# github.com/mattermost/mattermost-server/v5 (Go) vulnerabilities

199 known vulnerabilities (5 critical, 16 high, 123 medium, 53 low), with the versions each affects and the releases that fix them.

## At a glance

- Latest release: not known (cve.now hasn't read this package's releases)
- Newest unaffected release: not known without release data
- Registry: https://pkg.go.dev/github.com/mattermost/mattermost-server/v5

## Advisories (199)

### [CVE-2026-8823](https://cve.now/CVE-2026-8823): User Manager can demote bot accounts to guest without bot-management permission

- Severity: Low 3.8
- Published: Jun 22, 2026
- Affected: all versions.

### [CVE-2026-6961](https://cve.now/CVE-2026-6961): CVE-2026-6961: Path traversal via unsanitized FileInfo.Name in Mattermost federation sync

- Severity: High 7.6
- Published: Jun 12, 2026
- Affected: all versions.

### [CVE-2026-7387](https://cve.now/CVE-2026-7387): Mattermost group syncable endpoints allow privilege escalation via scheme\_admin

- Severity: High 8.8
- Published: Jun 12, 2026
- Affected: all versions.

### [CVE-2026-6046](https://cve.now/CVE-2026-6046): Plugin bot username conflict allows user account to be used as bot identity in Mattermost Server

- Severity: Medium 5.3
- Published: Jun 12, 2026
- Affected: all versions.

### [CVE-2026-6689](https://cve.now/CVE-2026-6689): Missing {{invite\_user}} permission check on team creation allows unprivileged users to set open-invite and allowed-domains team settings

- Severity: Medium 4.3
- Published: Jun 12, 2026
- Affected: all versions.

### [CVE-2026-7184](https://cve.now/CVE-2026-7184): Mattermost Remote Cluster PATCH API Leaks Authentication Tokens

- Severity: Medium 6.5
- Published: Jun 12, 2026
- Affected: all versions.

### [CVE-2026-6739](https://cve.now/CVE-2026-6739): Mattermost: Delegated admins could patch protected default system roles

- Severity: Medium 6.7
- Published: Jun 12, 2026
- Affected: all versions.

### [CVE-2026-3433](https://cve.now/CVE-2026-3433): Mattermost fails to scope role\_updated websocket events to authorized team and channel members

- Severity: Medium 4.3
- Published: Jun 12, 2026
- Affected: all versions.

### [CVE-2026-4915](https://cve.now/CVE-2026-4915): Server panic via outgoing webhook responses

- Severity: Medium 6.5
- Published: May 25, 2026
- Affected: all versions.

### [CVE-2026-5740](https://cve.now/CVE-2026-5740): Unauthenticated WebSocket binary frame causes denial of service in Mattermost Server

- Severity: High 7.5
- Published: May 22, 2026
- Affected: all versions.

### [CVE-2026-4055](https://cve.now/CVE-2026-4055): Insufficient permission validation on cross-team playbook run creation

- Severity: Medium 4.3
- Published: May 21, 2026
- Affected: all versions.

### [CVE-2026-6333](https://cve.now/CVE-2026-6333): SSRF via Host Header Spoofing in Custom Slash Commands

- Severity: Low 3.5
- Published: May 18, 2026
- Affected: all versions.

### [CVE-2026-6345](https://cve.now/CVE-2026-6345): Prevent password disclosure and force reset during Slack import

- Severity: Medium 6.5
- Published: May 18, 2026
- Affected: all versions.

### [CVE-2026-6346](https://cve.now/CVE-2026-6346): Sensitive credentials exposed in plaintext in Mattermost support packets

- Severity: High 8.7
- Published: May 18, 2026
- Affected: all versions.

### [CVE-2026-28732](https://cve.now/CVE-2026-28732): Slash command trigger-word update allowed command hijacking

- Severity: Medium 4.3
- Published: May 18, 2026
- Affected: all versions.

### [CVE-2026-6343](https://cve.now/CVE-2026-6343): Mattermost Playbooks Plugin fails to enforce view permissions in list endpoints, allowing unauthorized access to public playbooks

- Severity: Medium 4.3
- Published: May 18, 2026
- Affected: all versions.

### [CVE-2026-5163](https://cve.now/CVE-2026-5163): Missing authorization check in AI message rewrite endpoint allows access to private thread content

- Severity: Medium 6.5
- Published: May 18, 2026
- Affected: all versions.

### [CVE-2026-4286](https://cve.now/CVE-2026-4286): Playbooks Plugin fails to validate team transfers, allowing unauthorized removal of member access via playbook update

- Severity: Low 3.1
- Published: May 18, 2026
- Affected: all versions.

### [CVE-2026-6339](https://cve.now/CVE-2026-6339): Missing request origin validation on burn-on-read reveal endpoint

- Severity: Medium 4.3
- Published: May 18, 2026
- Affected: all versions.

### [CVE-2026-6340](https://cve.now/CVE-2026-6340): Memory Exhaustion via Malicious 7zip File Upload

- Severity: Medium 4.3
- Published: May 18, 2026
- Affected: all versions.

### [CVE-2026-3495](https://cve.now/CVE-2026-3495): Unescaped variables during error page composition

- Severity: Low 3.8
- Published: May 18, 2026
- Affected: all versions.

### [CVE-2026-4273](https://cve.now/CVE-2026-4273): Insufficient token rotation validation in remote cluster invite confirmation

- Severity: Low 3.7
- Published: May 18, 2026
- Affected: all versions.

### [CVE-2026-3637](https://cve.now/CVE-2026-3637): Mattermost fails to enforce create\_post permission when editing posts

- Severity: Medium 4.3
- Published: May 18, 2026
- Affected: all versions.

