Mattermost vulnerabilities
512 CVEs and advisories name Mattermost as an affected vendor, newest first. Follow it as a feed.
- CVE-2024-31859Member promoted to channel admin via playbooks run linking to channel
- CVE-2024-5270SAML to email switch possible when email signin is disabled
- CVE-2024-5272Run Details leak to guest via webhook event "custom_playbooks_playbook_run_updated"
- CVE-2024-32045Playbook run link to private channel grants channel access
- CVE-2024-34152Playbook Run Metadata leak to Guest
- CVE-2024-34029AD/LDAP Group Members Leak
- CVE-2024-4198Mattermost versions 9.6.0, 9.5.x before 9.5.3, and 8.1.x before 8.1.12 fail to fully validate role changes which allows an attacker authenti
- CVE-2024-4195Mattermost versions 9.6.0, 9.5.x before 9.5.3, and 8.1.x before 8.1.12 fail to fully validate role changes, which allows an attacker authent
- CVE-2024-4183Mattermost versions 8.1.x before 8.1.12, 9.6.x before 9.6.1, 9.5.x before 9.5.3, 9.4.x before 9.4.5 fail to limit the number of active sessi
- CVE-2024-4182Mattermost versions 9.6.0, 9.5.x before 9.5.3, 9.4.x before 9.4.5, and 8.1.x before 8.1.12 fail to handle JSON parsing errors in custom stat
- CVE-2024-32046Detailed error discloses full file path with dev mode off
- CVE-2024-22091Excessive resource consumption due to lack to request path size limits
- CVE-2024-3872Mattermost Mobile app versions 2.13.0 and earlier use a regular expression with polynomial complexity to parse certain deeplinks, which allo
- CVE-2024-2447Mattermost versions 8.1.x before 8.1.11, 9.3.x before 9.3.3, 9.4.x before 9.4.4, and 9.5.x before 9.5.2 fail to authenticate the source of c
- CVE-2024-29221Invite ID available to team admins even without the "Add Members" permission
- CVE-2024-28949DoS via a large number of User Preferences
- CVE-2024-21848Users maintain access to active call after being removed from a channel
- CVE-2024-2445Reflected XSS in Mattermost Jira plugin
- CVE-2024-2450Mattermost versions 8.1.x before 8.1.10, 9.2.x before 9.2.6, 9.3.x before 9.3.2, and 9.4.x before 9.4.3 fail to correctly verify account own
- CVE-2024-2446Mattermost versions 8.1.x before 8.1.10, 9.2.x before 9.2.6, 9.3.x before 9.3.2, and 9.4.x before 9.4.3 fail to limit the number of @-mentio
- CVE-2024-28053Resource Exhaustion via the Invitation Feature
- CVE-2024-24975 Denial of Service for mobile app users due to automatic code highlighting
- CVE-2024-1953Mattermost versions 8.1.x before 8.1.9, 9.2.x before 9.2.5, 9.3.0, and 9.4.x before 9.4.2 fail to limit the number of role names requested f
- CVE-2024-1952Mattermost version 8.1.x before 8.1.9 fails to sanitize data associated with permalinks when a plugin updates an ephemeral post, allowing an
- CVE-2024-1949A race condition in Mattermost versions 8.1.x before 8.1.9, and 9.4.x before 9.4.2 allows an authenticated attacker to gain unauthorized acc
- CVE-2024-1942Mattermost versions 8.1.x before 8.1.9, 9.2.x before 9.2.5, and 9.3.0 fail to sanitize the metadata on posts containing permalinks under spe
- CVE-2024-1888Existing server guests invited to the team by members without "invite_guest" permission
- CVE-2024-24988Excessive resource consumption when sending long emoji names in user custom status
- CVE-2024-1887Public channel post content accessible without membership when compliance export is enabled
- CVE-2024-23488Files of archived channels accessible with the “Allow users to view archived channels” option disabled