Mattermost vulnerabilities
512 CVEs and advisories name Mattermost as an affected vendor, newest first. Follow it as a feed.
- CVE-2024-8071System Role with edit access to permissions can elevate themselves to system admin
- CVE-2024-42411User creation date manipulation in POST /api/v4/users
- CVE-2024-40886One-click Client-Side Path Traversal Leading to CSRF in User Management admin page
- CVE-2024-43813IDOR when marking read a user's channel
- CVE-2024-39810Server crash via Elasticsearch certificate file
- CVE-2024-32939Email addresses of remote users visible in props regardless of server settings
- CVE-2024-39836Munged email address used for password resets and notifications
- CVE-2024-41926Malicious remote can claim that a user was synced from another remote
- CVE-2024-41162Malicious remote can make an arbitrary local channel read-only
- CVE-2024-41144Malicious remote can create/update/delete arbitrary posts in arbitrary channels
- CVE-2024-39839Remote username set to an arbitrary string by remote user
- CVE-2024-39837Malicious remote can create arbitrary channels
- CVE-2024-39832Permanently local data deletion by malicious remote
- CVE-2024-39777Malicious remote can invite itself to an arbitrary local channel
- CVE-2024-39274Malicious remote can add users to arbitrary teams and channels
- CVE-2024-36492Existing local user overwritten by malicious remote
- CVE-2024-29977Malicious remote can create arbitrary reactions on arbitrary posts
- CVE-2024-39767Spoofed push notifications from malicious server
- CVE-2024-32945LaTeX post content manipulation via renderer state leak across contexts
- CVE-2024-6428Limited DoS due to permitting creating users with user-defined IDs
- CVE-2024-39353RemoteClusterFrame payloads are audit logged in full
- CVE-2024-39361Creating posts with user-defined IDs permitted in CreatePost API
- CVE-2024-39830Timing attack during remote cluster token comparison when shared channels are enabled
- CVE-2024-39807Channel IDs of archived/restored channels leaked via webhook events
- CVE-2024-36257Lack of permission check when updating the profile picture of a remote user (shared channels enabled)
- CVE-2024-37182Lack of permissions prompting when opening external URLs
- CVE-2024-36287Bypass of TCC restrictions on macOS
- CVE-2024-29215Slash commands run in channel without channel membership via playbook task commands
- CVE-2024-36255Post actions can run playbook checklist task commands
- CVE-2024-36241/playbook add slash command allows viewing arbitrary post contents