# Mattermost. Every CVE that names Mattermost among its affected products, newest first. Vendors and products are as the CNA wrote them. ## Records, newest first (an older page) - [IDOR when marking read a user's channel](https://agentprime.io/advisories/CVE-2024-43813.md) `CVE-2024-43813` · CVE record: Mattermost Mattermost · CVSS 4.3 Medium · Not analysed yet · Published 22 Aug 2024 · Tags: Broken access control - [Server crash via Elasticsearch certificate file](https://agentprime.io/advisories/CVE-2024-39810.md) `CVE-2024-39810` · CVE record: Mattermost Mattermost · CVSS 4.9 Medium · Not analysed yet · Published 22 Aug 2024 · Tags: Denial of service - [Spoofed push notifications from malicious server](https://agentprime.io/advisories/CVE-2024-39767.md) `CVE-2024-39767` · CVE record: Mattermost Mattermost · CVSS 4.2 Medium · Not analysed yet · Published 15 Jul 2024 · Tags: Authentication bypass - [LaTeX post content manipulation via renderer state leak across contexts](https://agentprime.io/advisories/CVE-2024-32945.md) `CVE-2024-32945` · CVE record: Mattermost Mattermost · CVSS 2.6 Low · Not analysed yet · Published 15 Jul 2024 · Tags: CWE-909 - [Limited DoS due to permitting creating users with user-defined IDs](https://agentprime.io/advisories/CVE-2024-6428.md) `CVE-2024-6428` · CVE record: Mattermost Mattermost · CVSS 5.3 Medium · Not analysed yet · Published 3 Jul 2024 · Tags: Broken access control - [RemoteClusterFrame payloads are audit logged in full](https://agentprime.io/advisories/CVE-2024-39353.md) `CVE-2024-39353` · CVE record: Mattermost Mattermost · CVSS 2.7 Low · Not analysed yet · Published 3 Jul 2024 · Tags: Information disclosure - [Creating posts with user-defined IDs permitted in CreatePost API](https://agentprime.io/advisories/CVE-2024-39361.md) `CVE-2024-39361` · CVE record: Mattermost Mattermost · CVSS 3.1 Low · Not analysed yet · Published 3 Jul 2024 · Tags: Broken access control - [Timing attack during remote cluster token comparison when shared channels are enabled](https://agentprime.io/advisories/CVE-2024-39830.md) `CVE-2024-39830` · CVE record: Mattermost Mattermost · CVSS 8.1 High · Not analysed yet · Published 3 Jul 2024 · Tags: Authentication bypass - [Channel IDs of archived/restored channels leaked via webhook events](https://agentprime.io/advisories/CVE-2024-39807.md) `CVE-2024-39807` · CVE record: Mattermost Mattermost · CVSS 3.1 Low · Not analysed yet · Published 3 Jul 2024 · Tags: Information disclosure - [Lack of permission check when updating the profile picture of a remote user (shared channels enabled)](https://agentprime.io/advisories/CVE-2024-36257.md) `CVE-2024-36257` · CVE record: Mattermost Mattermost · CVSS 2.7 Low · Not analysed yet · Published 3 Jul 2024 · Tags: Broken access control - [Slash commands run in channel without channel membership via playbook task commands](https://agentprime.io/advisories/CVE-2024-29215.md) `CVE-2024-29215` · CVE record: Mattermost Mattermost · CVSS 4.3 Medium · Not analysed yet · Published 26 May 2024 · Tags: Broken access control - [Post actions can run playbook checklist task commands](https://agentprime.io/advisories/CVE-2024-36255.md) `CVE-2024-36255` · CVE record: Mattermost Mattermost · CVSS 5.7 Medium · Not analysed yet · Published 26 May 2024 · Tags: Cross-site request forgery (CSRF) - [/playbook add slash command allows viewing arbitrary post contents](https://agentprime.io/advisories/CVE-2024-36241.md) `CVE-2024-36241` · CVE record: Mattermost Mattermost · CVSS 3.1 Low · Not analysed yet · Published 26 May 2024 · Tags: Broken access control - [Member promoted to channel admin via playbooks run linking to channel](https://agentprime.io/advisories/CVE-2024-31859.md) `CVE-2024-31859` · CVE record: Mattermost Mattermost · CVSS 4.3 Medium · Not analysed yet · Published 26 May 2024 · Tags: Broken access control - [SAML to email switch possible when email signin is disabled](https://agentprime.io/advisories/CVE-2024-5270.md) `CVE-2024-5270` · CVE record: Mattermost Mattermost · CVSS 