Team can be joined by manipulating the SAML RelayState - Severity: High 8.1 - Published: Oct 16, 2025 - Affected: from 10.5.0+incompatible, fixed in 10.5.11+incompatible; from 10.10.0+incompatible, fixed in 10.10.3+incompatible; from 10.11.0+incompatible, fixed in 10.11.2+incompatible; from 10.11.0, fixed in 10.11.2; from 10.10.0, fixed in 10.10.3; from 10.5.0, fixed in 10.5.11. ### [CVE-2025-54499](https://cve.now/CVE-2025-54499): Insecure string comparison enables timing attacks - Severity: Low 3.1 - Published: Oct 16, 2025 - Affected: from 10.5.0+incompatible, fixed in 10.5.11+incompatible; from 10.11.0+incompatible, fixed in 10.11.3+incompatible; from 10.5.0, fixed in 10.5.11; from 10.11.0, fixed in 10.11.3. ### [CVE-2025-41443](https://cve.now/CVE-2025-41443): Guest user can discover active public channels - Severity: Medium 4.3 - Published: Oct 16, 2025 - Affected: all versions; from 10.5.0, fixed in 10.5.11; from 10.11.0, fixed in 10.11.3. ### [CVE-2025-9081](https://cve.now/CVE-2025-9081): IDOR in board file download allows any user to download any file by UUID - Severity: Low 3.1 - Published: Sep 19, 2025 - Affected: from 10.5.0-rc1, fixed in 10.5.9; from 9.11.0-rc1, fixed in 9.11.18; from 9.11.0-rc1+incompatible, fixed in 9.11.18+incompatible; from 10.5.0-rc1+incompatible, fixed in 10.5.9+incompatible. ### [CVE-2025-9079](https://cve.now/CVE-2025-9079): Admin RCE via prepackaged plugins by way of misconfigured imports directory - Severity: High 8.0 - Published: Sep 19, 2025 - Affected: from 9.11.0+incompatible, fixed in 9.11.18+incompatible; from 10.5.0+incompatible, fixed in 10.5.9+incompatible; from 10.8.0+incompatible, fixed in 10.8.4+incompatible; from 10.9.0+incompatible, fixed in 10.9.4+incompatible; from 10.10.0+incompatible, fixed in 10.10.2+incompatible; from 10.8.0, fixed in 10.8.4; from 10.5.0, fixed in 10.5.9; from 9.11.0, fixed in 9.11.18; from 10.10.0, fixed in 10.10.2; from 10.9.0, fixed in 10.9.4. ### [CVE-2025-9072](https://cve.now/CVE-2025-9072): One-Click Mattermost Account Takeover via Poisoned RelayState SAML Parameter - Severity: High 7.6 - Published: Sep 15, 2025 - Affected: from 10.5.0+incompatible, fixed in 10.5.10+incompatible; from 10.9.0+incompatible, fixed in 10.9.5+incompatible; from 10.10.0+incompatible, fixed in 10.10.2+incompatible; from 10.10.0, fixed in 10.10.2; from 10.5.0, fixed in 10.5.10; from 10.9.0, fixed in 10.9.5. ### [CVE-2025-9084](https://cve.now/CVE-2025-9084): Open redirect in OAuth login - Severity: Low 3.1 - Published: Sep 15, 2025 - Affected: from 10.5.0, fixed in 10.5.10; from 10.5.0+incompatible, fixed in 10.5.10+incompatible. ### [CVE-2025-9078](https://cve.now/CVE-2025-9078): Weak cache keys lead to post IDOR and link preview poisoning - Severity: Medium 4.3 - Published: Sep 15, 2025 - Affected: from 10.8.0, fixed in 10.8.4; from 10.5.0, fixed in 10.5.9; from 9.11.0, fixed in 9.11.18; from 10.10.0, fixed in 10.10.2; from 10.9.0, fixed in 10.9.4; from 9.11.0+incompatible, fixed in 9.11.18+incompatible; from 10.5.0+incompatible, fixed in 10.5.9+incompatible; from 10.8.0+incompatible, fixed in 10.8.4+incompatible; from 10.9.0+incompatible, fixed in 10.9.4+incompatible; from 10.10.0+incompatible, fixed in 10.10.2+incompatible. ### [CVE-2025-9076](https://cve.now/CVE-2025-9076): Mattermost Server exposes sensitive user credentials during shared channel membership synchronization - Severity: Medium 6.5 - Published: Sep 15, 2025 - Affected: from 10.10.0+incompatible, fixed in 10.10.2+incompatible; from 10.10.0, fixed in 10.10.2. ### [CVE-2025-8402](https://cve.now/CVE-2025-8402): Nil pointer dereference in bulk import crashes server - Severity: Medium 4.9 - Published: Aug 21, 2025 - Affected: from 9.11.0+incompatible, fixed in 9.11.18+incompatible; from 10.5.0+incompatible, fixed in 10.5.9+incompatible; from 10.8.0+incompatible, fixed in 10.8.4+incompatible; from 10.9.0+incompatible, fixed in 10.9.4+incompatible; from 10.10.0+incompatible, fixed in 10.10.1+incompatible; from 10.8.0, fixed in 10.8.4; from 10.5.0, fixed in 10.5.9; from 10.9.0, fixed in 10.9.4; from 10.10.0, fixed in 10.10.1; from 9.11.0, fixed in 9.11.18. ### [CVE-2025-6465](https://cve.now/CVE-2025-6465): Path traversal in image upload with preview overwrite - Severity: Medium 4.3 - Published: Aug 21, 2025 - Affected: from 10.5.0+incompatible, fixed in 10.5.9+incompatible; from 10.8.0+incompatible, fixed in 10.8.4+incompatible; from 10.9.0+incompatible, fixed in 10.9.4+incompatible; from 10.10.0+incompatible, fixed in 10.10.1+incompatible; from 10.8.0, fixed in 10.8.4; from 10.5.0, fixed in 10.5.9; from 10.9.0, fixed in 10.9.4; from 10.10.0, fixed in 10.10.1. ### [CVE-2025-47870](https://cve.now/CVE-2025-47870): Team invite ID leaked to team admin with no member invite privileges - Severity: Medium 4.3 - Published: Aug 21, 2025 - Affected: from 9.11.0+incompatible, fixed in 9.11.18+incompatible; from 10.5.0+incompatible, fixed in 10.5.9+incompatible; from 10.8.0+incompatible, fixed in 10.8.4+incompatible; from 10.9.0+incompatible, fixed in 10.9.3+incompatible; from 10.8.0, fixed in 10.8.4; from 10.5.0, fixed in 10.5.9; from 9.11.0, fixed in 9.11.18; from 10.9.0, fixed in 10.9.3. ### [CVE-2025-49222](https://cve.now/CVE-2025-49222): Mattermost Shared Channel Upload Type Validation Bypass - Severity: Medium 6.8 - Published: Aug 21, 2025 - Affected: from 9.11.0+incompatible, fixed in 9.11.18+incompatible; from 10.5.0+incompatible, fixed in 10.5.9+incompatible; from 10.8.0+incompatible, fixed in 10.8.4+incompatible; from 10.9.0+incompatible, fixed in 10.9.3+incompatible; from 10.10.0+incompatible, fixed in 10.10.1+incompatible; from 10.8.0, fixed in 10.8.4; from 10.5.0, fixed in 10.5.9; from 9.11.0, fixed in 9.11.18; from 10.9.0, fixed in 10.9.3; from 10.10.0, fixed in 10.10.1. ### [CVE-2025-8023](https://cve.now/CVE-2025-8023): Path Traversal in Template Upload Allows Uploading Files Outside Target Directory - Severity: Medium 6.8 - Published: Aug 21, 2025 - Affected: from 9.11.0+incompatible, fixed in 9.11.18+incompatible; from 10.5.0+incompatible, fixed in 10.5.9+incompatible; from 10.8.0+incompatible, fixed in 10.8.4+incompatible; from 10.9.0+incompatible, fixed in 10.9.3+incompatible; from 10.8.0, fixed in 10.8.4; from 10.5.0, fixed in 10.5.9; from 9.11.0, fixed in 9.11.18; from 10.9.0, fixed in 10.9.3. ### [CVE-2025-53971](https://cve.now/CVE-2025-53971): Channel and Team Membership APIs inadvertently allow loss of Member privileges. - Severity: Low 3.8 - Published: Aug 21, 2025 - Affected: from 10.5.0, fixed in 10.5.9; from 9.11.0, fixed in 9.11.18; from 9.11.0+incompatible, fixed in 9.11.18+incompatible; from 10.5.0+incompatible, fixed in 10.5.9+incompatible. ### [CVE-2025-47700](https://cve.now/CVE-2025-47700): AI plugin APIs can be triggered using post actions - Severity: Low 3.5 - Published: Aug 21, 2025 - Affected: from 10.5.0+incompatible, fixed in 10.5.10+incompatible; from 10.5.0, fixed in 10.5.10. ### [CVE-2025-49810](https://cve.now/CVE-2025-49810): Thread summarization allows persistent access to channel - Severity: Low 3.5 - Published: Aug 21, 2025 - Affected: from 10.5.0, fixed in 10.5.9; from 10.5.0+incompatible, fixed in 10.5.9+incompatible. ### [CVE-2025-36530](https://cve.now/CVE-2025-36530): Import Path Traversal Enables Unauthorized Unsigned Plugin Installation - Severity: Medium 6.8 - Published: Aug 21, 2025 - Affected: from 10.9.0, fixed in 10.9.2; from 10.8.0, fixed in 10.8.4; from 10.5.0, fixed in 10.5.9; from 9.11.0, fixed in 9.11.18; from 9.11.0+incompatible, fixed in 9.11.18+incompatible; from 10.5.0+incompatible, fixed in 10.5.9+incompatible; from 10.8.0+incompatible, fixed in 10.8.4+incompatible; from 10.9.0+incompatible, fixed in 10.9.2+incompatible. ### [CVE-2025-6227](https://cve.now/CVE-2025-6227): Invite token is used as part of the secure communication - Severity: Low 2.2 - Published: Jul 18, 2025 - Affected: from 9.11.0+incompatible, fixed in 9.11.17+incompatible; from 10.5.0+incompatible, fixed in 10.5.8+incompatible; from 10.5.0, fixed in 10.5.8; from 9.11.0, fixed in 9.11.17. ### [CVE-2025-6233](https://cve.now/CVE-2025-6233): Arbitrary file read by system admin via path traversal - Severity: Medium 6.8 - Published: Jul 18, 2025 - Affected: from 9.11.0+incompatible, fixed in 9.11.17+incompatible; from 10.5.0+incompatible, fixed in 10.5.8+incompatible; from 10.7.0+incompatible, fixed in 10.7.4+incompatible; from 10.8.0+incompatible, fixed in 10.8.2+incompatible; from 10.8.0, fixed in 10.8.2; from 10.7.0, fixed in 10.7.4; from 10.5.0, fixed