Skip to main content
cve.nowby Sazabi
← Go
GoPackage

github.com/mattermost/mattermost-server/v5

199 known vulnerabilities (5 critical, 16 high, 123 medium, 53 low), with the versions each affects and the releases that fix them.

Latest release
Not known: cve.now hasn't read this package's releases
Newest unaffected release
Not known without release data
Advisories
199 · 5 critical, 16 high, 123 medium, 53 low
Registry
pkg.go.dev

Advisories 199

  • User Manager can demote bot accounts to guest without bot-management permission

    Affected: all versions.

  • CVE-2026-6961: Path traversal via unsanitized FileInfo.Name in Mattermost federation sync

    Affected: all versions.

  • Mattermost group syncable endpoints allow privilege escalation via scheme_admin

    Affected: all versions.

  • CVE-2026-6046Medium 5.3

    Plugin bot username conflict allows user account to be used as bot identity in Mattermost Server

    Affected: all versions.

  • CVE-2026-6689Medium 4.3

    Missing {{invite_user}} permission check on team creation allows unprivileged users to set open-invite and allowed-domains team settings

    Affected: all versions.

  • CVE-2026-7184Medium 6.5

    Mattermost Remote Cluster PATCH API Leaks Authentication Tokens

    Affected: all versions.

  • CVE-2026-6739Medium 6.7

    Mattermost: Delegated admins could patch protected default system roles

    Affected: all versions.

  • CVE-2026-3433Medium 4.3

    Mattermost fails to scope role_updated websocket events to authorized team and channel members

    Affected: all versions.

  • CVE-2026-4915Medium 6.5

    Server panic via outgoing webhook responses

    Affected: all versions.

  • Unauthenticated WebSocket binary frame causes denial of service in Mattermost Server

    Affected: all versions.

  • CVE-2026-4055Medium 4.3

    Insufficient permission validation on cross-team playbook run creation

    Affected: all versions.

  • SSRF via Host Header Spoofing in Custom Slash Commands

    Affected: all versions.

  • CVE-2026-6345Medium 6.5

    Prevent password disclosure and force reset during Slack import

    Affected: all versions.

  • Sensitive credentials exposed in plaintext in Mattermost support packets

    Affected: all versions.

  • CVE-2026-28732Medium 4.3

    Slash command trigger-word update allowed command hijacking

    Affected: all versions.

Show all 199 advisoriesShow fewer advisories
  • CVE-2026-6343Medium 4.3

    Mattermost Playbooks Plugin fails to enforce view permissions in list endpoints, allowing unauthorized access to public playbooks

    Affected: all versions.

  • CVE-2026-5163Medium 6.5

    Missing authorization check in AI message rewrite endpoint allows access to private thread content

    Affected: all versions.

  • Playbooks Plugin fails to validate team transfers, allowing unauthorized removal of member access via playbook update

    Affected: all versions.

  • CVE-2026-6339Medium 4.3

    Missing request origin validation on burn-on-read reveal endpoint

    Affected: all versions.

  • CVE-2026-6340Medium 4.3

    Memory Exhaustion via Malicious 7zip File Upload

    Affected: all versions.

  • Unescaped variables during error page composition

    Affected: all versions.

  • Insufficient token rotation validation in remote cluster invite confirmation

    Affected: all versions.

  • CVE-2026-3637Medium 4.3

    Mattermost fails to enforce create_post permission when editing posts

    Affected: all versions.

  • CVE-2026-28759Medium 4.3

    Insufficient authorization in shared channel membership sync allows remote cluster to remove users from arbitrary channels

    Affected: all versions.

  • OAuth authorization code client binding not enforced during token redemption in Mattermost

    Affected: all versions.

  • CVE-2026-3590Medium 6.5

    Race Condition in Guest Magic Link Authentication Allows Token Reuse

    Affected: all versions.

  • CVE-2026-28741Medium 6.8

    CSRF Protection Bypass Allows Updating a User's Authentication Method

    Affected: all versions.

  • CVE-2026-3112Medium 6.8

    Arbitrary File Read via Advanced Logging Support Packet

    Affected: all versions.

  • CVE-2026-3115Medium 4.3

    Guest users can view group member IDs without respecting view restrictions

    Affected: all versions.