4.3 Medium · Not analysed yet · Published 26 May 2024 · Tags: Broken access control - [Run Details leak to guest via webhook event "custom_playbooks_playbook_run_updated"](https://agentprime.io/advisories/CVE-2024-5272.md) `CVE-2024-5272` · CVE record: Mattermost Mattermost · CVSS 4.3 Medium · Not analysed yet · Published 26 May 2024 · Tags: Broken access control - [Playbook run link to private channel grants channel access](https://agentprime.io/advisories/CVE-2024-32045.md) `CVE-2024-32045` · CVE record: Mattermost Mattermost · CVSS 5.9 Medium · Not analysed yet · Published 26 May 2024 · Tags: Broken access control - [Playbook Run Metadata leak to Guest](https://agentprime.io/advisories/CVE-2024-34152.md) `CVE-2024-34152` · CVE record: Mattermost Mattermost · CVSS 4.3 Medium · Not analysed yet · Published 26 May 2024 · Tags: Broken access control - [AD/LDAP Group Members Leak](https://agentprime.io/advisories/CVE-2024-34029.md) `CVE-2024-34029` · CVE record: Mattermost Mattermost · CVSS 4.3 Medium · Not analysed yet · Published 26 May 2024 · Tags: Information disclosure - [Uncontrolled resource consumption in Mattermost](https://agentprime.io/advisories/CVE-2024-3872.md) `CVE-2024-3872` · CVE record: Mattermost Mattermost · CVSS 3.1 Low · Not analysed yet · Published 16 Apr 2024 · Tags: Denial of service - [Reflected XSS in Mattermost Jira plugin](https://agentprime.io/advisories/CVE-2024-2445.md) `CVE-2024-2445` · CVE record: Mattermost Mattermost · CVSS 6.1 Medium · Not analysed yet · Published 15 Mar 2024 · Tags: Other injection - [Improper authentication in Mattermost](https://agentprime.io/advisories/CVE-2024-2450.md) `CVE-2024-2450` · CVE record: Mattermost Mattermost · CVSS 8.8 High · Not analysed yet · Published 15 Mar 2024 · Tags: Authentication bypass - [Uncontrolled resource consumption in Mattermost](https://agentprime.io/advisories/CVE-2024-2446.md) `CVE-2024-2446` · CVE record: Mattermost Mattermost · CVSS 4.3 Medium · Not analysed yet · Published 15 Mar 2024 · Tags: Denial of service - [Injection in Mattermost](https://agentprime.io/advisories/CVE-2023-7114.md) `CVE-2023-7114` · CVE record: Mattermost Mattermost · CVSS 7.1 High · Not analysed yet · Published 29 Dec 2023 · Tags: Other injection - [Leak Inaccessible Playbook Information via Channel Action IDOR](https://agentprime.io/advisories/CVE-2023-6727.md) `CVE-2023-6727` · CVE record: Mattermost Mattermost · CVSS 3.1 Low · Not analysed yet · Published 12 Dec 2023 · Tags: Information disclosure - [Reflected client side path traversal leading to CSRF in Playbooks](https://agentprime.io/advisories/CVE-2023-45316.md) `CVE-2023-45316` · CVE record: Mattermost Mattermost · CVSS 7.3 High · Not analysed yet · Published 12 Dec 2023 · Tags: Cross-site request forgery (CSRF) - [Playbooks access/modification by removed team member](https://agentprime.io/advisories/CVE-2023-6547.md) `CVE-2023-6547` · CVE record: Mattermost Mattermost · CVSS 3.7 Low · Not analysed yet · Published 12 Dec 2023 · Tags: Broken access control - [Playbook plugin crash via missing interface type assertion](https://agentprime.io/advisories/CVE-2023-49607.md) `CVE-2023-49607` · CVE record: Mattermost Mattermost · CVSS 4.3 Medium · Not analysed yet · Published 12 Dec 2023 · Tags: CWE-754 - [Todo plugin gets crashed and disabled by member](https://agentprime.io/advisories/CVE-2023-49809.md) `CVE-2023-49809` · CVE record: Mattermost Mattermost · CVSS 4.3 Medium · Not analysed yet · Published 12 Dec 2023 · Tags: Denial of service - [Inaccessible Post Information Leak via Run Timeline IDOR](https://agentprime.io/advisories/CVE-2023-46701.md) `CVE-2023-46701` · CVE record: Mattermost Mattermost · CVSS 6.5 Medium · Not analysed yet · Published 12 Dec 2023 · Tags: Information disclosure - [IDOR when updating the tasks of a private playbook run](https://agentprime.io/advisories/CVE-2023-49874.md) `CVE-2023-49874` · CVE record: Mattermost Mattermost · CVSS 4.3 Medium · Not analysed yet · Published 12 Dec 2023 · Tags: Broken access control - [Playbook