in 10.5.8; from 9.11.0, fixed in 9.11.17. ### [CVE-2025-6226](https://cve.now/CVE-2025-6226): IDOR in CreatePost API allows for timeboxed message disclosure - Severity: Medium 6.5 - Published: Jul 18, 2025 - Affected: from 9.11.0+incompatible, fixed in 9.11.17+incompatible; from 10.5.0+incompatible, fixed in 10.5.7+incompatible; from 10.7.0+incompatible, fixed in 10.7.4+incompatible; from 10.8.0+incompatible, fixed in 10.8.2+incompatible; from 10.5.0, fixed in 10.5.7; from 10.8.0, fixed in 10.8.2; from 10.7.0, fixed in 10.7.4; from 9.11.0, fixed in 9.11.17. ### [CVE-2025-47871](https://cve.now/CVE-2025-47871): Mattermost Playbooks exposes private channel metadata to unauthorized users via run metadata API - Severity: Medium 4.3 - Published: Jun 30, 2025 - Affected: fixed in 0.0.0-20250513065225-4ae5d647fb88; from 9.11.0+incompatible, fixed in 9.11.16+incompatible; from 10.5.0+incompatible, fixed in 10.5.6+incompatible; from 10.6.0+incompatible, fixed in 10.6.6+incompatible; from 10.7.0+incompatible, fixed in 10.7.3+incompatible; from 10.8.0+incompatible, fixed in 10.8.1+incompatible; fixed in 0.0.0-20250513065225-4ae5d647fb88. ### [CVE-2025-46702](https://cve.now/CVE-2025-46702): Mattermost Playbooks allows privilege escalation through improper access control in playbook run participant management - Severity: Medium 5.4 - Published: Jun 30, 2025 - Affected: fixed in 0.0.0-20250513065225-4ae5d647fb88; from 9.11.0+incompatible, fixed in 9.11.16+incompatible; from 10.5.0+incompatible, fixed in 10.5.6+incompatible; from 10.6.0+incompatible, fixed in 10.6.6+incompatible; from 10.7.0+incompatible, fixed in 10.7.3+incompatible; from 10.8.0+incompatible, fixed in 10.8.1+incompatible; fixed in 0.0.0-20250513065225-4ae5d647fb88. ### [CVE-2025-3228](https://cve.now/CVE-2025-3228): Unauthorized Guest user access to Playbook - Severity: Medium 4.3 - Published: Jun 20, 2025 - Affected: fixed in 0.0.0-20250520060012-d0380305ef7a; fixed in 0.0.0-20250520060012-d0380305ef7a; from 9.11.0+incompatible, fixed in 9.11.16+incompatible; from 10.5.0+incompatible, fixed in 10.5.6+incompatible; from 10.6.0+incompatible, fixed in 10.6.6+incompatible; from 10.7.0+incompatible, fixed in 10.7.3+incompatible; from 10.8.0+incompatible, fixed in 10.8.1+incompatible. ### [CVE-2025-3227](https://cve.now/CVE-2025-3227): Unauthorized channel member management through playbook runs - Severity: Medium 4.3 - Published: Jun 20, 2025 - Affected: fixed in 0.0.0-20250520060012-d0380305ef7a; fixed in 0.0.0-20250520060012-d0380305ef7a; from 9.11.0+incompatible, fixed in 9.11.16+incompatible; from 10.5.0+incompatible, fixed in 10.5.6+incompatible; from 10.6.0+incompatible, fixed in 10.6.6+incompatible; from 10.7.0+incompatible, fixed in 10.7.3+incompatible; from 10.8.0+incompatible, fixed in 10.8.1+incompatible. ### [CVE-2025-4981](https://cve.now/CVE-2025-4981): Path Traversal Leading to RCE by Any Authenticated Mattermost User - Severity: Critical 9.9 - Published: Jun 20, 2025 - Affected: fixed in 0.0.0-20250519205859-65aec10162f6; fixed in 0.0.0-20250519205859-65aec10162f6; from 9.11.0+incompatible, fixed in 9.11.16+incompatible; from 10.5.0+incompatible, fixed in 10.5.6+incompatible; from 10.6.0+incompatible, fixed in 10.6.6+incompatible; from 10.7.0+incompatible, fixed in 10.7.3+incompatible; from 10.8.0+incompatible, fixed in 10.8.1+incompatible. ### [CVE-2025-4128](https://cve.now/CVE-2025-4128): Mattermost Guest User Information Disclosure Vulnerability - Severity: Low 3.1 - Published: Jun 11, 2025 - Affected: from 10.5.0, fixed in 10.5.5; from 9.11.0, fixed in 9.11.14; from 9.11.0+incompatible, fixed in 9.11.14+incompatible; from 10.5.0+incompatible, fixed in 10.5.5+incompatible. ### [CVE-2025-4573](https://cve.now/CVE-2025-4573): LDAP Injection in Mattermost Enterprise Edition When Using Active Directory - Severity: Medium 4.1 - Published: Jun 11, 2025 - Affected: from 9.11.0+incompatible, fixed in 9.11.14+incompatible; from 10.5.0+incompatible, fixed in 10.5.5+incompatible; from 10.6.0+incompatible, fixed in 10.6.4+incompatible; from 10.7.0+incompatible, fixed in 10.7.2+incompatible; from 10.7.0, fixed in 10.7.2; from 10.6.0, fixed in 10.6.4; from 10.5.0, fixed in 10.5.5; from 9.11.0, fixed in 9.11.14. ### [CVE-2025-3611](https://cve.now/CVE-2025-3611): Improper Access Control in Mattermost allows System Managers to view team details despite role restrictions - Severity: Low 3.1 - Published: May 30, 2025 - Affected: from 9.0.0-rc1+incompatible, fixed in 9.11.13+incompatible; from 10.0.0-rc1+incompatible, fixed in 10.5.4+incompatible; from 10.6.0-rc1+incompatible, fixed in 10.7.1+incompatible. ### [CVE-2025-3230](https://cve.now/CVE-2025-3230): Bypass of System Admin User Deactivation Controls for Personal Access Tokens in Mattermost Server - Severity: Medium 5.4 - Published: May 30, 2025 - Affected: from 9.0.0-rc1+incompatible, fixed in 9.11.13+incompatible; from 10.0.0-rc1+incompatible, fixed in 10.5.4+incompatible; from 10.6.0-rc1+incompatible, fixed in 10.6.3+incompatible; from 10.7.0-rc1+incompatible, fixed in 10.7.1+incompatible. ### [CVE-2025-2571](https://cve.now/CVE-2025-2571): Google OAuth Authentication Bypass for Converted Bot Accounts - Severity: Medium 4.2 - Published: May 30, 2025 - Affected: from 9.0.0-rc1+incompatible, fixed in 9.11.13+incompatible; from 10.0.0-rc1+incompatible, fixed in 10.5.4+incompatible; from 10.6.0-rc1+incompatible, fixed in 10.6.3+incompatible; from 10.7.0-rc1+incompatible, fixed in 10.7.1+incompatible. ### [CVE-2025-1792](https://cve.now/CVE-2025-1792): Improper Access Control in Mattermost Channel Member API - Severity: Low 3.1 - Published: May 30, 2025 - Affected: from 9.0.0-rc1+incompatible, fixed in 9.11.13+incompatible; from 10.0.0-rc1+incompatible, fixed in 10.5.4+incompatible; from 10.6.0-rc1+incompatible, fixed in 10.7.1+incompatible. ### [CVE-2025-3913](https://cve.now/CVE-2025-3913): Team Privacy Settings Authorization Bypass in Mattermost Server - Severity: Medium 5.3 - Published: May 29, 2025 - Affected: from 9.0.0-rc1+incompatible, fixed in 9.11.13+incompatible; from 10.5.0-rc1+incompatible, fixed in 10.5.4+incompatible; from 10.6.0-rc1+incompatible, fixed in 10.6.3+incompatible; from 10.7.0-rc1+incompatible, fixed in 10.7.1+incompatible. ### [CVE-2025-2570](https://cve.now/CVE-2025-2570): System Admin Cannot Access Environment settings in System Console While System Manager Can - Severity: Low 2.7 - Published: May 15, 2025 - Affected: from 9.11.0+incompatible, fixed in 9.11.12+incompatible; from 10.5.0+incompatible, fixed in 10.5.3+incompatible. ### [CVE-2025-2527](https://cve.now/CVE-2025-2527): Improper access control to group information - Severity: Medium 4.3 - Published: May 15, 2025 - Affected: from 9.11.0+incompatible, fixed in 9.11.12+incompatible; from 10.5.0+incompatible, fixed in 10.5.3+incompatible. ### [CVE-2025-3446](https://cve.now/CVE-2025-3446): Members Without Guest Invite Permissions Can Add Guests to Teams - Severity: Medium 4.3 - Published: May 15, 2025 - Affected: from 9.11.0+incompatible, fixed in 9.11.12+incompatible; from 10.4.0+incompatible, fixed in 10.4.5+incompatible; from 10.5.0+incompatible, fixed in 10.5.3+incompatible; from 10.6.0+incompatible, fixed in 10.6.2+incompatible. ### [CVE-2025-31947](https://cve.now/CVE-2025-31947): Repeated LDAP login failures can lock an LDAP account - Severity: Medium 5.8 - Published: May 15, 2025 - Affected: from 9.11.0+incompatible, fixed in 9.11.12+incompatible; from 10.4.0+incompatible, fixed in 10.4.5+incompatible; from 10.5.0+incompatible, fixed in 10.5.3+incompatible; from 10.6.0+incompatible, fixed in 10.6.2+incompatible. ### [CVE-2025-41423](https://cve.now/CVE-2025-41423): Unauthorized Playbooks Post Deletion in Mattermost Playbooks Plugin - Severity: Low 3.1 - Published: Apr 24, 2025 - Affected: from 9.11.0+incompatible; from 10.4.0+incompatible; from 10.5.0+incompatible. ### [CVE-2025-35965](https://cve.now/CVE-2025-35965): DoS in Mattermost Playbooks via Excessive Task Actions - Severity: Medium 6.5 - Published: Apr 24, 2025 - Affected: from 9.11.0+incompatible; from 10.4.0+incompatible; from 10.5.0+incompatible. ### [CVE-2025-41395](https://cve.now/CVE-2025-41395): Webapp DoS via malicious retrospective post in Playbooks - Severity: Medium 6.5 - Published: Apr 24, 2025 - Affected: from 9.11.0+incompatible; from 10.4.0+incompatible; from 10.5.0+incompatible. ### [CVE-2025-2564](https://cve.now/CVE-2025-2564): Unauthorized View Access to Archived Channel Member Info - Severity: Medium 4.3 - Published: Apr 