  • CVE-2026-3114Medium 6.5

    Zip Bomb Denial of Service via Unrestricted Archive Decompression

    Affected: all versions.

  • Terminal Escape Injection in mmctl Report Posts Command

    Affected: all versions.

  • CVE-2026-4274Medium 5.4

    Insufficient authorization in shared channel membership sync grants team-level access instead of channel-level access

    Affected: all versions.

  • CVE-2026-27659Medium 4.6

    CSRF vulnerability in UpdateAccessControlPolicyActiveStatus endpoint

    Affected: all versions.

  • CVE-2026-20719Medium 4.3

    DoS via URL Previews Rendering Malicious SVGs

    Affected: all versions.

  • CVE-2026-27656Medium 5.7

    Account Takeover via Substring Matching in OpenID Connect Authentication

    Affected: all versions.

  • CVE-2026-24692Medium 4.3

    Guest users can bypass read permissions via search API

    Affected: all versions.

  • Password Change Bypass via Auth Switch Endpoint

    Affected: all versions.

  • CVE-2026-2455Medium 4.3

    SSRF bypass via IPv4-mapped IPv6 literals

    Affected: all versions.

  • CVE-2026-21386Medium 4.3

    Private channel enumeration via /mute slash command

    Affected: all versions.

  • CVE-2026-25780Medium 4.3

    Memory Exhaustion via Malformed DOC File Upload

    Affected: all versions.

  • CVE-2026-4265Medium 4.3

    Guest user can upload files without permission across teams

    Affected: all versions.

  • CVE-2026-25783Medium 4.3

    Denial of service via malformed User-Agent header in getBrowserVersion

    Affected: all versions.

  • DoS attack via login attempts with multi-megabyte passwords

    Affected: all versions.

  • CVE-2026-2578Medium 4.3

    Information Disclosure via WebSocket Event When Deleting Unrevealed Burn on Read Posts

    Affected: all versions.

  • CVE-2026-26246Medium 4.3

    Memory Exhaustion via Malformed PSD File Upload

    Affected: all versions.

  • CVE-2026-2458Medium 4.3

    Unauthorized channel enumeration in private teams after member removal

    Affected: all versions.

  • CVE-2026-2457Medium 4.3

    WebSocket Message Spoofing via Permalink Embed Manipulation

    Affected: all versions.

  • CVE-2026-2463Medium 4.3

    Unauthorized access to invite ID during team creation

    Affected: all versions.

  • CVE-2026-2456Medium 5.3

    Denial of Service via Unbounded Memory Allocation in Integration Actions

    Affected: all versions.

  • Team Admin Bypass of Invite Permissions via allow_open_invite Field

    Affected: all versions.

  • CVE-2025-14350Medium 4.3

    Information disclosure via channel mentions in posts

    Affected: all versions.

  • CVE-2025-13821Medium 5.7

    User profile update exposes password hash and MFA secrets

    Affected: all versions.

  • CVE-2026-0999Medium 5.4

    Authentication bypass via userID login when email and username login are disabled

    Affected: all versions.

  • CVE-2025-64641Medium 4.1

    Mattermost Jira plugin crafted action leaks Jira issue details

    Affected: all versions.

  • CVE-2025-13767Medium 4.3

    Unauthorized Read Access to Private Channel Posts via Mattermost Jira Plugin

    Affected: all versions.

  • Mattermost Jira plugin user spoofing enables Jira request forgery.

    Affected: all versions.

  • Lack of Invalidation of Legacy Remote Cluster Invite Tokens After Confirmation

    Affected: all versions.

  • Open redirect in error page when link opened in new tab

    Affected: all versions.

  • Mattermost GitHub Plugin allows unauthorized GitHub reactions via reaction forwarding hijacking

    Affected: all versions.

  • Unauthorized access and subscription vulnerability in Boards

    Affected: all versions.

  • CVE-2025-12756Medium 4.3

    Insecure Direct Object Reference in Mattermost Boards Plugin Enables Unauthorised Comment Deletion

    Affected: all versions.

  • CVE-2025-12421Critical 9.9

    Account Takeover via Code Exchange Endpoint

    Affected: all versions.

  • CVE-2025-12559Medium 4.3

    Information Disclosure in Common Teams API

    Affected: all versions.