### [CVE-2026-28759](https://cve.now/CVE-2026-28759): Insufficient authorization in shared channel membership sync allows remote cluster to remove users from arbitrary channels

- Severity: Medium 4.3
- Published: May 18, 2026
- Affected: all versions.

### [CVE-2026-6334](https://cve.now/CVE-2026-6334): OAuth authorization code client binding not enforced during token redemption in Mattermost

- Severity: Low 3.1
- Published: May 18, 2026
- Affected: all versions.

### [CVE-2026-3590](https://cve.now/CVE-2026-3590): Race Condition in Guest Magic Link Authentication Allows Token Reuse

- Severity: Medium 6.5
- Published: Apr 15, 2026
- Affected: all versions.

### [CVE-2026-28741](https://cve.now/CVE-2026-28741): CSRF Protection Bypass Allows Updating a User's Authentication Method

- Severity: Medium 6.8
- Published: Apr 15, 2026
- Affected: all versions.

### [CVE-2026-3112](https://cve.now/CVE-2026-3112): Arbitrary File Read via Advanced Logging Support Packet

- Severity: Medium 6.8
- Published: Mar 26, 2026
- Affected: all versions.

### [CVE-2026-3115](https://cve.now/CVE-2026-3115): Guest users can view group member IDs without respecting view restrictions

- Severity: Medium 4.3
- Published: Mar 26, 2026
- Affected: all versions.

### [CVE-2026-3114](https://cve.now/CVE-2026-3114): Zip Bomb Denial of Service via Unrestricted Archive Decompression

- Severity: Medium 6.5
- Published: Mar 26, 2026
- Affected: all versions.

### [CVE-2026-3108](https://cve.now/CVE-2026-3108): Terminal Escape Injection in mmctl Report Posts Command

- Severity: High 8.0
- Published: Mar 26, 2026
- Affected: all versions.

### [CVE-2026-4274](https://cve.now/CVE-2026-4274): Insufficient authorization in shared channel membership sync grants team-level access instead of channel-level access

- Severity: Medium 5.4
- Published: Mar 26, 2026
- Affected: all versions.

### [CVE-2026-27659](https://cve.now/CVE-2026-27659): CSRF vulnerability in UpdateAccessControlPolicyActiveStatus endpoint

- Severity: Medium 4.6
- Published: Mar 25, 2026
- Affected: all versions.

### [CVE-2026-20719](https://cve.now/CVE-2026-20719): DoS via URL Previews Rendering Malicious SVGs

- Severity: Medium 4.3
- Published: Mar 25, 2026
- Affected: all versions.

### [CVE-2026-27656](https://cve.now/CVE-2026-27656): Account Takeover via Substring Matching in OpenID Connect Authentication

- Severity: Medium 5.7
- Published: Mar 25, 2026
- Affected: all versions.

### [CVE-2026-24692](https://cve.now/CVE-2026-24692): Guest users can bypass read permissions via search API

- Severity: Medium 4.3
- Published: Mar 16, 2026
- Affected: all versions.

### [CVE-2026-22545](https://cve.now/CVE-2026-22545): Password Change Bypass via Auth Switch Endpoint

- Severity: Low 3.1
- Published: Mar 16, 2026
- Affected: all versions.

### [CVE-2026-2455](https://cve.now/CVE-2026-2455): SSRF bypass via IPv4-mapped IPv6 literals

- Severity: Medium 4.3
- Published: Mar 16, 2026
- Affected: all versions.

### [CVE-2026-21386](https://cve.now/CVE-2026-21386): Private channel enumeration via /mute slash command

- Severity: Medium 4.3
- Published: Mar 16, 2026
- Affected: all versions.

### [CVE-2026-25780](https://cve.now/CVE-2026-25780): Memory Exhaustion via Malformed DOC File Upload

- Severity: Medium 4.3
- Published: Mar 16, 2026
- Affected: all versions.

### [CVE-2026-4265](https://cve.now/CVE-2026-4265): Guest user can upload files without permission across teams

- Severity: Medium 4.3
- Published: Mar 16, 2026
- Affected: all versions.

### [CVE-2026-25783](https://cve.now/CVE-2026-25783): Denial of service via malformed User-Agent header in getBrowserVersion

- Severity: Medium 4.3
- Published: Mar 16, 2026
- Affected: all versions.

### [CVE-2026-24458](https://cve.now/CVE-2026-24458): DoS attack via login attempts with multi-megabyte passwords

- Severity: High 7.5
- Published: Mar 16, 2026
- Affected: all versions.

### [CVE-2026-2578](https://cve.now/CVE-2026-2578): Information Disclosure via WebSocket Event When Deleting Unrevealed Burn on Read Posts

- Severity: Medium 4.3
- Published: Mar 16, 2026
- Affected: all versions.

### [CVE-2026-26246](https://cve.now/CVE-2026-26246): Memory Exhaustion via Malformed PSD File Upload

- Severity: Medium 4.3
- Published: Mar 16, 2026
- Affected: all versions.

### [CVE-2026-2458](https://cve.now/CVE-2026-2458): Unauthorized channel enumeration in private teams after member removal

- Severity: Medium 4.3
- Published: Mar 16, 2026
- Affected: all versions.

### [CVE-2026-2457](https://cve.now/CVE-2026-2457): WebSocket Message Spoofing via Permalink Embed Manipulation

- Severity: Medium 4.3
- Published: Mar 16, 2026
- Affected: all versions.

### [CVE-2026-2463](https://cve.now/CVE-2026-2463): Unauthorized access to invite ID during team creation

- Severity: Medium 4.3
- Published: Mar 16, 2026
- Affected: all versions.

### [CVE-2026-2456](https://cve.now/CVE-2026-2456): Denial of Service via Unbounded Memory Allocation in Integration Actions

- Severity: Medium 5.3
- Published: Mar 16, 2026
- Affected: all versions.