16, 2025 - Affected: from 9.11.0+incompatible, fixed in 9.11.10+incompatible; from 10.4.0+incompatible, fixed in 10.4.4+incompatible; from 10.5.0+incompatible, fixed in 10.5.2+incompatible. ### [CVE-2025-27936](https://cve.now/CVE-2025-27936): Webhook Secret Exposure via Timing attack in MSteams plugin - Severity: Medium 5.3 - Published: Apr 16, 2025 - Affected: from 10.5.0+incompatible, fixed in 10.5.2+incompatible. ### [CVE-2025-31363](https://cve.now/CVE-2025-31363): Data exfiltration via AI plugin Jira tool - Severity: Low 3.0 - Published: Apr 16, 2025 - Affected: from 9.11.0+incompatible, fixed in 9.11.10+incompatible; from 10.4.0+incompatible, fixed in 10.4.3+incompatible; from 10.5.0+incompatible, fixed in 10.5.1+incompatible. ### [CVE-2025-27571](https://cve.now/CVE-2025-27571): Channel metadata visible in archived channels despite configuration setting - Severity: Medium 4.3 - Published: Apr 16, 2025 - Affected: from 9.11.0+incompatible, fixed in 9.11.10+incompatible; from 10.4.0+incompatible, fixed in 10.4.4+incompatible; from 10.5.0+incompatible, fixed in 10.5.2+incompatible. ### [CVE-2025-27538](https://cve.now/CVE-2025-27538): MFA Enforcement Bypass Allows Unauthorized Removal of MFA for Other Users - Severity: Low 2.2 - Published: Apr 16, 2025 - Affected: from 9.11.0+incompatible, fixed in 9.11.10+incompatible; from 10.5.0+incompatible, fixed in 10.5.2+incompatible. ### [CVE-2025-24839](https://cve.now/CVE-2025-24839): Unauthorized AI bot activation via Wrangler plugin - Severity: Low 3.1 - Published: Apr 16, 2025 - Affected: from 9.11.0+incompatible, fixed in 9.11.10+incompatible; from 10.4.0+incompatible, fixed in 10.4.4+incompatible; from 10.5.0+incompatible, fixed in 10.5.2+incompatible. ### [CVE-2025-2475](https://cve.now/CVE-2025-2475): Unauthorized Bot Login Using Credentials - Severity: Medium 5.4 - Published: Apr 14, 2025 - Affected: from 9.11.0+incompatible, fixed in 9.11.10+incompatible; from 10.5.0+incompatible, fixed in 10.5.2+incompatible. ### [CVE-2025-2424](https://cve.now/CVE-2025-2424): Leaked Metadata of Deleted Files via Bookmark Creation - Severity: Low 3.1 - Published: Apr 14, 2025 - Affected: from 9.11.0+incompatible, fixed in 9.11.10+incompatible; from 10.5.0+incompatible, fixed in 10.5.2+incompatible. ### [CVE-2025-32093](https://cve.now/CVE-2025-32093): Syatem admin profile modification by delegated granular administration role - Severity: Medium 4.7 - Published: Apr 14, 2025 - Affected: from 10.5.0, fixed in 10.5.2; from 10.4.0, fixed in 10.4.4; from 9.11.0, fixed in 9.11.10; from 9.11.0+incompatible, fixed in 9.11.10+incompatible; from 10.4.0+incompatible, fixed in 10.4.4+incompatible; from 10.5.0+incompatible, fixed in 10.5.2+incompatible. ### [CVE-2025-24866](https://cve.now/CVE-2025-24866): Unauthorized Access to User Activity Logs API by delegated granular administration roles - Severity: Low 2.7 - Published: Apr 10, 2025 - Affected: from 9.11.0+incompatible, fixed in 9.11.9+incompatible. ### [CVE-2025-25068](https://cve.now/CVE-2025-25068): Bypassing MFA Enforcement on Plugin Endpoints - Severity: High 7.5 - Published: Mar 21, 2025 - Affected: from 9.11.0+incompatible, fixed in 9.11.9+incompatible; from 10.3.0+incompatible, fixed in 10.3.4+incompatible; from 10.4.0+incompatible, fixed in 10.4.3+incompatible; from 10.5.0+incompatible, fixed in 10.5.1+incompatible. ### [CVE-2025-24920](https://cve.now/CVE-2025-24920): Unauthorized Bookmark Creation and Modification in Archived Channels - Severity: Medium 4.3 - Published: Mar 21, 2025 - Affected: from 9.11.0+incompatible, fixed in 9.11.9+incompatible; from 10.3.0+incompatible, fixed in 10.3.4+incompatible; from 10.4.0+incompatible, fixed in 10.4.3+incompatible; from 10.5.0+incompatible, fixed in 10.5.1+incompatible. ### [CVE-2025-30179](https://cve.now/CVE-2025-30179): MFA Enforcement Bypass in Search APIs - Severity: Medium 4.3 - Published: Mar 21, 2025 - Affected: from 9.11.0+incompatible, fixed in 9.11.9+incompatible; from 10.3.0+incompatible, fixed in 10.3.4+incompatible; from 10.4.0+incompatible, fixed in 10.4.3+incompatible; from 10.5.0+incompatible, fixed in 10.5.1+incompatible. ### [CVE-2025-25274](https://cve.now/CVE-2025-25274): Unauthorized Command Execution in Archived Channels - Severity: Medium 4.3 - Published: Mar 21, 2025 - Affected: from 9.11.0+incompatible, fixed in 9.11.9+incompatible; from 10.3.0+incompatible, fixed in 10.3.4+incompatible; from 10.4.0+incompatible, fixed in 10.4.3+incompatible; from 10.5.0+incompatible, fixed in 10.5.1+incompatible. ### [CVE-2025-27933](https://cve.now/CVE-2025-27933): Unauthorized Private-to-Public Channel Conversion - Severity: Medium 5.4 - Published: Mar 21, 2025 - Affected: fixed in 9.11.9; from 9.11.0+incompatible, fixed in 9.11.9+incompatible; from 10.3.0+incompatible, fixed in 10.3.4+incompatible; from 10.4.0+incompatible, fixed in 10.4.3+incompatible. ### [CVE-2025-27715](https://cve.now/CVE-2025-27715): Auto-Enrollment of Team Admins into Private Channels without explicit consent - Severity: Low 3.3 - Published: Mar 21, 2025 - Affected: from 9.11.0+incompatible, fixed in 9.11.9+incompatible. ### [CVE-2025-1472](https://cve.now/CVE-2025-1472): Unauthorized View Access to Site Statistics and Team Statistics - Severity: Medium 4.3 - Published: Mar 19, 2025 - Affected: from 9.11.0, fixed in 9.11.9; from 9.11.0+incompatible, fixed in 9.11.9+incompatible. ### [CVE-2025-20051](https://cve.now/CVE-2025-20051): Arbitrary file read via block duplication in Mattermost Boards - Severity: Critical 9.9 - Published: Feb 24, 2025 - Affected: from 9.11.0-rc1+incompatible, fixed in 9.11.8+incompatible; from 10.2.0-rc1+incompatible, fixed in 10.2.3+incompatible; from 10.3.0-rc1+incompatible, fixed in 10.3.3+incompatible; from 10.4.0-rc1+incompatible, fixed in 10.4.2+incompatible. ### [CVE-2025-25279](https://cve.now/CVE-2025-25279): Arbitrary file read in Mattermost Boards via import & export board archive - Severity: Critical 9.9 - Published: Feb 24, 2025 - Affected: from 9.11.0-rc1+incompatible, fixed in 9.11.8+incompatible; from 10.2.0-rc1+incompatible, fixed in 10.2.3+incompatible; from 10.3.0-rc1+incompatible, fixed in 10.3.3+incompatible; from 10.4.0-rc1+incompatible, fixed in 10.4.2+incompatible. ### [CVE-2025-1412](https://cve.now/CVE-2025-1412): Session Persistence After User-to-Bot Conversion - Severity: Low 3.1 - Published: Feb 24, 2025 - Affected: from 9.11.0-rc1+incompatible, fixed in 9.11.7+incompatible; from 10.4.0-rc1+incompatible, fixed in 10.4.2+incompatible. ### [CVE-2025-24526](https://cve.now/CVE-2025-24526): Channel export permitted on archived channel when viewing archived channels is disabled - Severity: Medium 4.3 - Published: Feb 24, 2025 - Affected: from 9.11.0-rc1+incompatible, fixed in 9.11.8+incompatible; from 10.2.0-rc1+incompatible, fixed in 10.2.3+incompatible; from 10.3.0-rc1+incompatible, fixed in 10.3.3+incompatible; from 10.4.0-rc1+incompatible, fixed in 10.4.2+incompatible. ### [CVE-2025-20621](https://cve.now/CVE-2025-20621): Webapp crash via object that can't be cast to String in Attachment Field - Severity: Medium 6.5 - Published: Jan 16, 2025 - Affected: from 9.11.0+incompatible, fixed in 9.11.6+incompatible; from 10.0.0+incompatible, fixed in 10.0.4+incompatible; from 10.1.0+incompatible, fixed in 10.1.4+incompatible; from 10.2.0+incompatible, fixed in 10.2.1+incompatible. ### [CVE-2025-20088](https://cve.now/CVE-2025-20088): Insufficient Input Validation on Post Props - Severity: Medium 6.5 - Published: Jan 15, 2025 - Affected: from 9.11.0+incompatible, fixed in 9.11.6+incompatible; from 10.0.0+incompatible, fixed in 10.0.4+incompatible; from 10.1.0+incompatible, fixed in 10.1.4+incompatible; from 10.2.0+incompatible, fixed in 10.2.1+incompatible. ### [CVE-2025-20086](https://cve.now/CVE-2025-20086): Insufficient Input Validation on Post Props - Severity: Medium 6.5 - Published: Jan 15, 2025 - Affected: from 9.11.0+incompatible, fixed in 9.11.6+incompatible; from 10.0.0+incompatible, fixed in 10.0.4+incompatible; from 10.1.0+incompatible, fixed in 10.1.4+incompatible; from 10.2.0+incompatible, fixed in 10.2.1+incompatible. ### [CVE-2025-21088](https://cve.now/CVE-2025-21088): WebApp crash via improper validation of proto style in attachments - Severity: Medium 6.5 - Published: Jan 15, 2025 - Affected: from 9.11.0+incompatible, fixed in 9.11.6+incompatible; from 10.0.0+incompatible, fixed in 10.0.4+incompatible; from 10.1.0+incompatible, fixed in 10.1.4+incompatible; from 10.2.0+incompatible, fixed in 