  • CVE-2025-12419Critical 9.9

    Account takeover on OAuth/OpenID-enabled servers

    Affected: all versions.

  • Channel member objects leak read status

    Affected: all versions.

  • CVE-2025-11794Medium 4.9

    Password hash and MFA secret returned in user email verification endpoint

    Affected: all versions.

  • CVE-2025-55073Medium 5.4

    MS Teams plugin OAuth allows editing arbitrary posts

    Affected: all versions.

  • CVE-2025-55070Medium 6.5

    Lack of MFA enforcement in WebSocket connections

    Affected: all versions.

  • Unauthorized access to archived channel content via threads interface

    Affected: all versions.

  • CVE-2025-11776Medium 4.3

    Guest user can discover archived public channels

    Affected: all versions; fixed in 5.3.2-0.20250815165020-c8d66301415d.

  • Cross-team channel membership access

    Affected: all versions; fixed in 5.3.2-0.20250905150616-ba86dfc5876b.

  • Arbitrary Mattermost Team can be joined by manipulating the OAuth state

    Affected: all versions.

  • CVE-2025-41410Medium 5.4

    Slack import bypasses email verification for team access controls

    Affected: all versions.

  • Guest user can add unauthorized team users to private channels

    Affected: all versions.

  • Arbitrary Mattermost Team can be joined by manipulating the SAML RelayState

    Affected: all versions.

  • Insecure string comparison enables timing attacks

    Affected: all versions.

  • IDOR in board file download allows any user to download any file by UUID

    Affected: all versions.

  • Admin RCE via prepackaged plugins by way of misconfigured imports directory

    Affected: all versions.

  • One-Click Mattermost Account Takeover via Poisoned RelayState SAML Parameter

    Affected: all versions.

  • Open redirect in OAuth login

    Affected: all versions.

  • CVE-2025-9078Medium 4.3

    Weak cache keys lead to post IDOR and link preview poisoning

    Affected: all versions.

  • CVE-2025-9076Medium 6.5

    Mattermost Server exposes sensitive user credentials during shared channel membership synchronization

    Affected: all versions.

  • CVE-2025-8402Medium 4.9

    Nil pointer dereference in bulk import crashes server

    Affected: all versions; through 5.39.3.

  • CVE-2025-6465Medium 4.3

    Path traversal in image upload with preview overwrite

    Affected: all versions.

  • CVE-2025-47870Medium 4.3

    Team invite ID leaked to team admin with no member invite privileges

    Affected: all versions; through 5.39.3.

  • CVE-2025-49222Medium 6.8

    Mattermost Shared Channel Upload Type Validation Bypass

    Affected: all versions; through 5.39.3.

  • CVE-2025-8023Medium 6.8

    Path Traversal in Template Upload Allows Uploading Files Outside Target Directory

    Affected: all versions; through 5.39.5.

  • Channel and Team Membership APIs inadvertently allow loss of Member privileges.

    Affected: through 5.39.3; all versions.

  • AI plugin APIs can be triggered using post actions

    Affected: all versions.

  • Thread summarization allows persistent access to channel

    Affected: all versions.

  • CVE-2025-36530Medium 6.8

    Import Path Traversal Enables Unauthorized Unsigned Plugin Installation

    Affected: through 5.11.1; all versions.

  • Invite token is used as part of the secure communication

    Affected: all versions.

  • CVE-2025-6233Medium 6.8

    Arbitrary file read by system admin via path traversal

    Affected: all versions.

  • CVE-2025-6226Medium 6.5

    IDOR in CreatePost API allows for timeboxed message disclosure

    Affected: all versions.

  • CVE-2025-47871Medium 4.3

    Mattermost Playbooks exposes private channel metadata to unauthorized users via run metadata API

    Affected: all versions.

  • CVE-2025-46702Medium 5.4

    Mattermost Playbooks allows privilege escalation through improper access control in playbook run participant management

    Affected: all versions.

  • CVE-2025-3228Medium 4.3

    Unauthorized Guest user access to Playbook

    Affected: all versions.

  • CVE-2025-3227Medium 4.3

    Unauthorized channel member management through playbook runs

    Affected: all versions.

