Mattermost vulnerabilities
512 CVEs and advisories name Mattermost as an affected vendor, newest first. Follow it as a feed.
- CVE-2023-5968Password hash in response body after username update
- CVE-2023-5967Denial of Service via crashing the Calls Plugin
- CVE-2023-5920Lack Of Secure Keyboard Entry Protection in MacOS Desktop
- CVE-2023-5875Lack of Hardening against media exploitation from a remote origin
- CVE-2023-5876Regex DoS from a malicious server enrolled in Desktop
- CVE-2023-5522Mobile app freezes when receiving a post with hundreds of emojis
- CVE-2023-5339Mattermost Desktop logs all keystrokes during initial run after fresh installation
- CVE-2023-5333 Denial of Service via multiple identical User IDs in /api/v4/users/ids
- CVE-2023-5331File Information Leak via IDOR in file_id in Draft Posts
- CVE-2023-5330 Denial of Service via Opengraph Data Cache
- CVE-2023-5160Full name disclosure via team top membership with Show Full Name option disabled
- CVE-2023-5194A system/user manager can demote / deactivate another manager
- CVE-2023-5195A team member can soft delete other teams that they are not part of
- CVE-2023-5193System Role with manage posts permission can read posts of Direct Messages
- CVE-2023-5196DoS via Channel Notification Properties
- CVE-2023-5159A User Manager role with user edit permissions could manage/update bots
- CVE-2023-4478Parameter tampering in the registration resulting in blocked accounts to be created
- CVE-2023-4108Audit logging fails to sanitize post metadata
- CVE-2023-4107Incorrect authorization allows a user manager to update a system admin
- CVE-2023-4106A guest user can perform various actions on public playbooks
- CVE-2023-4105Attachment of deleted message in a thread remains accessible and downloadable
- CVE-2023-3593Server crash via a specially crafted markdown input
- CVE-2023-3615Lack of server certificate validation in websockets connection
- CVE-2023-3614Denial of Service via specially crafted gif image
- CVE-2023-3613Guest accounts invited and added to channels by Welcomebot plugin
- CVE-2023-3591Lack of previous password reset tokens on new token creation
- CVE-2023-3590Deleted attachments in Boards remain accessible
- CVE-2023-3587Inconsistent state in UI after boards permission change by system admin
- CVE-2023-3586 Disabling publicly-shared boards does not disable existing publicly available board links
- CVE-2023-3585channel DoS by sharing a boards link