10.2.1+incompatible. ### [CVE-2025-22445](https://cve.now/CVE-2025-22445): Misleading UI for undefined admin console settings in Calls causes security confusion - Severity: Low 3.5 - Published: Jan 9, 2025 - Affected: fixed in 10.3.0+incompatible. ### [CVE-2025-20033](https://cve.now/CVE-2025-20033): DoS via custom post type for sysconsole plugin readers - Severity: Medium 4.3 - Published: Jan 9, 2025 - Affected: from 10.0.0+incompatible, fixed in 10.0.4+incompatible; from 10.1.0+incompatible, fixed in 10.1.4+incompatible; from 10.2.0+incompatible, fixed in 10.2.1+incompatible. ### [CVE-2025-22449](https://cve.now/CVE-2025-22449): Access control flaw for team admins allows unauthorized team additions - Severity: Low 3.8 - Published: Jan 9, 2025 - Affected: from 9.11.0+incompatible. ### [CVE-2024-54682](https://cve.now/CVE-2024-54682): Zipbomb DoS via Missing Slack Import Validation - Severity: Medium 6.5 - Published: Dec 16, 2024 - Affected: from 9.5.0+incompatible, fixed in 9.5.13+incompatible; from 9.11.0+incompatible, fixed in 9.11.5+incompatible; from 10.0.0+incompatible, fixed in 10.0.3+incompatible; from 10.1.0+incompatible, fixed in 10.1.3+incompatible. ### [CVE-2024-54083](https://cve.now/CVE-2024-54083): DoS via lack of type validation in Calls - Severity: Medium 6.5 - Published: Dec 16, 2024 - Affected: from 9.5.0+incompatible, fixed in 9.5.13+incompatible; from 9.11.0+incompatible, fixed in 9.11.5+incompatible; from 10.0.0+incompatible, fixed in 10.0.3+incompatible; from 10.1.0+incompatible, fixed in 10.1.3+incompatible. ### [CVE-2024-48872](https://cve.now/CVE-2024-48872): Bypass of "Max failed attempts" restriction via race condition - Severity: Medium 4.8 - Published: Dec 16, 2024 - Affected: from 9.5.0+incompatible, fixed in 9.5.13+incompatible; from 9.11.0+incompatible, fixed in 9.11.5+incompatible; from 10.0.0+incompatible, fixed in 10.0.3+incompatible; from 10.1.0+incompatible, fixed in 10.1.3+incompatible. ### [CVE-2024-46872](https://cve.now/CVE-2024-46872): Client-Side Path Traversal Leading to CSRF in Playbooks - Severity: Medium 4.6 - Published: Oct 29, 2024 - Affected: all versions. ### [CVE-2024-47401](https://cve.now/CVE-2024-47401): DoS via Amplified GraphQL Response in Playbooks - Severity: Medium 4.3 - Published: Oct 29, 2024 - Affected: all versions. ### [CVE-2024-50052](https://cve.now/CVE-2024-50052): Arbitrary post deletion via Playbooks /ignore-thread endpoint - Severity: Medium 4.3 - Published: Oct 29, 2024 - Affected: all versions. ### [CVE-2024-10241](https://cve.now/CVE-2024-10241): Private channel names leaked with Ctrl+K when ElasticSearch is enabled - Severity: Medium 4.3 - Published: Oct 29, 2024 - Affected: all versions. ### [CVE-2024-10214](https://cve.now/CVE-2024-10214): Incorrect Session Creation with Desktop SSO - Severity: Low 3.5 - Published: Oct 28, 2024 - Affected: all versions. ### [CVE-2024-47003](https://cve.now/CVE-2024-47003): DoS via non-string message using permalink embed - Severity: Low 3.1 - Published: Sep 26, 2024 - Affected: all versions. ### [CVE-2024-43780](https://cve.now/CVE-2024-43780): Unauthorized channel file upload - Severity: Medium 4.3 - Published: Aug 22, 2024 - Affected: from 9.5.0+incompatible, fixed in 9.5.8+incompatible; from 9.8.0+incompatible, fixed in 9.8.3+incompatible; from 9.9.0+incompatible, fixed in 9.9.2+incompatible; from 9.10.0+incompatible, fixed in 9.10.1+incompatible. ### [CVE-2024-42497](https://cve.now/CVE-2024-42497): Insufficient permissions checks on teams - Severity: Medium 6.0 - Published: Aug 22, 2024 - Affected: from 9.5.0+incompatible, fixed in 9.5.8+incompatible; from 9.8.0+incompatible, fixed in 9.8.3+incompatible; from 9.9.0+incompatible, fixed in 9.9.2+incompatible; from 9.10.0+incompatible, fixed in 9.10.1+incompatible. ### [CVE-2024-40884](https://cve.now/CVE-2024-40884): Unauthorized disabling of invite URL - Severity: Low 2.7 - Published: Aug 22, 2024 - Affected: from 9.5.0+incompatible, fixed in 9.5.8+incompatible; from 9.10.0+incompatible, fixed in 9.10.1+incompatible. ### [CVE-2024-8071](https://cve.now/CVE-2024-8071): System Role with edit access to permissions can elevate themselves to system admin - Severity: Medium 4.7 - Published: Aug 22, 2024 - Affected: from 9.5.0+incompatible, fixed in 9.5.8+incompatible; from 9.8.0+incompatible, fixed in 9.8.3+incompatible; from 9.9.0+incompatible, fixed in 9.9.2+incompatible; from 9.10.0+incompatible, fixed in 9.10.1+incompatible. ### [CVE-2024-40886](https://cve.now/CVE-2024-40886): One-click Client-Side Path Traversal Leading to CSRF in User Management admin page - Severity: Medium 4.6 - Published: Aug 22, 2024 - Affected: from 9.5.0+incompatible, fixed in 9.5.8+incompatible; from 9.8.0+incompatible, fixed in 9.8.3+incompatible; from 9.9.0+incompatible, fixed in 9.9.2+incompatible; from 9.10.0+incompatible, fixed in 9.10.1+incompatible. ### [CVE-2024-32939](https://cve.now/CVE-2024-32939): Email addresses of remote users visible in props regardless of server settings - Severity: Medium 4.3 - Published: Aug 22, 2024 - Affected: from 9.5.0+incompatible, fixed in 9.5.8+incompatible; from 9.8.0+incompatible, fixed in 9.8.3+incompatible; from 9.9.0+incompatible, fixed in 9.9.2+incompatible; from 9.10.0+incompatible, fixed in 9.10.1+incompatible. ### [CVE-2024-39836](https://cve.now/CVE-2024-39836): Munged email address used for password resets and notifications - Severity: Medium 4.8 - Published: Aug 22, 2024 - Affected: from 9.5.0+incompatible, fixed in 9.5.8+incompatible; from 9.8.0+incompatible, fixed in 9.8.3+incompatible; from 9.9.0+incompatible, fixed in 9.9.2+incompatible; from 9.10.0+incompatible, fixed in 9.10.1+incompatible. ### [CVE-2024-41926](https://cve.now/CVE-2024-41926): Malicious remote can claim that a user was synced from another remote - Severity: Low 2.7 - Published: Aug 1, 2024 - Affected: from 9.5.0+incompatible, fixed in 9.5.7+incompatible; from 9.9.0+incompatible, fixed in 9.9.1+incompatible. ### [CVE-2024-41162](https://cve.now/CVE-2024-41162): Malicious remote can make an arbitrary local channel read-only - Severity: Medium 4.1 - Published: Aug 1, 2024 - Affected: from 9.5.0+incompatible, fixed in 9.5.7+incompatible; from 9.7.0+incompatible, fixed in 9.7.6+incompatible; from 9.8.0+incompatible, fixed in 9.8.2+incompatible; from 9.9.0+incompatible, fixed in 9.9.1+incompatible. ### [CVE-2024-41144](https://cve.now/CVE-2024-41144): Malicious remote can create/update/delete arbitrary posts in arbitrary channels - Severity: Medium 5.5 - Published: Aug 1, 2024 - Affected: from 9.5.0+incompatible, fixed in 9.5.7+incompatible; from 9.7.0+incompatible, fixed in 9.7.6+incompatible; from 9.8.0+incompatible, fixed in 9.8.2+incompatible; from 9.9.0+incompatible, fixed in 9.9.1+incompatible. ### [CVE-2024-39839](https://cve.now/CVE-2024-39839): Remote username set to an arbitrary string by remote user - Severity: Medium 4.3 - Published: Aug 1, 2024 - Affected: from 9.5.0+incompatible, fixed in 9.5.7+incompatible; from 9.7.0+incompatible, fixed in 9.7.6+incompatible; from 9.8.0+incompatible, fixed in 9.8.2+incompatible; from 9.9.0+incompatible, fixed in 9.9.1+incompatible. ### [CVE-2024-39837](https://cve.now/CVE-2024-39837): Malicious remote can create arbitrary channels - Severity: Low 3.8 - Published: Aug 1, 2024 - Affected: from 9.9.0, fixed in 9.9.1; from 9.5.0, fixed in 9.5.7; from 9.5.0+incompatible, fixed in 9.5.7+incompatible; from 9.9.0+incompatible, fixed in 9.9.1+incompatible. ### [CVE-2024-39832](https://cve.now/CVE-2024-39832): Permanently local data deletion by malicious remote - Severity: Medium 6.8 - Published: Aug 1, 2024 - Affected: from 9.5.0+incompatible, fixed in 9.5.7+incompatible; from 9.7.0+incompatible, fixed in 9.7.6+incompatible; from 9.8.0+incompatible, fixed in 9.8.2+incompatible; from 9.9.0+incompatible, fixed in 9.9.1+incompatible. ### [CVE-2024-39777](https://cve.now/CVE-2024-39777): Malicious remote can invite itself to an arbitrary local channel - Severity: High 8.7 - Published: Aug 1, 2024 - Affected: from 9.5.0+incompatible, fixed in 9.5.7+incompatible; from 9.7.0+incompatible, fixed in 9.7.6+incompatible; from 9.8.0+incompatible, fixed in 9.8.1+incompatible; from 9.9.0+incompatible, fixed in 9.9.1+incompatible. ### [CVE-2024-39274](https://cve.now/CVE-2024-39274): Malicious remote can add users to arbitrary teams and channels - Severity: High 8.7 - Published: Aug 1, 2024 - Affected: from 9.5.0+incompatible, fixed in 9.5.7+incompatible; from 9.7.0+incompatible, fixed in 9.7.6+incompatible; from 9.8.0+incompatible, fixed