Mattermost vulnerabilities
512 CVEs and advisories name Mattermost as an affected vendor, newest first. Follow it as a feed.
- CVE-2023-27264IDOR: Updating a playbook via the Playbooks API
- CVE-2023-27263IDOR: Accessing playbook runs via the Playbooks Runs API
- CVE-2022-4045Authenticated user could send multiple requests containing a parameter which could fetch a large amount of data and can crash a Mattermost server
- CVE-2022-4044Authenticated user could send multiple requests containing a large Auto Responder Message payload and can crash a Mattermost server
- CVE-2022-4019Authenticated user could send multiple requests containing a large payload to a Playbooks API and can crash a Mattermost server
- CVE-2022-3257Server-side Denial of Service while processing a specifically crafted GIF file
- CVE-2022-3147Server-side Denial of Service while processing a specifically crafted JPEG file
- CVE-2022-2408Guest accounts can list all public channels
- CVE-2022-2406Malicious imports can lead to Denial of Service
- CVE-2022-2401Team members could access sensitive information of other users via an API call
- CVE-2022-2366Incorrect defaults can cause attackers to bypass rate limitations
- CVE-2022-1982A crafted SVG attachment can crash a Mattermost server
- CVE-2022-1548Playbook members are allowed to escalate their membership privileges and perform actions restricted to playbook admins.
- CVE-2022-1384Authorized users are allowed to install old plugin versions from the Marketplace
- CVE-2022-1385Invitation Email is resent as a Reminder after invalidating pending email invites
- CVE-2022-1332Restricted custom admin role can bypass the restrictions and view the server logs and server config.json file contents
- CVE-2022-1333A specifically drafted Playbook could trigger large amount of webhook requests leading to Denial of Service
- CVE-2022-1337OOM DoS in Mattermost image proxy
- CVE-2022-1002HTML Injection while inviting Guests
- CVE-2022-1003Sysadmin can override existing configs & bypass restrictions like EnableUploads
- CVE-2022-0904Stack overflow in document extractor in Mattermost
- CVE-2022-0903Stack overflow in SAML login in Mattermost
- CVE-2022-0708Team Creator's Email Address is disclosed to Team Members via one of the APIs
- CVE-2021-37864Users can view the contents of an archived channel when access is explicitly denied by the system admin
- CVE-2021-37867Emails of all users are exposed via one of the Boards APIs
- CVE-2021-37866Session is not invalidated on server-side when user logged out of Boards
- CVE-2021-37865Server-side Denial of Service while processing a specifically crafted GIF file
- CVE-2021-37863Mattermost 6.0 and earlier fails to sufficiently validate parameters during post creation, which allows authenticated attackers to cause a c
- CVE-2021-37862Mattermost 6.0 and earlier fails to sufficiently validate the email address during registration, which allows attackers to trick users into
- CVE-2021-37861Mattermost 6.0.2 and earlier fails to sufficiently sanitize user's password in audit logs when user creation fails.