### [CVE-2025-14573](https://cve.now/CVE-2025-14573): Team Admin Bypass of Invite Permissions via allow\_open\_invite Field

- Severity: Low 3.8
- Published: Feb 16, 2026
- Affected: all versions.

### [CVE-2025-14350](https://cve.now/CVE-2025-14350): Information disclosure via channel mentions in posts

- Severity: Medium 4.3
- Published: Feb 16, 2026
- Affected: all versions.

### [CVE-2025-13821](https://cve.now/CVE-2025-13821): User profile update exposes password hash and MFA secrets

- Severity: Medium 5.7
- Published: Feb 16, 2026
- Affected: all versions.

### [CVE-2026-0999](https://cve.now/CVE-2026-0999): Authentication bypass via userID login when email and username login are disabled

- Severity: Medium 5.4
- Published: Feb 16, 2026
- Affected: all versions.

### [CVE-2025-64641](https://cve.now/CVE-2025-64641): Mattermost Jira plugin crafted action leaks Jira issue details

- Severity: Medium 4.1
- Published: Dec 24, 2025
- Affected: all versions.

### [CVE-2025-13767](https://cve.now/CVE-2025-13767): Unauthorized Read Access to Private Channel Posts via Mattermost Jira Plugin

- Severity: Medium 4.3
- Published: Dec 24, 2025
- Affected: all versions.

### [CVE-2025-14273](https://cve.now/CVE-2025-14273): Mattermost Jira plugin user spoofing enables Jira request forgery.

- Severity: High 7.2
- Published: Dec 22, 2025
- Affected: all versions.

### [CVE-2025-13324](https://cve.now/CVE-2025-13324): Lack of Invalidation of Legacy Remote Cluster Invite Tokens After Confirmation

- Severity: Low 3.7
- Published: Dec 17, 2025
- Affected: all versions.

### [CVE-2025-62690](https://cve.now/CVE-2025-62690): Open redirect in error page when link opened in new tab

- Severity: Low 3.1
- Published: Dec 17, 2025
- Affected: all versions.

### [CVE-2025-13352](https://cve.now/CVE-2025-13352): Mattermost GitHub Plugin allows unauthorized GitHub reactions via reaction forwarding hijacking

- Severity: Low 3.0
- Published: Dec 17, 2025
- Affected: all versions.

### [CVE-2025-13870](https://cve.now/CVE-2025-13870): Unauthorized access and subscription vulnerability in Boards

- Severity: Low 3.1
- Published: Dec 2, 2025
- Affected: all versions.

### [CVE-2025-12756](https://cve.now/CVE-2025-12756): Insecure Direct Object Reference in Mattermost Boards Plugin Enables Unauthorised Comment Deletion

- Severity: Medium 4.3
- Published: Dec 1, 2025
- Affected: all versions.

### [CVE-2025-12421](https://cve.now/CVE-2025-12421): Account Takeover via Code Exchange Endpoint

- Severity: Critical 9.9
- Published: Nov 27, 2025
- Affected: all versions.

### [CVE-2025-12559](https://cve.now/CVE-2025-12559): Information Disclosure in Common Teams API

- Severity: Medium 4.3
- Published: Nov 27, 2025
- Affected: all versions.

### [CVE-2025-12419](https://cve.now/CVE-2025-12419): Account takeover on OAuth/OpenID-enabled servers

- Severity: Critical 9.9
- Published: Nov 27, 2025
- Affected: all versions.

### [CVE-2025-55074](https://cve.now/CVE-2025-55074): Channel member objects leak read status

- Severity: Low 3.0
- Published: Nov 18, 2025
- Affected: all versions.

### [CVE-2025-11794](https://cve.now/CVE-2025-11794): Password hash and MFA secret returned in user email verification endpoint

- Severity: Medium 4.9
- Published: Nov 14, 2025
- Affected: all versions.

### [CVE-2025-55073](https://cve.now/CVE-2025-55073): MS Teams plugin OAuth allows editing arbitrary posts

- Severity: Medium 5.4
- Published: Nov 14, 2025
- Affected: all versions.

### [CVE-2025-55070](https://cve.now/CVE-2025-55070): Lack of MFA enforcement in WebSocket connections

- Severity: Medium 6.5
- Published: Nov 14, 2025
- Affected: all versions.

### [CVE-2025-41436](https://cve.now/CVE-2025-41436): Unauthorized access to archived channel content via threads interface

- Severity: Low 3.1
- Published: Nov 14, 2025
- Affected: all versions.

### [CVE-2025-11776](https://cve.now/CVE-2025-11776): Guest user can discover archived public channels

- Severity: Medium 4.3
- Published: Nov 14, 2025
- Affected: all versions; fixed in 5.3.2-0.20250815165020-c8d66301415d.

### [CVE-2025-11777](https://cve.now/CVE-2025-11777): Cross-team channel membership access

- Severity: Low 3.1
- Published: Nov 13, 2025
- Affected: all versions; fixed in 5.3.2-0.20250905150616-ba86dfc5876b.

### [CVE-2025-58073](https://cve.now/CVE-2025-58073): Arbitrary Mattermost Team can be joined by manipulating the OAuth state

- Severity: High 8.1
- Published: Oct 16, 2025
- Affected: all versions.

### [CVE-2025-41410](https://cve.now/CVE-2025-41410): Slack import bypasses email verification for team access controls

- Severity: Medium 5.4
- Published: Oct 16, 2025
- Affected: all versions.

### [CVE-2025-10545](https://cve.now/CVE-2025-10545): Guest user can add unauthorized team users to private channels

- Severity: Low 3.1
- Published: Oct 16, 2025
- Affected: all versions.