in 9.8.2+incompatible; from 9.9.0+incompatible, fixed in 9.9.1+incompatible. ### [CVE-2024-36492](https://cve.now/CVE-2024-36492): Existing local user overwritten by malicious remote - Severity: High 7.4 - Published: Aug 1, 2024 - Affected: from 9.5.0+incompatible, fixed in 9.5.7+incompatible; from 9.7.0+incompatible, fixed in 9.7.6+incompatible; from 9.8.0+incompatible, fixed in 9.8.2+incompatible; from 9.9.0+incompatible, fixed in 9.9.1+incompatible. ### [CVE-2024-29977](https://cve.now/CVE-2024-29977): Malicious remote can create arbitrary reactions on arbitrary posts - Severity: Low 2.7 - Published: Aug 1, 2024 - Affected: from 9.5.0+incompatible, fixed in 9.5.7+incompatible; from 9.9.0+incompatible, fixed in 9.9.1+incompatible. ### [CVE-2024-4198](https://cve.now/CVE-2024-4198): Mattermost versions 9.6.0, 9.5.x before 9.5.3, and 8.1.x before 8.1.12 fail to fully validate role changes which allows an attacker… - Severity: Low 2.7 - Published: Apr 26, 2024 - Affected: from 8.1.0+incompatible, fixed in 8.1.12+incompatible; from 9.5.0+incompatible, fixed in 9.5.3+incompatible; from 9.6.0-rc1+incompatible, fixed in 9.6.1+incompatible; from 9.6.0-rc1, fixed in 9.6.1; from 9.5.0, fixed in 9.5.3; from 8.1.0, fixed in 8.1.12. ### [CVE-2024-4195](https://cve.now/CVE-2024-4195): Mattermost versions 9.6.0, 9.5.x before 9.5.3, and 8.1.x before 8.1.12 fail to fully validate role changes, which allows an attacker… - Severity: Low 2.7 - Published: Apr 26, 2024 - Affected: from 9.5.0, fixed in 9.5.3; from 8.1.0, fixed in 8.1.12; from 8.1.0+incompatible, fixed in 8.1.12+incompatible; from 9.5.0+incompatible, fixed in 9.5.3+incompatible. ### [CVE-2024-4183](https://cve.now/CVE-2024-4183): Mattermost versions 8.1.x before 8.1.12, 9.6.x before 9.6.1, 9.5.x before 9.5.3, 9.4.x before 9.4.5 fail to limit the number of active… - Severity: Medium 4.3 - Published: Apr 26, 2024 - Affected: from 8.1.0+incompatible, fixed in 8.1.12+incompatible; from 9.4.0+incompatible, fixed in 9.4.5+incompatible; from 9.5.0+incompatible, fixed in 9.5.3+incompatible; from 9.6.0-rc1+incompatible, fixed in 9.6.1+incompatible; from 9.6.0-rc1, fixed in 9.6.1; from 9.5.0, fixed in 9.5.3; from 9.4.0, fixed in 9.4.5; from 8.1.0, fixed in 8.1.12. ### [CVE-2024-4182](https://cve.now/CVE-2024-4182): Mattermost versions 9.6.0, 9.5.x before 9.5.3, 9.4.x before 9.4.5, and 8.1.x before 8.1.12 fail to handle JSON parsing errors in custom… - Severity: Medium 4.3 - Published: Apr 26, 2024 - Affected: from 8.1.0+incompatible, fixed in 8.1.12+incompatible; from 9.4.0+incompatible, fixed in 9.4.5+incompatible; from 9.5.0+incompatible, fixed in 9.5.3+incompatible; from 9.6.0-rc1+incompatible, fixed in 9.6.1+incompatible; from 8.1.0, fixed in 8.1.12; from 9.4.0, fixed in 9.4.5; from 9.5.0, fixed in 9.5.3; from 9.6.0-rc1, fixed in 9.6.1. ### [CVE-2024-32046](https://cve.now/CVE-2024-32046): Detailed error discloses full file path with dev mode off - Severity: Medium 4.3 - Published: Apr 26, 2024 - Affected: from 8.1.0, fixed in 8.1.12; from 9.5.0, fixed in 9.5.3; from 9.6.0-rc1, fixed in 9.6.1; from 9.4.0, fixed in 9.4.5; from 8.1.0+incompatible, fixed in 8.1.12+incompatible; from 9.4.0+incompatible, fixed in 9.4.5+incompatible; from 9.5.0+incompatible, fixed in 9.5.3+incompatible; from 9.6.0-rc1+incompatible, fixed in 9.6.1+incompatible. ### [CVE-2024-22091](https://cve.now/CVE-2024-22091): Excessive resource consumption due to lack to request path size limits - Severity: Low 3.1 - Published: Apr 26, 2024 - Affected: from 8.1.0+incompatible, fixed in 8.1.12+incompatible; from 9.5.0+incompatible, fixed in 9.5.3+incompatible; from 9.6.0-rc1+incompatible, fixed in 9.6.1+incompatible; from 8.1.0, fixed in 8.1.12; from 9.5.0, fixed in 9.5.3; from 9.6.0-rc1, fixed in 9.6.1. ### [CVE-2024-2447](https://cve.now/CVE-2024-2447): Mattermost versions 8.1.x before 8.1.11, 9.3.x before 9.3.3, 9.4.x before 9.4.4, and 9.5.x before 9.5.2 fail to authenticate the source of… - Severity: Medium 6.5 - Published: Apr 5, 2024 - Affected: from 9.3.0+incompatible, fixed in 9.3.3+incompatible; from 9.4.0+incompatible, fixed in 9.4.4+incompatible; from 9.5.0+incompatible, fixed in 9.5.2+incompatible. ### [CVE-2024-29221](https://cve.now/CVE-2024-29221): Invite ID available to team admins even without the "Add Members" permission - Severity: Medium 4.7 - Published: Apr 5, 2024 - Affected: from 9.3.0+incompatible, fixed in 9.3.3+incompatible; from 9.4.0+incompatible, fixed in 9.4.4+incompatible; from 9.5.0+incompatible, fixed in 9.5.2+incompatible. ### [CVE-2024-28949](https://cve.now/CVE-2024-28949): DoS via a large number of User Preferences - Severity: Medium 4.3 - Published: Apr 5, 2024 - Affected: from 9.3.0+incompatible, fixed in 9.3.3+incompatible; from 9.4.0+incompatible, fixed in 9.4.4+incompatible; from 9.5.0+incompatible, fixed in 9.5.2+incompatible. ### [CVE-2024-21848](https://cve.now/CVE-2024-21848): Users maintain access to active call after being removed from a channel - Severity: Low 3.1 - Published: Apr 5, 2024 - Affected: all versions. ### [CVE-2024-28053](https://cve.now/CVE-2024-28053): Resource Exhaustion via the Invitation Feature - Severity: Low 3.1 - Published: Mar 15, 2024 - Affected: fixed in 0.0.0-20240209181221-674f549daf0e. ### [CVE-2024-1953](https://cve.now/CVE-2024-1953): Mattermost versions 8.1.x before 8.1.9, 9.2.x before 9.2.5, 9.3.0, and 9.4.x before 9.4.2 fail to limit the number of role names requested… - Severity: Medium 4.3 - Published: Feb 29, 2024 - Affected: from 9.2.0+incompatible, fixed in 9.2.5+incompatible; from 9.3.0+incompatible, fixed in 9.3.1+incompatible; from 9.4.0+incompatible, fixed in 9.4.2+incompatible. ### [CVE-2024-1952](https://cve.now/CVE-2024-1952): Mattermost version 8.1.x before 8.1.9 fails to sanitize data associated with permalinks when a plugin updates an ephemeral post, allowing… - Severity: Low 3.1 - Published: Feb 29, 2024 - Affected: from 9.0.0+incompatible, fixed in 9.4.0+incompatible. ### [CVE-2024-1949](https://cve.now/CVE-2024-1949): A race condition in Mattermost versions 8.1.x before 8.1.9, and 9.4.x before 9.4.2 allows an authenticated attacker to gain unauthorized… - Severity: Low 2.6 - Published: Feb 29, 2024 - Affected: from 9.0.0+incompatible, fixed in 9.4.2+incompatible. ### [CVE-2024-1942](https://cve.now/CVE-2024-1942): Mattermost versions 8.1.x before 8.1.9, 9.2.x before 9.2.5, and 9.3.0 fail to sanitize the metadata on posts containing permalinks under… - Severity: Medium 4.3 - Published: Feb 29, 2024 - Affected: from 9.2.0+incompatible, fixed in 9.2.5+incompatible; from 9.3.0+incompatible, fixed in 9.3.1+incompatible. ### [CVE-2024-1888](https://cve.now/CVE-2024-1888): Existing server guests invited to the team by members without "invite\_guest" permission - Severity: Medium 4.3 - Published: Feb 29, 2024 - Affected: from 9.2.0+incompatible, fixed in 9.2.5+incompatible; from 9.3.0+incompatible, fixed in 9.3.1+incompatible; from 9.4.0+incompatible, fixed in 9.4.2+incompatible. ### [CVE-2024-24988](https://cve.now/CVE-2024-24988): Excessive resource consumption when sending long emoji names in user custom status - Severity: Medium 4.3 - Published: Feb 29, 2024 - Affected: from 9.2.0+incompatible, fixed in 9.2.5+incompatible; from 9.3.0+incompatible, fixed in 9.3.1+incompatible. ### [CVE-2024-1887](https://cve.now/CVE-2024-1887): Public channel post content accessible without membership when compliance export is enabled - Severity: Medium 4.3 - Published: Feb 29, 2024 - Affected: from 9.2.0+incompatible, fixed in 9.2.5+incompatible; from 9.3.0+incompatible, fixed in 9.3.1+incompatible. ### [CVE-2024-23488](https://cve.now/CVE-2024-23488): Files of archived channels accessible with the “Allow users to view archived channels” option disabled - Severity: Low 3.1 - Published: Feb 29, 2024 - Affected: from 9.0.0+incompatible, fixed in 9.4.2+incompatible. ### [CVE-2024-23493](https://cve.now/CVE-2024-23493): Team associated AD/LDAP Groups Leaked due to missing authorization - Severity: Medium 4.3 - Published: Feb 29, 2024 - Affected: from 9.2.0+incompatible, fixed in 9.2.5+incompatible; from 9.3.0+incompatible, fixed in 9.3.1+incompatible; from 9.4.0+incompatible, fixed in 9.4.2+incompatible. ### [CVE-2024-1402](https://cve.now/CVE-2024-1402): Denial of service in mattermost mobile apps and server via emoji reactions - Severity: Medium 4.3 - Published: Feb 9, 2024 - Affected: from 9.1.0+incompatible, fixed in 9.1.5+incompatible; from 9.2.0+incompatible, fixed in 9.2.4+incompatible. ### [CVE-2024-24776](https://cve.now/CVE-2024-24776): Incorrect