Plugin Crash via Run Checklist](https://agentprime.io/advisories/CVE-2023-45847.md) `CVE-2023-45847` · CVE record: Mattermost Mattermost · CVSS 4.3 Medium · Not analysed yet · Published 12 Dec 2023 · Tags: Denial of service - [Mobile app freezes when receiving a post with hundreds of emojis](https://agentprime.io/advisories/CVE-2023-5522.md) `CVE-2023-5522` · CVE record: Mattermost Mattermost · CVSS 4.3 Medium · Not analysed yet · Published 17 Oct 2023 · Tags: Denial of service - [Mattermost Desktop logs all keystrokes during initial run after fresh installation](https://agentprime.io/advisories/CVE-2023-5339.md) `CVE-2023-5339` · CVE record: Mattermost Mattermost · CVSS 4.7 Medium · Not analysed yet · Published 17 Oct 2023 · Tags: Information disclosure - [Denial of Service via multiple identical User IDs in /api/v4/users/ids](https://agentprime.io/advisories/CVE-2023-5333.md) `CVE-2023-5333` · CVE record: Mattermost Mattermost · CVSS 4.3 Medium · Not analysed yet · Published 9 Oct 2023 · Tags: Denial of service - [File Information Leak via IDOR in file_id in Draft Posts](https://agentprime.io/advisories/CVE-2023-5331.md) `CVE-2023-5331` · CVE record: Mattermost Mattermost · CVSS 4.3 Medium · Not analysed yet · Published 9 Oct 2023 · Tags: Broken access control - [Denial of Service via Opengraph Data Cache](https://agentprime.io/advisories/CVE-2023-5330.md) `CVE-2023-5330` · CVE record: Mattermost Mattermost · CVSS 4.3 Medium · Not analysed yet · Published 9 Oct 2023 · Tags: Denial of service - [Full name disclosure via team top membership with Show Full Name option disabled](https://agentprime.io/advisories/CVE-2023-5160.md) `CVE-2023-5160` · CVE record: Mattermost Mattermost · CVSS 4.3 Medium · Not analysed yet · Published 2 Oct 2023 · Tags: Information disclosure - [Parameter tampering in the registration resulting in blocked accounts to be created](https://agentprime.io/advisories/CVE-2023-4478.md) `CVE-2023-4478` · CVE record: Mattermost Mattermost · CVSS 4.3 Medium · Not analysed yet · Published 25 Aug 2023 · Tags: Other injection - [Server crash via a specially crafted markdown input](https://agentprime.io/advisories/CVE-2023-3593.md) `CVE-2023-3593` · CVE record: Mattermost Mattermost · CVSS 4.3 Medium · Not analysed yet · Published 17 Jul 2023 · Tags: Denial of service - [Denial of Service via specially crafted gif image](https://agentprime.io/advisories/CVE-2023-3614.md) `CVE-2023-3614` · CVE record: Mattermost Mattermost · CVSS 4.3 Medium · Not analysed yet · Published 17 Jul 2023 · Tags: Denial of service - [Lack of previous password reset tokens on new token creation](https://agentprime.io/advisories/CVE-2023-3591.md) `CVE-2023-3591` · CVE record: Mattermost Mattermost · CVSS 4.8 Medium · Not analysed yet · Published 17 Jul 2023 · Tags: Authentication bypass - [Deleted attachments in Boards remain accessible](https://agentprime.io/advisories/CVE-2023-3590.md) `CVE-2023-3590` · CVE record: Mattermost Mattermost · CVSS 3.1 Low · Not analysed yet · Published 17 Jul 2023 · Tags: Broken access control - [Inconsistent state in UI after boards permission change by system admin](https://agentprime.io/advisories/CVE-2023-3587.md) `CVE-2023-3587` · CVE record: Mattermost Mattermost · CVSS 2.7 Low · Not analysed yet · Published 17 Jul 2023 · Tags: Broken access control - [Disabling publicly-shared boards does not disable existing publicly available board links](https://agentprime.io/advisories/CVE-2023-3586.md) `CVE-2023-3586` · CVE record: Mattermost Mattermost · CVSS 4.2 Medium · Not analysed yet · Published 17 Jul 2023 · Tags: Broken access control - [channel DoS by sharing a boards link](https://agentprime.io/advisories/CVE-2023-3585.md) `CVE-2023-3585` · CVE record: Mattermost Mattermost · CVSS 4.3 Medium · Not analysed yet · Published 17 Jul 2023 · Tags: Denial of service - [Member can create team with team override scheme](https://agentprime.io/advisories/CVE-2023-3584.md) `CVE-2023-3584` · CVE record: Mattermost Mattermost · CVSS 3.1 Low · Not analysed yet · Published 17 Jul 2023 · Tags: Broken access control - [Lack of channel membership check when linking a board to a channel](https://agentprime.io/advisories/CVE-2023-3582.md) `CVE-2023-3582` · CVE record: Mattermost Mattermost · CVSS 4.3 Medium · Not analysed yet · Published 17 Jul 2023 · Tags: Broken access control - [WebSockets accept connections from HTTPS origin](https://agentprime.io/advisories/CVE-2023-3581.md) `CVE-2023-3581` · CVE record: Mattermost Mattermost · CVSS 6.2 Medium · Not analysed yet · Published 17 Jul 2023 · Tags: CWE-346 - [Limited blind SSRF to localhost/intranet in interactive dialog implementation](https://agentprime.io/advisories/CVE-2023-3577.md) `CVE-2023-3577` · CVE record: Mattermost Mattermost · CVSS 3.5 Low · Not analysed yet · Published 17 Jul 2023 · Tags: Server-side request forgery (SSRF) - [Specially crafted search query can cause large log entries in postgres](https://agentprime.io/advisories/CVE-2023-2785.md) `CVE-2023-2785` · CVE record: Mattermost Mattermost · CVSS 4.3 Medium · Not analysed yet · Published 16 Jun 2023 · Tags: Denial of service - [Denial of Service while unescaping a Markdown string](https://agentprime.io/advisories/CVE-2023-2831.md) `CVE-2023-2831` · CVE record: Mattermost Mattermost · CVSS 4.3 Medium · Not analysed yet · Published 16 Jun 2023 · Tags: Denial of service - [Stack exhaustion in PreparePostForClientWithEmbedsAndImages](https://agentprime.io/advisories/CVE-2023-2793.md) `CVE-2023-2793` · CVE record: Mattermost Mattermost · CVSS 6.5 Medium · Not analysed yet · Published 16 Jun 2023 · Tags: Denial of service - [Ephemeral messages return private channel contents in permalink previews](https://agentprime.io/advisories/CVE-2023-2792.md) `CVE-2023-2792` · CVE record: Mattermost Mattermost · CVSS 6.5 Medium · Not analysed yet · Published 16 Jun 2023 · Tags: Information disclosure - [Playbooks lets you edit arbitrary posts](https://agentprime.io/advisories/CVE-2023-2791.md) `CVE-2023-2791` · CVE record: Mattermost Mattermost · CVSS 4.3 Medium · Not analysed yet · Published 16 Jun 2023 · Tags: Broken access control - [Deactivated user can retain access using oauth2 api](https://agentprime.io/advisories/CVE-2023-2788.md) `CVE-2023-2788` · CVE record: Mattermost Mattermost · CVSS 6.2 Medium · Not analysed yet · Published 16 Jun 2023 · Tags: Broken access control - [Collapsed Reply Threads APIs leak message contents from private channels](https://agentprime.io/advisories/CVE-2023-2787.md) `CVE-2023-2787` · CVE record: Mattermost Mattermost · CVSS 6.5 Medium · Not analysed yet · Published 16 Jun 2023 · Tags: Broken access control - [Channel commands execution doesn't properly verify permissions](https://agentprime.io/advisories/CVE-2023-2786.md) `CVE-2023-2786` · CVE record: Mattermost Mattermost · CVSS 4.3 Medium · Not analysed yet · Published 16 Jun 2023 · Tags: Broken access control - [Lack of URL normalization allows rendering previews for disallowed domains](https://agentprime.io/advisories/CVE-2023-2808.md) `CVE-2023-2808` · CVE record: Mattermost Mattermost · CVSS 4.3 Medium · Not analysed yet · Published 29 May 2023 · Tags: CWE-20 - [DB username/password revealed in application logs](https://agentprime.io/advisories/CVE-2023-2514.md) `CVE-2023-2514` · CVE record: Mattermost Mattermost · CVSS 6.7 Medium · Not analysed yet · Published 12 May 2023 · Tags: Information disclosure Newest: Older: ## Filters and formats Filters are query parameters on this URL: `q` (words, as in a web search engine: `"a phrase"`, `OR`, `-word`; an id; a package or product name), `severity` (low, medium, high or critical), `critical=1`, `kev=1`, `ecosystem` (npm, pypi, packagist, go, maven, rubygems, crates, nuget, hex), `kind=package`, `assigner` (a CNA’s short name), `min_score` and `state`. Each record’s title links to its Markdown page. - The same list as JSON: - Every list: , critical: ; by weakness: and the other tags in ; by technology: `/advisories/technology/.md` (`fortinet-fortimail`) --- The web page: . Everything for agents: .