### [CVE-2025-58075](https://cve.now/CVE-2025-58075): Arbitrary Mattermost Team can be joined by manipulating the SAML RelayState

- Severity: High 8.1
- Published: Oct 16, 2025
- Affected: all versions.

### [CVE-2025-54499](https://cve.now/CVE-2025-54499): Insecure string comparison enables timing attacks

- Severity: Low 3.1
- Published: Oct 16, 2025
- Affected: all versions.

### [CVE-2025-9081](https://cve.now/CVE-2025-9081): IDOR in board file download allows any user to download any file by UUID

- Severity: Low 3.1
- Published: Sep 19, 2025
- Affected: all versions.

### [CVE-2025-9079](https://cve.now/CVE-2025-9079): Admin RCE via prepackaged plugins by way of misconfigured imports directory

- Severity: High 8.0
- Published: Sep 19, 2025
- Affected: all versions.

### [CVE-2025-9072](https://cve.now/CVE-2025-9072): One-Click Mattermost Account Takeover via Poisoned RelayState SAML Parameter

- Severity: High 7.6
- Published: Sep 15, 2025
- Affected: all versions.

### [CVE-2025-9084](https://cve.now/CVE-2025-9084): Open redirect in OAuth login

- Severity: Low 3.1
- Published: Sep 15, 2025
- Affected: all versions.

### [CVE-2025-9078](https://cve.now/CVE-2025-9078): Weak cache keys lead to post IDOR and link preview poisoning

- Severity: Medium 4.3
- Published: Sep 15, 2025
- Affected: all versions.

### [CVE-2025-9076](https://cve.now/CVE-2025-9076): Mattermost Server exposes sensitive user credentials during shared channel membership synchronization

- Severity: Medium 6.5
- Published: Sep 15, 2025
- Affected: all versions.

### [CVE-2025-8402](https://cve.now/CVE-2025-8402): Nil pointer dereference in bulk import crashes server

- Severity: Medium 4.9
- Published: Aug 21, 2025
- Affected: all versions; through 5.39.3.

### [CVE-2025-6465](https://cve.now/CVE-2025-6465): Path traversal in image upload with preview overwrite

- Severity: Medium 4.3
- Published: Aug 21, 2025
- Affected: all versions.

### [CVE-2025-47870](https://cve.now/CVE-2025-47870): Team invite ID leaked to team admin with no member invite privileges

- Severity: Medium 4.3
- Published: Aug 21, 2025
- Affected: all versions; through 5.39.3.

### [CVE-2025-49222](https://cve.now/CVE-2025-49222): Mattermost Shared Channel Upload Type Validation Bypass

- Severity: Medium 6.8
- Published: Aug 21, 2025
- Affected: all versions; through 5.39.3.

### [CVE-2025-8023](https://cve.now/CVE-2025-8023): Path Traversal in Template Upload Allows Uploading Files Outside Target Directory

- Severity: Medium 6.8
- Published: Aug 21, 2025
- Affected: all versions; through 5.39.5.

### [CVE-2025-53971](https://cve.now/CVE-2025-53971): Channel and Team Membership APIs inadvertently allow loss of Member privileges.

- Severity: Low 3.8
- Published: Aug 21, 2025
- Affected: through 5.39.3; all versions.

### [CVE-2025-47700](https://cve.now/CVE-2025-47700): AI plugin APIs can be triggered using post actions

- Severity: Low 3.5
- Published: Aug 21, 2025
- Affected: all versions.

### [CVE-2025-49810](https://cve.now/CVE-2025-49810): Thread summarization allows persistent access to channel

- Severity: Low 3.5
- Published: Aug 21, 2025
- Affected: all versions.

### [CVE-2025-36530](https://cve.now/CVE-2025-36530): Import Path Traversal Enables Unauthorized Unsigned Plugin Installation

- Severity: Medium 6.8
- Published: Aug 21, 2025
- Affected: through 5.11.1; all versions.

### [CVE-2025-6227](https://cve.now/CVE-2025-6227): Invite token is used as part of the secure communication

- Severity: Low 2.2
- Published: Jul 18, 2025
- Affected: all versions.

### [CVE-2025-6233](https://cve.now/CVE-2025-6233): Arbitrary file read by system admin via path traversal

- Severity: Medium 6.8
- Published: Jul 18, 2025
- Affected: all versions.

### [CVE-2025-6226](https://cve.now/CVE-2025-6226): IDOR in CreatePost API allows for timeboxed message disclosure

- Severity: Medium 6.5
- Published: Jul 18, 2025
- Affected: all versions.

### [CVE-2025-47871](https://cve.now/CVE-2025-47871): Mattermost Playbooks exposes private channel metadata to unauthorized users via run metadata API

- Severity: Medium 4.3
- Published: Jun 30, 2025
- Affected: all versions.

### [CVE-2025-46702](https://cve.now/CVE-2025-46702): Mattermost Playbooks allows privilege escalation through improper access control in playbook run participant management

- Severity: Medium 5.4
- Published: Jun 30, 2025
- Affected: all versions.

### [CVE-2025-3228](https://cve.now/CVE-2025-3228): Unauthorized Guest user access to Playbook

- Severity: Medium 4.3
- Published: Jun 20, 2025
- Affected: all versions.

### [CVE-2025-3227](https://cve.now/CVE-2025-3227): Unauthorized channel member management through playbook runs

- Severity: Medium 4.3
- Published: Jun 20, 2025
- Affected: all versions.

### [CVE-2025-4981](https://cve.now/CVE-2025-4981): Path Traversal Leading to RCE by Any Authenticated Mattermost User

- Severity: Critical 9.9
- Published: Jun 20, 2025
- Affected: all versions.