  • CVE-2025-4981Critical 9.9

    Path Traversal Leading to RCE by Any Authenticated Mattermost User

    Affected: all versions.

  • Mattermost Guest User Information Disclosure Vulnerability

    Affected: all versions.

  • CVE-2025-4573Medium 4.1

    LDAP Injection in Mattermost Enterprise Edition When Using Active Directory

    Affected: all versions.

  • Improper Access Control in Mattermost allows System Managers to view team details despite role restrictions

    Affected: all versions.

  • CVE-2025-3230Medium 5.4

    Bypass of System Admin User Deactivation Controls for Personal Access Tokens in Mattermost Server

    Affected: all versions.

  • CVE-2025-2571Medium 4.2

    Google OAuth Authentication Bypass for Converted Bot Accounts

    Affected: all versions.

  • Improper Access Control in Mattermost Channel Member API

    Affected: all versions.

  • CVE-2025-3913Medium 5.3

    Team Privacy Settings Authorization Bypass in Mattermost Server

    Affected: all versions.

  • System Admin Cannot Access Environment settings in System Console While System Manager Can

    Affected: all versions.

  • CVE-2025-2527Medium 4.3

    Improper access control to group information

    Affected: all versions.

  • CVE-2025-3446Medium 4.3

    Members Without Guest Invite Permissions Can Add Guests to Teams

    Affected: all versions.

  • CVE-2025-31947Medium 5.8

    Repeated LDAP login failures can lock an LDAP account

    Affected: all versions.

  • Unauthorized Playbooks Post Deletion in Mattermost Playbooks Plugin

    Affected: all versions.

  • CVE-2025-35965Medium 6.5

    DoS in Mattermost Playbooks via Excessive Task Actions

    Affected: all versions.

  • CVE-2025-41395Medium 6.5

    Webapp DoS via malicious retrospective post in Playbooks

    Affected: all versions.

  • CVE-2025-2564Medium 4.3

    Unauthorized View Access to Archived Channel Member Info

    Affected: all versions.

  • CVE-2025-27936Medium 5.3

    Webhook Secret Exposure via Timing attack in MSteams plugin

    Affected: all versions.

  • Data exfiltration via AI plugin Jira tool

    Affected: all versions.

  • CVE-2025-27571Medium 4.3

    Channel metadata visible in archived channels despite configuration setting

    Affected: all versions.

  • MFA Enforcement Bypass Allows Unauthorized Removal of MFA for Other Users

    Affected: all versions.

  • Unauthorized AI bot activation via Wrangler plugin

    Affected: all versions.

  • CVE-2025-2475Medium 5.4

    Unauthorized Bot Login Using Credentials

    Affected: all versions.

  • Leaked Metadata of Deleted Files via Bookmark Creation

    Affected: all versions.

  • CVE-2025-32093Medium 4.7

    Syatem admin profile modification by delegated granular administration role

    Affected: all versions.

  • Unauthorized Access to User Activity Logs API by delegated granular administration roles

    Affected: all versions.

  • Bypassing MFA Enforcement on Plugin Endpoints

    Affected: all versions.

  • CVE-2025-24920Medium 4.3

    Unauthorized Bookmark Creation and Modification in Archived Channels

    Affected: all versions.

  • CVE-2025-30179Medium 4.3

    MFA Enforcement Bypass in Search APIs

    Affected: all versions.

  • CVE-2025-25274Medium 4.3

    Unauthorized Command Execution in Archived Channels

    Affected: all versions.

  • CVE-2025-27933Medium 5.4

    Unauthorized Private-to-Public Channel Conversion

    Affected: all versions.

  • Auto-Enrollment of Team Admins into Private Channels without explicit consent

    Affected: all versions.

  • CVE-2025-1472Medium 4.3

    Unauthorized View Access to Site Statistics and Team Statistics

    Affected: all versions.

  • CVE-2025-20051Critical 9.9

    Arbitrary file read via block duplication in Mattermost Boards

    Affected: all versions.

  • CVE-2025-25279Critical 9.9

    Arbitrary file read in Mattermost Boards via import & export board archive

    Affected: all versions.

  • Session Persistence After User-to-Bot Conversion

    Affected: all versions.

