Mattermost.

Path traversal in Mattermost Agents plugin mention reminder allows plugin replacement via crafted post

• Mattermost
• Path traversal

Team admin can escalate a team member's permissions via the team member roles endpoint

• Mattermost
• Broken access control

Mattermost OpenID discovery endpoint request bypasses outbound connection filtering, allowing SSRF by a System Administrator

• Mattermost
• Server-side request forgery (SSRF)

Unbounded memory consumption during PDF text extraction

• Mattermost
• CWE-409

Mattermost allows authenticated users to trigger excessive memory allocation via crafted msgpack binary WebSocket frames

• Mattermost
• Denial of service

Improper post type validation on scheduled post endpoints

• Mattermost
• Broken access control

Insufficient length validation when parsing Zoom chat transcriptions

• Mattermost
• CWE-754

Null condition in Playbooks import crashes the plugin

• Mattermost
• CWE-754

Mattermost Server fails to restrict Slack import account binding, allowing team admins to forge posts as existing users

• Mattermost
• Broken access control

Mattermost local image proxy allows server memory exhaustion via unbounded image response buffering

• Mattermost
• Denial of service

Private team metadata disclosure via the team search API

• Mattermost
• Broken access control

Mattermost invitation tokens not bound to invited email address allowing unauthorized team and private channel access

• Mattermost
• Broken access control

Mattermost fails to reject OAuth application sessions in account type switch, allowing account takeover via bearer token

• Mattermost
• Broken access control

Improper order of authorisations in Mattermost GetFile API leads to an authenticated user to determine a post’s quarantined status

• Mattermost
• Information disclosure

Mattermost SAML RelayState forgery allows unauthorized team membership

• Mattermost
• CWE-472

Mattermost logs plaintext authentication tokens in debug-level server logs on failed auth attempts

• Mattermost
• Information disclosure

Mattermost leaks interactive-message integration secrets to non-admin users via post-deletion events and thread reads

• Mattermost
• Information disclosure

Private channel ID disclosure via user status endpoints

• Mattermost
• Information disclosure

Missing server side validation allowed user to quarantine a DM and GM post

• Mattermost
• Broken access control

Uncapped mention keys in user notification properties allow CPU exhaustion during post processing

• Mattermost
• Denial of service

Disclosure of AD/LDAP bind password via Test Connection

• Mattermost
• Information disclosure

Mattermost guest account privilege escalation via member roles API

• Mattermost
• Broken access control

Outgoing OAuth connection client secret exposure during connection validation

• Mattermost
• Information disclosure

Mattermost server missing request body size limit on plugin routes allows denial of service by an authenticated user

• Mattermost
• Denial of service

Mattermost server-side request forgery via OAuth endpoints configurable by a System Administrator

• Mattermost
• Server-side request forgery (SSRF)

Unbounded post ID array in the bulk reactions endpoint allows denial of service

• Mattermost
• Denial of service

Mattermost Desktop App Missing IPC Sender Validation in Calls Leave Handler

• Mattermost
• CWE-346

Mattermost Desktop App plugin popout scheme validation bypass

• Mattermost
• CWE-1287

Mattermost Desktop local network access from server-rendered content

• Mattermost
• CWE-346

Data Retention Teams Endpoint Leaks Private Team Invite ID

• Mattermost
• Broken access control

Mattermost DCR redirect URI allowlist bypass via improper URL component validation

• Mattermost
• Open redirect

Mattermost ABAC parent policy bypass via policy update endpoint

• Mattermost
• Broken access control

MS Calendar plugin: unrecovered handler panics from malformed post-action requests could crash the plugin process

• Mattermost
• CWE-704

Mattermost Server Algorithmic DoS via Unbounded Markdown Block Nesting

• Mattermost
• Denial of service

Unauthenticated webhook request with null notification entry could crash the Microsoft Calendar plugin.

• Mattermost
• CWE-754

Boards plugin denial of service via unvalidated block fields.properties

• Mattermost
• CWE-754

Missing property field ownership validation in Playbooks run property update endpoint

• Mattermost
• Broken access control

Playbooks run owner channel membership permission bypass

• Mattermost
• Broken access control

Unbounded zlib decompression in Calls SDP WebSocket messages

• Mattermost
• CWE-409

Uploading a crafted image causes excessive memory allocation in the Mattermost Server

• Mattermost
• CWE-409

Playbooks channel action update validation issue

• Mattermost
• Broken access control

Inconsistent authorization checks in Mattermost Boards endpoints

• Mattermost
• Broken access control

Mattermost Markdown autolink parsing denial of service

• Mattermost
• Denial of service

Fix authenticated members disabling file content indexing server-wide via extraction pool exhaustion

• Mattermost
• Denial of service

Board archive import bypasses team board creation permissions

• Mattermost
• Broken access control

Plaintext pre-auth secret exposure via Desktop App diagnostics report

• Mattermost
• Information disclosure

Mattermost thread memberships persist after team removal, exposing private channel thread metadata on re-invite

• Mattermost
• CWE-459

Mattermost Boards plugin didn’t enforce role-based authorization on board channel link allowing board editors to expose boards to arbitrary channels

• Mattermost
• Broken access control

Insufficient server-side validation of board member role fields permits privilege escalation

• Mattermost
• Broken access control

Boards plugin panics on WebSocket command with non-string field types

• Mattermost
• CWE-704

Boards plugin retains Board Admin rights for users demoted to System Guest

• Mattermost
• Broken access control

Missing per-channel team-scope check in ABAC access control policy unassign allows cross-team policy removal

• Mattermost
• Broken access control

Insufficient validation of guest board admin privileges on archive import

• Mattermost
• Broken access control

Delegated OAuth tokens could revoke unrelated OAuth application authorizations

• Mattermost
• Broken access control

_GitLab Plugin allows cross-channel post injection and phishing via missing channel permission checks in issue API endpoints_

• Mattermost
• Broken access control

Board channel linking without read channel permission validation

• Mattermost
• Broken access control

Missing run-state validation on finished playbook runs

• Mattermost
• Broken access control

Channel member roles accept out-of-scope roles

• Mattermost
• Broken access control

Boards archive import endpoint allows resource exhaustion via zip bomb and file size limit bypass in Mattermost

• Mattermost
• CWE-409

SAML certificate deletion allows path traversal to delete arbitrary files outside the config directory

• Mattermost
• Path traversal