Authorization leads to Channel Member Count Leak - Severity: Low 3.1 - Published: Feb 9, 2024 - Affected: from 9.0.0+incompatible, fixed in 9.3.0+incompatible. ### [CVE-2023-47858](https://cve.now/CVE-2023-47858): Details of archived public channels are leaked to members of another team - Severity: Medium 4.3 - Published: Jan 2, 2024 - Affected: all versions. ### [CVE-2023-50333](https://cve.now/CVE-2023-50333): Lack of restriction to manage group names for freshly demoted guests - Severity: Low 3.7 - Published: Jan 2, 2024 - Affected: all versions. ### [CVE-2023-48732](https://cve.now/CVE-2023-48732): Keywords that trigger mentions are leaked to other users - Severity: Medium 4.3 - Published: Jan 2, 2024 - Affected: fixed in 8.1.7+incompatible. ### [CVE-2023-7113](https://cve.now/CVE-2023-7113): Mattermost version 8.1.6 and earlier fails to sanitize channel mention data in posts, which allows an attacker to inject markup in the web… - Severity: Low 3.7 - Published: Dec 29, 2023 - Affected: all versions. ### [CVE-2023-5968](https://cve.now/CVE-2023-5968): Password hash in response body after username update - Severity: Medium 4.9 - Published: Nov 6, 2023 - Affected: fixed in 5.3.2-0.20230825233148-f787fd63368a. ### [CVE-2023-1777](https://cve.now/CVE-2023-1777): Information disclosure in linked message previews - Severity: Medium 6.5 - Published: Mar 31, 2023 - Affected: from 7.8.0, fixed in 7.8.1; from 7.7.0, fixed in 7.7.2; from 7.1.0, fixed in 7.1.6; from 1.4.1-0.20211025164829-f7a8147b825c, fixed in 1.4.1-0.20230301145909-10be118d99a5. ### [CVE-2023-1776](https://cve.now/CVE-2023-1776): Stored XSS via SVG attachment on Boards - Severity: High 7.3 - Published: Mar 31, 2023 - Affected: from 7.7.0, fixed in 7.7.2; from 7.1.0, fixed in 7.1.6; from 7.8.0, fixed in 7.8.1. ### [CVE-2023-1775](https://cve.now/CVE-2023-1775): Unsanitized events sent over Websocket to regular users in a High Availability environment - Severity: Medium 4.3 - Published: Mar 31, 2023 - Affected: from 3.3.0, fixed in 7.1.6; from 7.7.0, fixed in 7.7.2; from 7.1.0, fixed in 7.1.6. ### [CVE-2023-1774](https://cve.now/CVE-2023-1774): Unauthorized email invite to a private channel - Severity: Medium 4.2 - Published: Mar 31, 2023 - Affected: from 3.3.0, fixed in 7.1.6; from 7.7.0, fixed in 7.7.2; from 7.1.0, fixed in 7.1.6. ### [CVE-2022-4045](https://cve.now/CVE-2022-4045): Authenticated user could send multiple requests containing a parameter which could fetch a large amount of data and can crash a Mattermost… - Severity: Low 3.1 - Published: Nov 23, 2022 - Affected: fixed in 7.1.4; from 7.2.0, fixed in 7.2.1; from 7.3.0, fixed in 7.3.1. ### [CVE-2022-4044](https://cve.now/CVE-2022-4044): Authenticated user could send multiple requests containing a large Auto Responder Message payload and can crash a Mattermost server - Severity: Medium 4.3 - Published: Nov 23, 2022 - Affected: fixed in 7.1.4; from 7.2.0, fixed in 7.2.1; from 7.3.0, fixed in 7.3.1. ### [CVE-2022-2401](https://cve.now/CVE-2022-2401): Team members could access sensitive information of other users via an API call - Severity: Medium 6.5 - Published: Jul 14, 2022 - Affected: all versions. ### [CVE-2022-1982](https://cve.now/CVE-2022-1982): A crafted SVG attachment can crash a Mattermost server - Severity: Medium 4.3 - Published: Jun 2, 2022 - Affected: from 6.6.0, fixed in 6.6.1; from 6.5.0, fixed in 6.5.1; from 6.4.0, fixed in 6.4.3; from 5.0.0, fixed in 6.3.8. ### [CVE-2022-1384](https://cve.now/CVE-2022-1384): Authorized users are allowed to install old plugin versions from the Marketplace - Severity: Medium 4.7 - Published: Apr 19, 2022 - Affected: all versions. ### [CVE-2022-1385](https://cve.now/CVE-2022-1385): Invitation Email is resent as a Reminder after invalidating pending email invites - Severity: Low 3.7 - Published: Apr 19, 2022 - Affected: all versions. ### [CVE-2022-1332](https://cve.now/CVE-2022-1332): Restricted custom admin role can bypass the restrictions and view the server logs and server config.json file contents - Severity: Medium 4.3 - Published: Apr 13, 2022 - Affected: all versions. ### [CVE-2022-1337](https://cve.now/CVE-2022-1337): OOM DoS in Mattermost image proxy - Severity: Medium 4.3 - Published: Apr 13, 2022 - Affected: all versions. ### [CVE-2021-37860](https://cve.now/CVE-2021-37860): Mattermost 5.38 and earlier fails to sufficiently sanitize clipboard contents, which allows a user-assisted attacker to inject arbitrary… - Severity: Low 3.7 - Published: Sep 22, 2021 - Affected: all versions. ### [CVE-2016-11084](https://cve.now/CVE-2016-11084): An issue was discovered in Mattermost Server before 2.1.0. - Severity: Unrated - Published: Jun 19, 2020 - Affected: fixed in 2.1.0+incompatible; fixed in 2.1.0. ### [CVE-2016-11083](https://cve.now/CVE-2016-11083): An issue was discovered in Mattermost Server before 2.2.0. - Severity: Unrated - Published: Jun 19, 2020 - Affected: fixed in 2.2.0+incompatible; fixed in 2.2.0. ### [CVE-2016-11082](https://cve.now/CVE-2016-11082): An issue was discovered in Mattermost Server before 2.2.0. - Severity: Unrated - Published: Jun 19, 2020 - Affected: fixed in 2.2.0+incompatible; fixed in 2.2.0. ### [CVE-2016-11081](https://cve.now/CVE-2016-11081): An issue was discovered in Mattermost Server before 2.2.0. - Severity: Unrated - Published: Jun 19, 2020 - Affected: fixed in 2.2.0+incompatible; fixed in 2.2.0. ### [CVE-2016-11080](https://cve.now/CVE-2016-11080): An issue was discovered in Mattermost Server before 3.0.0. - Severity: Unrated - Published: Jun 19, 2020 - Affected: fixed in 3.0.0; fixed in 3.0.0+incompatible. ### [CVE-2016-11079](https://cve.now/CVE-2016-11079): An issue was discovered in Mattermost Server before 3.0.0. - Severity: Unrated - Published: Jun 19, 2020 - Affected: fixed in 3.0.0+incompatible; fixed in 3.0.0. ### [CVE-2016-11078](https://cve.now/CVE-2016-11078): An issue was discovered in Mattermost Server before 3.0.0. - Severity: Unrated - Published: Jun 19, 2020 - Affected: fixed in 3.0.0; fixed in 3.0.0+incompatible. ### [CVE-2016-11077](https://cve.now/CVE-2016-11077): An issue was discovered in Mattermost Server before 3.0.0. - Severity: Unrated - Published: Jun 19, 2020 - Affected: fixed in 3.0.0; fixed in 3.0.0+incompatible. ### [CVE-2016-11076](https://cve.now/CVE-2016-11076): An issue was discovered in Mattermost Server before 3.0.0. - Severity: Unrated - Published: Jun 19, 2020 - Affected: fixed in 3.0.0; fixed in 3.0.0+incompatible. ### [CVE-2016-11075](https://cve.now/CVE-2016-11075): An issue was discovered in Mattermost Server before 3.0.0. - Severity: Unrated - Published: Jun 19, 2020 - Affected: fixed in 2.0.1-0.20160310160916-26ad6d2c7696; all versions. ### [CVE-2016-11074](https://cve.now/CVE-2016-11074): An issue was discovered in Mattermost Server before 3.0.0. - Severity: Unrated - Published: Jun 19, 2020 - Affected: fixed in 3.0.0+incompatible; fixed in 3.0.0. ### [CVE-2016-11073](https://cve.now/CVE-2016-11073): An issue was discovered in Mattermost Server before 3.0.0. - Severity: Unrated - Published: Jun 19, 2020 - Affected: fixed in 3.0.0+incompatible; fixed in 3.0.0. ### [CVE-2016-11072](https://cve.now/CVE-2016-11072): An issue was discovered in Mattermost Server before 3.0.2. - Severity: Unrated - Published: Jun 19, 2020 - Affected: fixed in 3.0.2+incompatible; fixed in 3.0.2. ### [CVE-2016-11071](https://cve.now/CVE-2016-11071): An issue was discovered in Mattermost Server before 3.1.0. - Severity: Unrated - Published: Jun 19, 2020 - Affected: fixed in 3.1.0+incompatible; fixed in 3.1.0. ### [CVE-2016-11070](https://cve.now/CVE-2016-11070): An issue was discovered in Mattermost Server before 3.1.0. - Severity: Unrated - Published: Jun 19, 2020 - Affected: fixed in 3.1.0; fixed in 3.1.0+incompatible. ### [CVE-2016-11069](https://cve.now/CVE-2016-11069): An issue was discovered in Mattermost Server before 3.2.0. - Severity: Unrated - Published: Jun 19, 2020 - Affected: fixed in 3.2.0; fixed in 3.2.0+incompatible. ### [CVE-2016-11068](https://cve.now/CVE-2016-11068): An issue was discovered in Mattermost Server before 3.2.0. - Severity: Unrated - Published: Jun 19, 2020 - Affected: fixed in 3.2.0+incompatible; fixed in 3.2.0. ### [CVE-2016-11067](https://cve.now/CVE-2016-11067): An issue was discovered in Mattermost Server before 3.2.0. - Severity: Unrated - Published: Jun 19, 2020 - Affected: fixed in 3.2.0; fixed in 3.2.0+incompatible. ### [CVE-2016-11066](https://cve.now/CVE-2016-11066): An issue was discovered in