  • CVE-2025-24526Medium 4.3

    Channel export permitted on archived channel when viewing archived channels is disabled

    Affected: all versions.

  • CVE-2025-20621Medium 6.5

    Webapp crash via object that can't be cast to String in Attachment Field

    Affected: all versions.

  • CVE-2025-20088Medium 6.5

    Insufficient Input Validation on Post Props

    Affected: all versions.

  • CVE-2025-20086Medium 6.5

    Insufficient Input Validation on Post Props

    Affected: all versions.

  • CVE-2025-21088Medium 6.5

    WebApp crash via improper validation of proto style in attachments

    Affected: all versions.

  • Misleading UI for undefined admin console settings in Calls causes security confusion

    Affected: all versions.

  • CVE-2025-20033Medium 4.3

    DoS via custom post type for sysconsole plugin readers

    Affected: all versions.

  • Access control flaw for team admins allows unauthorized team additions

    Affected: all versions.

  • CVE-2024-54682Medium 6.5

    Zipbomb DoS via Missing Slack Import Validation

    Affected: all versions.

  • CVE-2024-54083Medium 6.5

    DoS via lack of type validation in Calls

    Affected: all versions.

  • CVE-2024-48872Medium 4.8

    Bypass of "Max failed attempts" restriction via race condition

    Affected: all versions.

  • CVE-2024-46872Medium 4.6

    Client-Side Path Traversal Leading to CSRF in Playbooks

    Affected: all versions.

  • CVE-2024-47401Medium 4.3

    DoS via Amplified GraphQL Response in Playbooks

    Affected: all versions.

  • CVE-2024-50052Medium 4.3

    Arbitrary post deletion via Playbooks /ignore-thread endpoint

    Affected: all versions.

  • CVE-2024-10241Medium 4.3

    Private channel names leaked with Ctrl+K when ElasticSearch is enabled

    Affected: all versions.

  • Incorrect Session Creation with Desktop SSO

    Affected: all versions.

  • DoS via non-string message using permalink embed

    Affected: all versions.

  • CVE-2024-43780Medium 4.3

    Unauthorized channel file upload

    Affected: all versions.

  • CVE-2024-42497Medium 6.0

    Insufficient permissions checks on teams

    Affected: all versions.

  • Unauthorized disabling of invite URL

    Affected: all versions.

  • CVE-2024-8071Medium 4.7

    System Role with edit access to permissions can elevate themselves to system admin

    Affected: all versions.

  • CVE-2024-40886Medium 4.6

    One-click Client-Side Path Traversal Leading to CSRF in User Management admin page

    Affected: all versions.

  • CVE-2024-32939Medium 4.3

    Email addresses of remote users visible in props regardless of server settings

    Affected: all versions.

  • CVE-2024-39836Medium 4.8

    Munged email address used for password resets and notifications

    Affected: all versions.

  • Malicious remote can claim that a user was synced from another remote

    Affected: all versions.

  • CVE-2024-41162Medium 4.1

    Malicious remote can make an arbitrary local channel read-only

    Affected: all versions.

  • CVE-2024-41144Medium 5.5

    Malicious remote can create/update/delete arbitrary posts in arbitrary channels

    Affected: all versions.

  • CVE-2024-39839Medium 4.3

    Remote username set to an arbitrary string by remote user

    Affected: all versions.

  • Malicious remote can create arbitrary channels

    Affected: fixed in 5.3.2-0.20240626164322-c758cecaf30c; all versions.

  • CVE-2024-39832Medium 6.8

    Permanently local data deletion by malicious remote

    Affected: all versions.

  • Malicious remote can invite itself to an arbitrary local channel

    Affected: all versions.

  • Malicious remote can add users to arbitrary teams and channels

    Affected: all versions.

  • Existing local user overwritten by malicious remote

    Affected: all versions.

  • Malicious remote can create arbitrary reactions on arbitrary posts

    Affected: all versions.

  • CVE-2024-2447Medium 6.5

    Mattermost versions 8.1.x before 8.1.11, 9.3.x before 9.3.3, 9.4.x before 9.4.4, and 9.5.x before 9.5.2 fail to authenticate the source of…

    Affected: all versions.

  • CVE-2024-29221Medium 4.7

    Invite ID available to team admins even without the "Add Members" permission

    Affected: all versions.