### [CVE-2025-4128](https://cve.now/CVE-2025-4128): Mattermost Guest User Information Disclosure Vulnerability

- Severity: Low 3.1
- Published: Jun 11, 2025
- Affected: all versions.

### [CVE-2025-4573](https://cve.now/CVE-2025-4573): LDAP Injection in Mattermost Enterprise Edition When Using Active Directory

- Severity: Medium 4.1
- Published: Jun 11, 2025
- Affected: all versions.

### [CVE-2025-3611](https://cve.now/CVE-2025-3611): Improper Access Control in Mattermost allows System Managers to view team details despite role restrictions

- Severity: Low 3.1
- Published: May 30, 2025
- Affected: all versions.

### [CVE-2025-3230](https://cve.now/CVE-2025-3230): Bypass of System Admin User Deactivation Controls for Personal Access Tokens in Mattermost Server

- Severity: Medium 5.4
- Published: May 30, 2025
- Affected: all versions.

### [CVE-2025-2571](https://cve.now/CVE-2025-2571): Google OAuth Authentication Bypass for Converted Bot Accounts

- Severity: Medium 4.2
- Published: May 30, 2025
- Affected: all versions.

### [CVE-2025-1792](https://cve.now/CVE-2025-1792): Improper Access Control in Mattermost Channel Member API

- Severity: Low 3.1
- Published: May 30, 2025
- Affected: all versions.

### [CVE-2025-3913](https://cve.now/CVE-2025-3913): Team Privacy Settings Authorization Bypass in Mattermost Server

- Severity: Medium 5.3
- Published: May 29, 2025
- Affected: all versions.

### [CVE-2025-2570](https://cve.now/CVE-2025-2570): System Admin Cannot Access Environment settings in System Console While System Manager Can

- Severity: Low 2.7
- Published: May 15, 2025
- Affected: all versions.

### [CVE-2025-2527](https://cve.now/CVE-2025-2527): Improper access control to group information

- Severity: Medium 4.3
- Published: May 15, 2025
- Affected: all versions.

### [CVE-2025-3446](https://cve.now/CVE-2025-3446): Members Without Guest Invite Permissions Can Add Guests to Teams

- Severity: Medium 4.3
- Published: May 15, 2025
- Affected: all versions.

### [CVE-2025-31947](https://cve.now/CVE-2025-31947): Repeated LDAP login failures can lock an LDAP account

- Severity: Medium 5.8
- Published: May 15, 2025
- Affected: all versions.

### [CVE-2025-41423](https://cve.now/CVE-2025-41423): Unauthorized Playbooks Post Deletion in Mattermost Playbooks Plugin

- Severity: Low 3.1
- Published: Apr 24, 2025
- Affected: all versions.

### [CVE-2025-35965](https://cve.now/CVE-2025-35965): DoS in Mattermost Playbooks via Excessive Task Actions

- Severity: Medium 6.5
- Published: Apr 24, 2025
- Affected: all versions.

### [CVE-2025-41395](https://cve.now/CVE-2025-41395): Webapp DoS via malicious retrospective post in Playbooks

- Severity: Medium 6.5
- Published: Apr 24, 2025
- Affected: all versions.

### [CVE-2025-2564](https://cve.now/CVE-2025-2564): Unauthorized View Access to Archived Channel Member Info

- Severity: Medium 4.3
- Published: Apr 16, 2025
- Affected: all versions.

### [CVE-2025-27936](https://cve.now/CVE-2025-27936): Webhook Secret Exposure via Timing attack in MSteams plugin

- Severity: Medium 5.3
- Published: Apr 16, 2025
- Affected: all versions.

### [CVE-2025-31363](https://cve.now/CVE-2025-31363): Data exfiltration via AI plugin Jira tool

- Severity: Low 3.0
- Published: Apr 16, 2025
- Affected: all versions.

### [CVE-2025-27571](https://cve.now/CVE-2025-27571): Channel metadata visible in archived channels despite configuration setting

- Severity: Medium 4.3
- Published: Apr 16, 2025
- Affected: all versions.

### [CVE-2025-27538](https://cve.now/CVE-2025-27538): MFA Enforcement Bypass Allows Unauthorized Removal of MFA for Other Users

- Severity: Low 2.2
- Published: Apr 16, 2025
- Affected: all versions.

### [CVE-2025-24839](https://cve.now/CVE-2025-24839): Unauthorized AI bot activation via Wrangler plugin

- Severity: Low 3.1
- Published: Apr 16, 2025
- Affected: all versions.

### [CVE-2025-2475](https://cve.now/CVE-2025-2475): Unauthorized Bot Login Using Credentials

- Severity: Medium 5.4
- Published: Apr 14, 2025
- Affected: all versions.

### [CVE-2025-2424](https://cve.now/CVE-2025-2424): Leaked Metadata of Deleted Files via Bookmark Creation

- Severity: Low 3.1
- Published: Apr 14, 2025
- Affected: all versions.

### [CVE-2025-32093](https://cve.now/CVE-2025-32093): Syatem admin profile modification by delegated granular administration role

- Severity: Medium 4.7
- Published: Apr 14, 2025
- Affected: all versions.

### [CVE-2025-24866](https://cve.now/CVE-2025-24866): Unauthorized Access to User Activity Logs API by delegated granular administration roles

- Severity: Low 2.7
- Published: Apr 10, 2025
- Affected: all versions.

### [CVE-2025-25068](https://cve.now/CVE-2025-25068): Bypassing MFA Enforcement on Plugin Endpoints

- Severity: High 7.5
- Published: Mar 21, 2025
- Affected: all versions.

### [CVE-2025-24920](https://cve.now/CVE-2025-24920): Unauthorized Bookmark Creation and Modification in Archived Channels

- Severity: Medium 4.3
- Published: Mar 21, 2025
- Affected: all versions.