Mattermost Server before 3.2.0. - Severity: Unrated - Published: Jun 19, 2020 - Affected: all versions; fixed in 3.1.1. ### [CVE-2016-11063](https://cve.now/CVE-2016-11063): An issue was discovered in Mattermost Server before 3.5.1. - Severity: Unrated - Published: Jun 19, 2020 - Affected: fixed in 3.5.1+incompatible; fixed in 3.5.1. ### [CVE-2017-18918](https://cve.now/CVE-2017-18918): An issue was discovered in Mattermost Server before 3.7.3 and 3.6.5. - Severity: Unrated - Published: Jun 19, 2020 - Affected: fixed in 3.6.5+incompatible; from 3.7.0+incompatible, fixed in 3.7.3+incompatible; fixed in 3.6.5; from 3.7.0, fixed in 3.7.3. ### [CVE-2017-18907](https://cve.now/CVE-2017-18907): An issue was discovered in Mattermost Server before 4.0.0, 3.10.2, and 3.9.2. - Severity: Unrated - Published: Jun 19, 2020 - Affected: fixed in 3.9.2-0.20170714014920-312269ad0bd1; from 3.10.0, fixed in 3.10.2; from 3.10.0+incompatible, fixed in 3.10.2+incompatible. ### [CVE-2017-18916](https://cve.now/CVE-2017-18916): An issue was discovered in Mattermost Server before 3.8.2, 3.7.5, and 3.6.7. - Severity: Unrated - Published: Jun 19, 2020 - Affected: fixed in 3.6.7-0.20170420152529-0968e4079e0a; from 3.7.0, fixed in 3.7.5; from 3.8.0, fixed in 3.8.2; from 3.7.0+incompatible, fixed in 3.7.5+incompatible; from 3.8.0+incompatible, fixed in 3.8.2+incompatible. ### [CVE-2017-18917](https://cve.now/CVE-2017-18917): An issue was discovered in Mattermost Server before 3.8.2, 3.7.5, and 3.6.7. - Severity: Unrated - Published: Jun 19, 2020 - Affected: from 3.8.0+incompatible, fixed in 3.8.2+incompatible; fixed in 3.7.5-0.20170421192444-247cd1e51a8c; from 3.8.0, fixed in 3.8.2. ### [CVE-2017-18906](https://cve.now/CVE-2017-18906): An issue was discovered in Mattermost Server before 4.0.0, 3.10.2, and 3.9.2, when Single Sign-On OAuth2 is used. - Severity: Unrated - Published: Jun 19, 2020 - Affected: fixed in 3.9.2-0.20170714134023-b17fca0d5ee7; from 3.10.0, fixed in 3.10.2; from 3.10.0+incompatible, fixed in 3.10.2+incompatible. ### [CVE-2017-18905](https://cve.now/CVE-2017-18905): An issue was discovered in Mattermost Server before 4.0.0, 3.10.2, and 3.9.2, when used as an OAuth 2.0 service provider, Session… - Severity: Unrated - Published: Jun 19, 2020 - Affected: fixed in 3.9.2+incompatible; from 3.10.0+incompatible, fixed in 3.10.2+incompatible; fixed in 3.9.2; from 3.10.0, fixed in 3.10.2. ### [CVE-2017-18908](https://cve.now/CVE-2017-18908): An issue was discovered in Mattermost Server before 4.0.0, 3.10.2, and 3.9.2. - Severity: Unrated - Published: Jun 19, 2020 - Affected: fixed in 3.9.1-rc1; from 3.10.0, fixed in 3.10.1; fixed in 3.9.1-rc1+incompatible; from 3.10.0+incompatible, fixed in 3.10.1+incompatible. ### [CVE-2017-18915](https://cve.now/CVE-2017-18915): An issue was discovered in Mattermost Server before 3.8.2, 3.7.5, and 3.6.7. - Severity: Unrated - Published: Jun 19, 2020 - Affected: fixed in 3.6.7-0.20170420152529-0968e4079e0a; from 3.7.0, fixed in 3.7.5; from 3.8.0, fixed in 3.8.2; from 3.7.0+incompatible, fixed in 3.7.5+incompatible; from 3.8.0+incompatible, fixed in 3.8.2+incompatible. ### [CVE-2017-18909](https://cve.now/CVE-2017-18909): An issue was discovered in Mattermost Server before 3.9.0 when SAML is used. - Severity: Unrated - Published: Jun 19, 2020 - Affected: all versions; fixed in 3.8.1-0.20170504181128-4f074fed0d65. ### [CVE-2017-18911](https://cve.now/CVE-2017-18911): An issue was discovered in Mattermost Server before 3.8.2, 3.7.5, and 3.6.7. - Severity: Unrated - Published: Jun 19, 2020 - Affected: fixed in 3.6.7-rc1; from 3.7.0, fixed in 3.7.5; from 3.8.0, fixed in 3.8.2; fixed in 3.6.7-rc1+incompatible; from 3.7.0+incompatible, fixed in 3.7.5+incompatible; from 3.8.0+incompatible, fixed in 3.8.2+incompatible. ### [CVE-2017-18912](https://cve.now/CVE-2017-18912): An issue was discovered in Mattermost Server before 3.8.2, 3.7.5, and 3.6.7. - Severity: Unrated - Published: Jun 19, 2020 - Affected: all versions; fixed in 3.7.4-0.20170404171331-0b5c0794fdcb. ### [CVE-2017-18904](https://cve.now/CVE-2017-18904): An issue was discovered in Mattermost Server before 4.0.0, 3.10.2, and 3.9.2. - Severity: Unrated - Published: Jun 19, 2020 - Affected: fixed in 3.9.2+incompatible; from 3.10.0+incompatible, fixed in 3.10.2+incompatible; fixed in 3.9.2; from 3.10.0, fixed in 3.10.2. ### [CVE-2017-18903](https://cve.now/CVE-2017-18903): An issue was discovered in Mattermost Server before 4.0.0, 3.10.2, and 3.9.2. - Severity: Unrated - Published: Jun 19, 2020 - Affected: fixed in 3.9.2+incompatible; from 3.10.0+incompatible, fixed in 3.10.2+incompatible; fixed in 3.9.2; from 3.10.0-rc1, fixed in 3.10.2. ### [CVE-2017-18902](https://cve.now/CVE-2017-18902): An issue was discovered in Mattermost Server before 4.1.0, 4.0.4, and 3.10.3. - Severity: Unrated - Published: Jun 19, 2020 - Affected: fixed in 3.10.3; from 4.0.0, fixed in 4.0.4; from 4.0.5-rc1, fixed in 4.1.0; fixed in 3.10.3+incompatible; from 4.0.0+incompatible, fixed in 4.0.4+incompatible; from 4.0.5-rc1+incompatible, fixed in 4.1.0+incompatible. ### [CVE-2017-18898](https://cve.now/CVE-2017-18898): An issue was discovered in Mattermost Server before 4.2.0, 4.1.1, and 4.0.5. - Severity: Unrated - Published: Jun 19, 2020 - Affected: fixed in 4.0.5; from 4.1.0, fixed in 4.1.1; from 4.2.0-rc1, fixed in 4.2.0; fixed in 4.0.5+incompatible; from 4.1.0+incompatible, fixed in 4.1.1+incompatible; from 4.2.0-rc1+incompatible, fixed in 4.2.0+incompatible. ### [CVE-2017-18900](https://cve.now/CVE-2017-18900): An issue was discovered in Mattermost Server before 4.1.0, 4.0.4, and 3.10.3. - Severity: Unrated - Published: Jun 19, 2020 - Affected: fixed in 3.10.3+incompatible; from 4.0.0+incompatible, fixed in 4.0.3+incompatible; fixed in 3.10.3; from 4.0.0, fixed in 4.0.3. ### [CVE-2017-18886](https://cve.now/CVE-2017-18886): An issue was discovered in Mattermost Server before 4.3.0, 4.2.1, and 4.1.2. - Severity: Unrated - Published: Jun 19, 2020 - Affected: fixed in 4.1.2; from 4.2.0-rc1, fixed in 4.2.1; from 4.3.0-rc1, fixed in 4.3.0; fixed in 4.1.2+incompatible; from 4.2.0-rc1+incompatible, fixed in 4.2.1+incompatible; from 4.3.0-rc1+incompatible, fixed in 4.3.0+incompatible. ### [CVE-2017-18895](https://cve.now/CVE-2017-18895): An issue was discovered in Mattermost Server before 4.2.0, 4.1.1, and 4.0.5. - Severity: Unrated - Published: Jun 19, 2020 - Affected: fixed in 4.0.5; from 4.1.0, fixed in 4.1.1; from 4.2.0-rc1, fixed in 4.2.0; fixed in 4.0.5+incompatible; from 4.1.0+incompatible, fixed in 4.1.1+incompatible; from 4.2.0-rc1+incompatible, fixed in 4.2.0+incompatible. ### [CVE-2017-18887](https://cve.now/CVE-2017-18887): An issue was discovered in Mattermost Server before 4.3.0, 4.2.1, and 4.1.2. - Severity: Unrated - Published: Jun 19, 2020 - Affected: fixed in 4.1.2+incompatible; from 4.2.0-rc1+incompatible, fixed in 4.2.1+incompatible; from 4.3.0-rc1+incompatible, fixed in 4.3.0+incompatible; fixed in 4.1.2; from 4.2.0-rc1, fixed in 4.2.1; from 4.3.0-rc1, fixed in 4.3.0. ### [CVE-2017-18888](https://cve.now/CVE-2017-18888): An issue was discovered in Mattermost Server before 4.3.0, 4.2.1, and 4.1.2. - Severity: Unrated - Published: Jun 19, 2020 - Affected: fixed in 4.1.2+incompatible; from 4.2.0-rc1+incompatible, fixed in 4.2.1+incompatible; from 4.3.0-rc1+incompatible, fixed in 4.3.0+incompatible; fixed in 4.1.2; from 4.2.0-rc1, fixed in 4.2.1; from 4.3.0-rc1, fixed in 4.3.0. ### [CVE-2017-18893](https://cve.now/CVE-2017-18893): An issue was discovered in Mattermost Server before 4.2.0, 4.1.1, and 4.0.5. - Severity: Unrated - Published: Jun 19, 2020 - Affected: fixed in 4.0.5+incompatible; from 4.1.0+incompatible, fixed in 4.1.1+incompatible; from 4.2.0-rc1+incompatible, fixed in 4.2.0+incompatible; fixed in 4.0.5; from 4.1.0, fixed in 4.1.1; from 4.2.0-rc1, fixed in 4.2.0. ### [CVE-2017-18894](https://cve.now/CVE-2017-18894): An issue was discovered in Mattermost Server before 4.2.0, 4.1.1, and 4.0.5, when used as an OAuth 2.0 service provider. - Severity: Unrated - Published: Jun 19, 2020 - Affected: fixed in 4.0.5+incompatible; from 4.1.0+incompatible, fixed in 4.1.1+incompatible; from 4.2.0-rc1+incompatible, fixed in 4.2.0+incompatible; fixed in 4.0.5; from 4.1.0, fixed in 4.1.1; from 4.2.0-rc1, fixed in 4.2.0. ### [CVE-2017-18896](https://cve.now/CVE-2017-18896): An issue was discovered in Mattermost Server before 4.2.0, 4.1.1, and 4.0.5. - Severity: Unrated - Published: Jun 19, 2020 - Affected: from 4.1.0, fixed in 4.1.1; fixed in 4.0.5; from 