  • CVE-2024-28949Medium 4.3

    DoS via a large number of User Preferences

    Affected: all versions.

  • Users maintain access to active call after being removed from a channel

    Affected: all versions.

  • Resource Exhaustion via the Invitation Feature

    Affected: fixed in 0.0.0-20240209181221-674f549daf0e; all versions.

  • CVE-2024-1953Medium 4.3

    Mattermost versions 8.1.x before 8.1.9, 9.2.x before 9.2.5, 9.3.0, and 9.4.x before 9.4.2 fail to limit the number of role names requested…

    Affected: all versions.

  • Mattermost version 8.1.x before 8.1.9 fails to sanitize data associated with permalinks when a plugin updates an ephemeral post, allowing…

    Affected: all versions.

  • A race condition in Mattermost versions 8.1.x before 8.1.9, and 9.4.x before 9.4.2 allows an authenticated attacker to gain unauthorized…

    Affected: all versions.

  • CVE-2024-1942Medium 4.3

    Mattermost versions 8.1.x before 8.1.9, 9.2.x before 9.2.5, and 9.3.0 fail to sanitize the metadata on posts containing permalinks under…

    Affected: all versions.

  • CVE-2024-1888Medium 4.3

    Existing server guests invited to the team by members without "invite_guest" permission

    Affected: all versions.

  • CVE-2024-24988Medium 4.3

    Excessive resource consumption when sending long emoji names in user custom status

    Affected: all versions.

  • CVE-2024-1887Medium 4.3

    Public channel post content accessible without membership when compliance export is enabled

    Affected: all versions.

  • Files of archived channels accessible with the “Allow users to view archived channels” option disabled

    Affected: all versions.

  • CVE-2024-23493Medium 4.3

    Team associated AD/LDAP Groups Leaked due to missing authorization

    Affected: all versions.

  • CVE-2024-1402Medium 4.3

    Denial of service in mattermost mobile apps and server via emoji reactions

    Affected: all versions.

  • Incorrect Authorization leads to Channel Member Count Leak

    Affected: all versions.

  • CVE-2023-47858Medium 4.3

    Details of archived public channels are leaked to members of another team

    Affected: all versions.

  • Lack of restriction to manage group names for freshly demoted guests

    Affected: all versions.

  • CVE-2023-48732Medium 4.3

    Keywords that trigger mentions are leaked to other users

    Affected: all versions.

  • Mattermost version 8.1.6 and earlier fails to sanitize channel mention data in posts, which allows an attacker to inject markup in the web…

    Affected: all versions.

  • CVE-2023-5968Medium 4.9

    Password hash in response body after username update

    Affected: fixed in 5.3.2-0.20230825233148-f787fd63368a.

  • Stored XSS via SVG attachment on Boards

    Affected: from 5.0.0, fixed in 7.1.6.

  • CVE-2023-1775Medium 4.3

    Unsanitized events sent over Websocket to regular users in a High Availability environment

    Affected: from 5.0.0, fixed in 7.1.6.

  • CVE-2023-1774Medium 4.2

    Unauthorized email invite to a private channel

    Affected: from 5.0.0, fixed in 7.1.6.

  • CVE-2022-2401Medium 6.5

    Team members could access sensitive information of other users via an API call

    Affected: all versions.

  • CVE-2022-1384Medium 4.7

    Authorized users are allowed to install old plugin versions from the Marketplace

    Affected: all versions.

  • Invitation Email is resent as a Reminder after invalidating pending email invites

    Affected: all versions.

  • CVE-2022-1332Medium 4.3

    Restricted custom admin role can bypass the restrictions and view the server logs and server config.json file contents

    Affected: fixed in 5.37.9.

  • CVE-2022-1337Medium 4.3

    OOM DoS in Mattermost image proxy

    Affected: all versions.

  • Mattermost 5.38 and earlier fails to sufficiently sanitize clipboard contents, which allows a user-assisted attacker to inject arbitrary…

    Affected: fixed in 5.39.0.

  • An issue was discovered in Mattermost Server before 5.1.

    Affected: fixed in 5.1.0.

  • An issue was discovered in Mattermost Server before 5.20.0.

    Affected: fixed in 5.20.0.