### [CVE-2025-30179](https://cve.now/CVE-2025-30179): MFA Enforcement Bypass in Search APIs

- Severity: Medium 4.3
- Published: Mar 21, 2025
- Affected: all versions.

### [CVE-2025-25274](https://cve.now/CVE-2025-25274): Unauthorized Command Execution in Archived Channels

- Severity: Medium 4.3
- Published: Mar 21, 2025
- Affected: all versions.

### [CVE-2025-27933](https://cve.now/CVE-2025-27933): Unauthorized Private-to-Public Channel Conversion

- Severity: Medium 5.4
- Published: Mar 21, 2025
- Affected: all versions.

### [CVE-2025-27715](https://cve.now/CVE-2025-27715): Auto-Enrollment of Team Admins into Private Channels without explicit consent

- Severity: Low 3.3
- Published: Mar 21, 2025
- Affected: all versions.

### [CVE-2025-1472](https://cve.now/CVE-2025-1472): Unauthorized View Access to Site Statistics and Team Statistics

- Severity: Medium 4.3
- Published: Mar 19, 2025
- Affected: all versions.

### [CVE-2025-20051](https://cve.now/CVE-2025-20051): Arbitrary file read via block duplication in Mattermost Boards

- Severity: Critical 9.9
- Published: Feb 24, 2025
- Affected: all versions.

### [CVE-2025-25279](https://cve.now/CVE-2025-25279): Arbitrary file read in Mattermost Boards via import & export board archive

- Severity: Critical 9.9
- Published: Feb 24, 2025
- Affected: all versions.

### [CVE-2025-1412](https://cve.now/CVE-2025-1412): Session Persistence After User-to-Bot Conversion

- Severity: Low 3.1
- Published: Feb 24, 2025
- Affected: all versions.

### [CVE-2025-24526](https://cve.now/CVE-2025-24526): Channel export permitted on archived channel when viewing archived channels is disabled

- Severity: Medium 4.3
- Published: Feb 24, 2025
- Affected: all versions.

### [CVE-2025-20621](https://cve.now/CVE-2025-20621): Webapp crash via object that can't be cast to String in Attachment Field

- Severity: Medium 6.5
- Published: Jan 16, 2025
- Affected: all versions.

### [CVE-2025-20088](https://cve.now/CVE-2025-20088): Insufficient Input Validation on Post Props

- Severity: Medium 6.5
- Published: Jan 15, 2025
- Affected: all versions.

### [CVE-2025-20086](https://cve.now/CVE-2025-20086): Insufficient Input Validation on Post Props

- Severity: Medium 6.5
- Published: Jan 15, 2025
- Affected: all versions.

### [CVE-2025-21088](https://cve.now/CVE-2025-21088): WebApp crash via improper validation of proto style in attachments

- Severity: Medium 6.5
- Published: Jan 15, 2025
- Affected: all versions.

### [CVE-2025-22445](https://cve.now/CVE-2025-22445): Misleading UI for undefined admin console settings in Calls causes security confusion

- Severity: Low 3.5
- Published: Jan 9, 2025
- Affected: all versions.

### [CVE-2025-20033](https://cve.now/CVE-2025-20033): DoS via custom post type for sysconsole plugin readers

- Severity: Medium 4.3
- Published: Jan 9, 2025
- Affected: all versions.

### [CVE-2025-22449](https://cve.now/CVE-2025-22449): Access control flaw for team admins allows unauthorized team additions

- Severity: Low 3.8
- Published: Jan 9, 2025
- Affected: all versions.

### [CVE-2024-54682](https://cve.now/CVE-2024-54682): Zipbomb DoS via Missing Slack Import Validation

- Severity: Medium 6.5
- Published: Dec 16, 2024
- Affected: all versions.

### [CVE-2024-54083](https://cve.now/CVE-2024-54083): DoS via lack of type validation in Calls

- Severity: Medium 6.5
- Published: Dec 16, 2024
- Affected: all versions.

### [CVE-2024-48872](https://cve.now/CVE-2024-48872): Bypass of "Max failed attempts" restriction via race condition

- Severity: Medium 4.8
- Published: Dec 16, 2024
- Affected: all versions.

### [CVE-2024-46872](https://cve.now/CVE-2024-46872): Client-Side Path Traversal Leading to CSRF in Playbooks

- Severity: Medium 4.6
- Published: Oct 29, 2024
- Affected: all versions.

### [CVE-2024-47401](https://cve.now/CVE-2024-47401): DoS via Amplified GraphQL Response in Playbooks

- Severity: Medium 4.3
- Published: Oct 29, 2024
- Affected: all versions.

### [CVE-2024-50052](https://cve.now/CVE-2024-50052): Arbitrary post deletion via Playbooks /ignore-thread endpoint

- Severity: Medium 4.3
- Published: Oct 29, 2024
- Affected: all versions.

### [CVE-2024-10241](https://cve.now/CVE-2024-10241): Private channel names leaked with Ctrl+K when ElasticSearch is enabled

- Severity: Medium 4.3
- Published: Oct 29, 2024
- Affected: all versions.

### [CVE-2024-10214](https://cve.now/CVE-2024-10214): Incorrect Session Creation with Desktop SSO

- Severity: Low 3.5
- Published: Oct 28, 2024
- Affected: all versions.

### [CVE-2024-47003](https://cve.now/CVE-2024-47003): DoS via non-string message using permalink embed

- Severity: Low 3.1
- Published: Sep 26, 2024
- Affected: all versions.

### [CVE-2024-43780](https://cve.now/CVE-2024-43780): Unauthorized channel file upload

- Severity: Medium 4.3
- Published: Aug 22, 2024
- Affected: all versions.

### [CVE-2024-42497](https://cve.now/CVE-2024-42497): Insufficient permissions checks on teams

- Severity: Medium 6.0
- Published: Aug 22, 2024
- Affected: all versions.