4.2.0-rc1, fixed in 4.2.0; fixed in 4.0.5+incompatible; from 4.1.0+incompatible, fixed in 4.1.1+incompatible; from 4.2.0-rc1+incompatible, fixed in 4.2.0+incompatible. ### [CVE-2017-18897](https://cve.now/CVE-2017-18897): An issue was discovered in Mattermost Server before 4.2.0, 4.1.1, and 4.0.5, when used as an OAuth 2.0 service provider. - Severity: Unrated - Published: Jun 19, 2020 - Affected: fixed in 4.0.5; from 4.1.0, fixed in 4.1.1; from 4.2.0-rc1, fixed in 4.2.0; fixed in 4.0.5+incompatible; from 4.1.0+incompatible, fixed in 4.1.1+incompatible; from 4.2.0-rc1+incompatible, fixed in 4.2.0+incompatible. ### [CVE-2017-18885](https://cve.now/CVE-2017-18885): An issue was discovered in Mattermost Server before 4.3.0, 4.2.1, and 4.1.2. - Severity: Unrated - Published: Jun 19, 2020 - Affected: fixed in 4.1.2+incompatible; from 4.2.0-rc1+incompatible, fixed in 4.2.1+incompatible; from 4.3.0-rc1+incompatible, fixed in 4.3.0+incompatible; fixed in 4.1.2; from 4.2.0-rc1, fixed in 4.2.1; from 4.3.0-rc1, fixed in 4.3.0. ### [CVE-2017-18901](https://cve.now/CVE-2017-18901): An issue was discovered in Mattermost Server before 4.1.0, 4.0.4, and 3.10.3. - Severity: Unrated - Published: Jun 19, 2020 - Affected: all versions; fixed in 3.10.3; from 4.0.0, fixed in 4.0.4. ### [CVE-2017-18889](https://cve.now/CVE-2017-18889): An issue was discovered in Mattermost Server before 4.3.0, 4.2.1, and 4.1.2. - Severity: Unrated - Published: Jun 19, 2020 - Affected: fixed in 4.1.2; from 4.2.0-rc1, fixed in 4.2.1; from 4.3.0-rc1, fixed in 4.3.0; fixed in 4.1.2+incompatible; from 4.2.0-rc1+incompatible, fixed in 4.2.1+incompatible; from 4.3.0-rc1+incompatible, fixed in 4.3.0+incompatible. ### [CVE-2017-18890](https://cve.now/CVE-2017-18890): An issue was discovered in Mattermost Server before 4.3.0, 4.2.1, and 4.1.2. - Severity: Unrated - Published: Jun 19, 2020 - Affected: fixed in 4.1.2+incompatible; from 4.2.0-rc1+incompatible, fixed in 4.2.1+incompatible; from 4.3.0-rc1+incompatible, fixed in 4.3.0+incompatible; fixed in 4.1.2; from 4.2.0-rc1, fixed in 4.2.1; from 4.3.0-rc1, fixed in 4.3.0. ### [CVE-2017-18892](https://cve.now/CVE-2017-18892): An issue was discovered in Mattermost Server before 4.2.0, 4.1.1, and 4.0.5. - Severity: Unrated - Published: Jun 19, 2020 - Affected: fixed in 4.0.5; from 4.1.0, fixed in 4.1.1; from 4.2.0-rc1, fixed in 4.2.0; fixed in 4.0.5+incompatible; from 4.1.0+incompatible, fixed in 4.1.1+incompatible; from 4.2.0-rc1+incompatible, fixed in 4.2.0+incompatible. ### [CVE-2017-18891](https://cve.now/CVE-2017-18891): An issue was discovered in Mattermost Server before 4.2.0, 4.1.1, and 4.0.5. - Severity: Unrated - Published: Jun 19, 2020 - Affected: fixed in 4.0.5; from 4.1.0, fixed in 4.1.1; from 4.2.0-rc1, fixed in 4.2.0; fixed in 4.0.5+incompatible; from 4.1.0+incompatible, fixed in 4.1.1+incompatible; from 4.2.0-rc1+incompatible, fixed in 4.2.0+incompatible. ### [CVE-2017-18884](https://cve.now/CVE-2017-18884): An issue was discovered in Mattermost Server before 4.3.0, 4.2.1, and 4.1.2. - Severity: Unrated - Published: Jun 19, 2020 - Affected: fixed in 4.1.2+incompatible; from 4.2.0-rc1+incompatible, fixed in 4.2.1+incompatible; from 4.3.0-rc1+incompatible, fixed in 4.3.0+incompatible; fixed in 4.1.2; from 4.2.0-rc1, fixed in 4.2.1; from 4.3.0-rc1, fixed in 4.3.0. ### [CVE-2017-18883](https://cve.now/CVE-2017-18883): An issue was discovered in Mattermost Server before 4.3.0, 4.2.1, and 4.1.2, when serving as an OAuth 2.0 Service Provider. - Severity: Unrated - Published: Jun 19, 2020 - Affected: fixed in 4.1.2+incompatible; from 4.2.0-rc1+incompatible, fixed in 4.2.1+incompatible; from 4.3.0-rc1+incompatible, fixed in 4.3.0+incompatible; fixed in 4.1.2; from 4.2.0-rc1, fixed in 4.2.1; from 4.3.0-rc1, fixed in 4.3.0. ### [CVE-2017-18879](https://cve.now/CVE-2017-18879): An issue was discovered in Mattermost Server before 4.3.0, 4.2.1, and 4.1.2. - Severity: Unrated - Published: Jun 19, 2020 - Affected: fixed in 4.1.2+incompatible; from 4.2.0+incompatible, fixed in 4.2.1+incompatible; from 4.3.0-rc1+incompatible, fixed in 4.3.0+incompatible; fixed in 4.1.2; from 4.2.0, fixed in 4.2.1; from 4.3.0-rc1, fixed in 4.3.0. ### [CVE-2017-18878](https://cve.now/CVE-2017-18878): An issue was discovered in Mattermost Server before 4.3.0, 4.2.1, and 4.1.2. - Severity: Unrated - Published: Jun 19, 2020 - Affected: from 4.3.0-rc1+incompatible, fixed in 4.3.0+incompatible; fixed in 4.1.2-0.20171004201910-6be8113eb60c; from 4.2.0-rc1, fixed in 4.2.1-0.20171004192657-8fbbd688ea24; from 4.3.0-rc1, fixed in 4.3.0. ### [CVE-2017-18874](https://cve.now/CVE-2017-18874): An issue was discovered in Mattermost Server before 4.3.0, 4.2.1, and 4.1.2 when local storage for files is used. - Severity: Unrated - Published: Jun 19, 2020 - Affected: from 4.2.0-rc1+incompatible, fixed in 4.2.0+incompatible; from 4.3.0-rc1+incompatible, fixed in 4.3.0+incompatible; fixed in 4.1.2-0.20171004201910-6be8113eb60; from 4.2.0-rc1, fixed in 4.2.1-0.20171004194140-6d3cb2ce07fc; from 4.3.0-rc1, fixed in 4.3.0. ### [CVE-2017-18873](https://cve.now/CVE-2017-18873): An issue was discovered in Mattermost Server before 4.3.0, 4.2.1, and 4.1.2. - Severity: Unrated - Published: Jun 19, 2020 - Affected: fixed in 4.1.2-0.20171013141717-ee57a5829ab1; from 4.2.0, fixed in 4.2.1-0.20171013140502-b3e4b0ac9168; from 4.3.0-rc1, fixed in 4.3.0; fixed in 4.1.2-0.20171013141717-ee57a5829ab1+incompatible; from 4.2.0+incompatible, fixed in 4.2.1-0.20171013140502-b3e4b0ac9168+incompatible; from 4.3.0-rc1+incompatible, fixed in 4.3.0+incompatible. ### [CVE-2017-18872](https://cve.now/CVE-2017-18872): An issue was discovered in Mattermost Server before 4.4.3 and 4.3.3. - Severity: Unrated - Published: Jun 19, 2020 - Affected: fixed in 4.3.3+incompatible; from 4.4.0-rc1+incompatible, fixed in 4.4.3+incompatible; fixed in 4.3.3; from 4.4.0-rc1, fixed in 4.4.3. ### [CVE-2017-18871](https://cve.now/CVE-2017-18871): An issue was discovered in Mattermost Server before 4.5.0, 4.4.5, 4.3.4, and 4.2.2. - Severity: Unrated - Published: Jun 19, 2020 - Affected: fixed in 4.2.2+incompatible; from 4.3.0-rc1+incompatible, fixed in 4.3.4+incompatible; from 4.4.0-rc1+incompatible, fixed in 4.4.5+incompatible; from 4.5.0-rc1+incompatible, fixed in 4.5.0+incompatible; fixed in 4.2.2; from 4.3.0-rc1, fixed in 4.3.4; from 4.4.0-rc1, fixed in 4.4.5; from 4.5.0-rc1, fixed in 4.5.0. ### [CVE-2017-18877](https://cve.now/CVE-2017-18877): An issue was discovered in Mattermost Server before 4.3.0, 4.2.1, and 4.1.2. - Severity: Unrated - Published: Jun 19, 2020 - Affected: fixed in 4.1.2; from 4.2.0, fixed in 4.2.1; from 4.3.0-rc1, fixed in 4.3.0; fixed in 4.1.2+incompatible; from 4.2.0+incompatible, fixed in 4.2.1+incompatible; from 4.3.0-rc1+incompatible, fixed in 4.3.0+incompatible. ### [CVE-2017-18876](https://cve.now/CVE-2017-18876): An issue was discovered in Mattermost Server before 4.3.0, 4.2.1, and 4.1.2 when local storage for files is used. - Severity: Unrated - Published: Jun 19, 2020 - Affected: fixed in 4.1.2-0.20171004201910-6be8113eb60c; from 4.2.0-rc1.0.20171004154238-fadd9514f6e7, fixed in 4.2.1-0.20171004194140-6d3cb2ce07fc; from 4.3.0-rc1, fixed in 4.3.0; from 4.3.0-rc1+incompatible, fixed in 4.3.0+incompatible. ### [CVE-2017-18875](https://cve.now/CVE-2017-18875): An issue was discovered in Mattermost Server before 4.3.0, 4.2.1, and 4.1.2 when local storage for files is used. - Severity: Unrated - Published: Jun 19, 2020 - Affected: fixed in 4.1.2-0.20171004201910-6be8113eb60c; from 4.2.0-rc1.0.20171004154238-fadd9514f6e7, fixed in 4.2.1-0.20171004194140-6d3cb2ce07fc; from 4.3.0-rc1, fixed in 4.3.0; from 4.3.0-rc1+incompatible, fixed in 4.3.0+incompatible. ### [CVE-2017-18870](https://cve.now/CVE-2017-18870): An issue was discovered in Mattermost Server before 4.5.0, 4.4.5, and 4.3.4. - Severity: Unrated - Published: Jun 19, 2020 - Affected: all versions. ### [CVE-2018-21258](https://cve.now/CVE-2018-21258): An issue was discovered in Mattermost Server before 5.1. - Severity: Unrated - Published: Jun 19, 2020 - Affected: all versions; fixed in 5.1.0. ### [CVE-2020-14457](https://cve.now/CVE-2020-14457): An issue was discovered in Mattermost Server before 5.20.0. - Severity: Unrated - Published: Jun 19, 2020 - Affected: all versions. --- Source: cve.now Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards. Page: https://cve.now/packages/go/github.com/mattermost/mattermost-server Site guide for agents: https://cve.now/llms.txt Uses NVD data; not endorsed by NVD.