Mattermost vulnerabilities
512 CVEs and advisories name Mattermost as an affected vendor, newest first. Follow it as a feed.
- CVE-2024-23493 Team associated AD/LDAP Groups Leaked due to missing authorization
- CVE-2024-1402Denial of service in mattermost mobile apps and server via emoji reactions
- CVE-2024-24776 Incorrect Authorization leads to Channel Member Count Leak
- CVE-2024-24774Missing authorization allows users to access arbitrary security levels on Jira through webhooks (Jira Plugin)
- CVE-2024-23319CSRF issue allows disconnecting a user's Jira connection through a simple post message (Jira Plugin)
- CVE-2023-47858Details of archived public channels are leaked to members of another team
- CVE-2023-50333Lack of restriction to manage group names for freshly demoted guests
- CVE-2023-48732Keywords that trigger mentions are leaked to other users
- CVE-2023-7114Mattermost version 2.10.0 and earlier fails to sanitize deeplink paths, which allows an attacker to perform CSRF attacks against the server.
- CVE-2023-7113Mattermost version 8.1.6 and earlier fails to sanitize channel mention data in posts, which allows an attacker to inject markup in the web c
- CVE-2023-6727Leak Inaccessible Playbook Information via Channel Action IDOR
- CVE-2023-45316Reflected client side path traversal leading to CSRF in Playbooks
- CVE-2023-6547Playbooks access/modification by removed team member
- CVE-2023-49607Playbook plugin crash via missing interface type assertion
- CVE-2023-49809Todo plugin gets crashed and disabled by member
- CVE-2023-46701Inaccessible Post Information Leak via Run Timeline IDOR
- CVE-2023-49874IDOR when updating the tasks of a private playbook run
- CVE-2023-45847 Playbook Plugin Crash via Run Checklist
- CVE-2023-6459Public endpoint /metrics of Calls plugin reveals channel IDs
- CVE-2023-6458Client side path traversal due to lack of route parameters validation
- CVE-2023-47168Open redirect in /oauth/<service>/mobile_login?redirect_to=
- CVE-2023-6202Insecure Direct Object Reference in /plugins/focalboard/ api/v2/users of Mattermost Boards
- CVE-2023-43754Permalink previews displayed for posts in archived channels even if users are disallowed to view archived channels
- CVE-2023-48369Log Flooding due to specially crafted requests in different endpoints
- CVE-2023-35075HTML injection via channel autocomplete
- CVE-2023-40703Denial of Service via specially crafted block fields in Mattermost Boards
- CVE-2023-48268Denial of Service via Board Import Zip Bomb
- CVE-2023-45223Users full name disclosure through Mattermost Boards with Show Full Name Option disabled
- CVE-2023-47865Username and Icon override can be used by members when Hardened Mode is enabled
- CVE-2023-5969 Denial of Service via Link Preview in /api/v4/redirect_location