### [CVE-2024-40884](https://cve.now/CVE-2024-40884): Unauthorized disabling of invite URL

- Severity: Low 2.7
- Published: Aug 22, 2024
- Affected: all versions.

### [CVE-2024-8071](https://cve.now/CVE-2024-8071): System Role with edit access to permissions can elevate themselves to system admin

- Severity: Medium 4.7
- Published: Aug 22, 2024
- Affected: all versions.

### [CVE-2024-40886](https://cve.now/CVE-2024-40886): One-click Client-Side Path Traversal Leading to CSRF in User Management admin page

- Severity: Medium 4.6
- Published: Aug 22, 2024
- Affected: all versions.

### [CVE-2024-32939](https://cve.now/CVE-2024-32939): Email addresses of remote users visible in props regardless of server settings

- Severity: Medium 4.3
- Published: Aug 22, 2024
- Affected: all versions.

### [CVE-2024-39836](https://cve.now/CVE-2024-39836): Munged email address used for password resets and notifications

- Severity: Medium 4.8
- Published: Aug 22, 2024
- Affected: all versions.

### [CVE-2024-41926](https://cve.now/CVE-2024-41926): Malicious remote can claim that a user was synced from another remote

- Severity: Low 2.7
- Published: Aug 1, 2024
- Affected: all versions.

### [CVE-2024-41162](https://cve.now/CVE-2024-41162): Malicious remote can make an arbitrary local channel read-only

- Severity: Medium 4.1
- Published: Aug 1, 2024
- Affected: all versions.

### [CVE-2024-41144](https://cve.now/CVE-2024-41144): Malicious remote can create/update/delete arbitrary posts in arbitrary channels

- Severity: Medium 5.5
- Published: Aug 1, 2024
- Affected: all versions.

### [CVE-2024-39839](https://cve.now/CVE-2024-39839): Remote username set to an arbitrary string by remote user

- Severity: Medium 4.3
- Published: Aug 1, 2024
- Affected: all versions.

### [CVE-2024-39837](https://cve.now/CVE-2024-39837): Malicious remote can create arbitrary channels

- Severity: Low 3.8
- Published: Aug 1, 2024
- Affected: fixed in 5.3.2-0.20240626164322-c758cecaf30c; all versions.

### [CVE-2024-39832](https://cve.now/CVE-2024-39832): Permanently local data deletion by malicious remote

- Severity: Medium 6.8
- Published: Aug 1, 2024
- Affected: all versions.

### [CVE-2024-39777](https://cve.now/CVE-2024-39777): Malicious remote can invite itself to an arbitrary local channel

- Severity: High 8.7
- Published: Aug 1, 2024
- Affected: all versions.

### [CVE-2024-39274](https://cve.now/CVE-2024-39274): Malicious remote can add users to arbitrary teams and channels

- Severity: High 8.7
- Published: Aug 1, 2024
- Affected: all versions.

### [CVE-2024-36492](https://cve.now/CVE-2024-36492): Existing local user overwritten by malicious remote

- Severity: High 7.4
- Published: Aug 1, 2024
- Affected: all versions.

### [CVE-2024-29977](https://cve.now/CVE-2024-29977): Malicious remote can create arbitrary reactions on arbitrary posts

- Severity: Low 2.7
- Published: Aug 1, 2024
- Affected: all versions.

### [CVE-2024-2447](https://cve.now/CVE-2024-2447): Mattermost versions 8.1.x before 8.1.11, 9.3.x before 9.3.3, 9.4.x before 9.4.4, and 9.5.x before 9.5.2 fail to authenticate the source of…

- Severity: Medium 6.5
- Published: Apr 5, 2024
- Affected: all versions.

### [CVE-2024-29221](https://cve.now/CVE-2024-29221): Invite ID available to team admins even without the "Add Members" permission

- Severity: Medium 4.7
- Published: Apr 5, 2024
- Affected: all versions.

### [CVE-2024-28949](https://cve.now/CVE-2024-28949): DoS via a large number of User Preferences

- Severity: Medium 4.3
- Published: Apr 5, 2024
- Affected: all versions.

### [CVE-2024-21848](https://cve.now/CVE-2024-21848): Users maintain access to active call after being removed from a channel

- Severity: Low 3.1
- Published: Apr 5, 2024
- Affected: all versions.

### [CVE-2024-28053](https://cve.now/CVE-2024-28053): Resource Exhaustion via the Invitation Feature

- Severity: Low 3.1
- Published: Mar 15, 2024
- Affected: fixed in 0.0.0-20240209181221-674f549daf0e; all versions.

### [CVE-2024-1953](https://cve.now/CVE-2024-1953): Mattermost versions 8.1.x before 8.1.9, 9.2.x before 9.2.5, 9.3.0, and 9.4.x before 9.4.2 fail to limit the number of role names requested…

- Severity: Medium 4.3
- Published: Feb 29, 2024
- Affected: all versions.

### [CVE-2024-1952](https://cve.now/CVE-2024-1952): Mattermost version 8.1.x before 8.1.9 fails to sanitize data associated with permalinks when a plugin updates an ephemeral post, allowing…

- Severity: Low 3.1
- Published: Feb 29, 2024
- Affected: all versions.

### [CVE-2024-1949](https://cve.now/CVE-2024-1949): A race condition in Mattermost versions 8.1.x before 8.1.9, and 9.4.x before 9.4.2 allows an authenticated attacker to gain unauthorized…

- Severity: Low 2.6
- Published: Feb 29, 2024
- Affected: all versions.

### [CVE-2024-1942](https://cve.now/CVE-2024-1942): Mattermost versions 8.1.x before 8.1.9, 9.2.x before 9.2.5, and 9.3.0 fail to sanitize the metadata on posts containing permalinks under…

- Severity: Medium 4.3
- Published: Feb 29, 2024
- Affected: all versions.

### [CVE-2024-1888](https://cve.now/CVE-2024-1888): Existing server guests invited to the team by members without "invite\_guest" permission

- Severity: Medium 4.3
- Published: Feb 29, 2024
- Affected: all versions.

### [CVE-2024-24988](https://cve.now/CVE-2024-24988): Excessive resource consumption when sending long emoji names in user custom status

- Severity: Medium 4.3
- Published: Feb 29, 2024
- Affected: all versions.

### [CVE-2024-1887](https://cve.now/CVE-2024-1887): Public channel post content accessible without membership when compliance export is enabled

- Severity: Medium 4.3
- Published: Feb 29, 2024
- Affected: all versions.

### [CVE-2024-23488](https://cve.now/CVE-2024-23488): Files of archived channels accessible with the “Allow users to view archived channels” option disabled

- Severity: Low 3.1
- Published: Feb 29, 2024
- Affected: all versions.

### [CVE-2024-23493](https://cve.now/CVE-2024-23493): Team associated AD/LDAP Groups Leaked due to missing authorization

- Severity: Medium 4.3
- Published: Feb 29, 2024
- Affected: all versions.

### [CVE-2024-1402](https://cve.now/CVE-2024-1402): Denial of service in mattermost mobile apps and server via emoji reactions

- Severity: Medium 4.3
- Published: Feb 9, 2024
- Affected: all versions.

### [CVE-2024-24776](https://cve.now/CVE-2024-24776): Incorrect Authorization leads to Channel Member Count Leak

- Severity: Low 3.1
- Published: Feb 9, 2024
- Affected: all versions.

### [CVE-2023-47858](https://cve.now/CVE-2023-47858): Details of archived public channels are leaked to members of another team

- Severity: Medium 4.3
- Published: Jan 2, 2024
- Affected: all versions.

### [CVE-2023-50333](https://cve.now/CVE-2023-50333): Lack of restriction to manage group names for freshly demoted guests

- Severity: Low 3.7
- Published: Jan 2, 2024
- Affected: all versions.

### [CVE-2023-48732](https://cve.now/CVE-2023-48732): Keywords that trigger mentions are leaked to other users

- Severity: Medium 4.3
- Published: Jan 2, 2024
- Affected: all versions.

### [CVE-2023-7113](https://cve.now/CVE-2023-7113): Mattermost version 8.1.6 and earlier fails to sanitize channel mention data in posts, which allows an attacker to inject markup in the web…

- Severity: Low 3.7
- Published: Dec 29, 2023
- Affected: all versions.

### [CVE-2023-5968](https://cve.now/CVE-2023-5968): Password hash in response body after username update

- Severity: Medium 4.9
- Published: Nov 6, 2023
- Affected: fixed in 5.3.2-0.20230825233148-f787fd63368a.

### [CVE-2023-1776](https://cve.now/CVE-2023-1776): Stored XSS via SVG attachment on Boards

- Severity: High 7.3
- Published: Mar 31, 2023
- Affected: from 5.0.0, fixed in 7.1.6.

### [CVE-2023-1775](https://cve.now/CVE-2023-1775): Unsanitized events sent over Websocket to regular users in a High Availability environment

- Severity: Medium 4.3
- Published: Mar 31, 2023
- Affected: from 5.0.0, fixed in 7.1.6.

### [CVE-2023-1774](https://cve.now/CVE-2023-1774): Unauthorized email invite to a private channel

- Severity: Medium 4.2
- Published: Mar 31, 2023
- Affected: from 5.0.0, fixed in 7.1.6.

### [CVE-2022-2401](https://cve.now/CVE-2022-2401): Team members could access sensitive information of other users via an API call

- Severity: Medium 6.5
- Published: Jul 14, 2022
- Affected: all versions.

### [CVE-2022-1384](https://cve.now/CVE-2022-1384): Authorized users are allowed to install old plugin versions from the Marketplace

- Severity: Medium 4.7
- Published: Apr 19, 2022
- Affected: all versions.

### [CVE-2022-1385](https://cve.now/CVE-2022-1385): Invitation Email is resent as a Reminder after invalidating pending email invites

- Severity: Low 3.7
- Published: Apr 19, 2022
- Affected: all versions.

### [CVE-2022-1332](https://cve.now/CVE-2022-1332): Restricted custom admin role can bypass the restrictions and view the server logs and server config.json file contents

- Severity: Medium 4.3
- Published: Apr 13, 2022
- Affected: fixed in 5.37.9.

### [CVE-2022-1337](https://cve.now/CVE-2022-1337): OOM DoS in Mattermost image proxy

- Severity: Medium 4.3
- Published: Apr 13, 2022
- Affected: all versions.

### [CVE-2021-37860](https://cve.now/CVE-2021-37860): Mattermost 5.38 and earlier fails to sufficiently sanitize clipboard contents, which allows a user-assisted attacker to inject arbitrary…

- Severity: Low 3.7
- Published: Sep 22, 2021
- Affected: fixed in 5.39.0.

### [CVE-2018-21258](https://cve.now/CVE-2018-21258): An issue was discovered in Mattermost Server before 5.1.

- Severity: Unrated
- Published: Jun 19, 2020
- Affected: fixed in 5.1.0.

### [CVE-2020-14457](https://cve.now/CVE-2020-14457): An issue was discovered in Mattermost Server before 5.20.0.

- Severity: Unrated
- Published: Jun 19, 2020
- Affected: fixed in 5.20.0.

---

Source: cve.now
Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards.
Page: https://cve.now/packages/go/github.com/mattermost/mattermost-server/v5
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.