Advisories · Technology
Mattermost.
Every CVE that names Mattermost among its affected products, newest first. Vendors and products are as the CNA wrote them; check the affected versions on each record.
- CVSS 4.3 Medium
IDOR when marking read a user's channel
- Mattermost
- Broken access control
- CVSS 4.9 Medium
Server crash via Elasticsearch certificate file
- Mattermost
- Denial of service
- CVSS 4.2 Medium
Spoofed push notifications from malicious server
- Mattermost
- Authentication bypass
- CVSS 2.6 Low
LaTeX post content manipulation via renderer state leak across contexts
- Mattermost
- CWE-909
- CVSS 5.3 Medium
Limited DoS due to permitting creating users with user-defined IDs
- Mattermost
- Broken access control
- CVSS 2.7 Low
RemoteClusterFrame payloads are audit logged in full
- Mattermost
- Information disclosure
- CVSS 3.1 Low
Creating posts with user-defined IDs permitted in CreatePost API
- Mattermost
- Broken access control
- CVSS 8.1 High
Timing attack during remote cluster token comparison when shared channels are enabled
- Mattermost
- Authentication bypass
- CVSS 3.1 Low
Channel IDs of archived/restored channels leaked via webhook events
- Mattermost
- Information disclosure
- CVSS 2.7 Low
Lack of permission check when updating the profile picture of a remote user (shared channels enabled)
- Mattermost
- Broken access control
- CVSS 4.3 Medium
Slash commands run in channel without channel membership via playbook task commands
- Mattermost
- Broken access control
- CVSS 5.7 Medium
Post actions can run playbook checklist task commands
- Mattermost
- Cross-site request forgery (CSRF)
- CVSS 3.1 Low
/playbook add slash command allows viewing arbitrary post contents
- Mattermost
- Broken access control
- CVSS 4.3 Medium
Member promoted to channel admin via playbooks run linking to channel
- Mattermost
- Broken access control
- CVSS 4.3 Medium
SAML to email switch possible when email signin is disabled
- Mattermost
- Broken access control
- CVSS 4.3 Medium
Run Details leak to guest via webhook event "custom_playbooks_playbook_run_updated"
- Mattermost
- Broken access control
- CVSS 5.9 Medium
Playbook run link to private channel grants channel access
- Mattermost
- Broken access control
- CVSS 4.3 Medium
Playbook Run Metadata leak to Guest
- Mattermost
- Broken access control
- CVSS 4.3 Medium
AD/LDAP Group Members Leak
- Mattermost
- Information disclosure
- CVSS 3.1 Low
Uncontrolled resource consumption in Mattermost
- Mattermost
- Denial of service
- CVSS 6.1 Medium
Reflected XSS in Mattermost Jira plugin
- Mattermost
- Other injection
- CVSS 8.8 High
Improper authentication in Mattermost
- Mattermost
- Authentication bypass
- CVSS 4.3 Medium
Uncontrolled resource consumption in Mattermost
- Mattermost
- Denial of service
- CVSS 7.1 High
Injection in Mattermost
- Mattermost
- Other injection
- CVSS 3.1 Low
Leak Inaccessible Playbook Information via Channel Action IDOR
- Mattermost
- Information disclosure
- CVSS 7.3 High
Reflected client side path traversal leading to CSRF in Playbooks
- Mattermost
- Cross-site request forgery (CSRF)
- CVSS 3.7 Low
Playbooks access/modification by removed team member
- Mattermost
- Broken access control
- CVSS 4.3 Medium
Playbook plugin crash via missing interface type assertion
- Mattermost
- CWE-754
- CVSS 4.3 Medium
Todo plugin gets crashed and disabled by member
- Mattermost
- Denial of service
- CVSS 6.5 Medium
Inaccessible Post Information Leak via Run Timeline IDOR
- Mattermost
- Information disclosure
- CVSS 4.3 Medium
IDOR when updating the tasks of a private playbook run
- Mattermost
- Broken access control
- CVSS 4.3 Medium
Playbook Plugin Crash via Run Checklist
- Mattermost
- Denial of service
- CVSS 4.3 Medium
Mobile app freezes when receiving a post with hundreds of emojis
- Mattermost
- Denial of service
- CVSS 4.7 Medium
Mattermost Desktop logs all keystrokes during initial run after fresh installation
- Mattermost
- Information disclosure
- CVSS 4.3 Medium
Denial of Service via multiple identical User IDs in /api/v4/users/ids
- Mattermost
- Denial of service
- CVSS 4.3 Medium
File Information Leak via IDOR in file_id in Draft Posts
- Mattermost
- Broken access control
- CVSS 4.3 Medium
Denial of Service via Opengraph Data Cache
- Mattermost
- Denial of service
- CVSS 4.3 Medium
Full name disclosure via team top membership with Show Full Name option disabled
- Mattermost
- Information disclosure
- CVSS 4.3 Medium
Parameter tampering in the registration resulting in blocked accounts to be created
- Mattermost
- Other injection
- CVSS 4.3 Medium
Server crash via a specially crafted markdown input
- Mattermost
- Denial of service
- CVSS 4.3 Medium
Denial of Service via specially crafted gif image
- Mattermost
- Denial of service
- CVSS 4.8 Medium
Lack of previous password reset tokens on new token creation
- Mattermost
- Authentication bypass
- CVSS 3.1 Low
Deleted attachments in Boards remain accessible
- Mattermost
- Broken access control
- CVSS 2.7 Low
Inconsistent state in UI after boards permission change by system admin
- Mattermost
- Broken access control
- CVSS 4.2 Medium
Disabling publicly-shared boards does not disable existing publicly available board links
- Mattermost
- Broken access control
- CVSS 4.3 Medium
channel DoS by sharing a boards link
- Mattermost
- Denial of service
- CVSS 3.1 Low
Member can create team with team override scheme
- Mattermost
- Broken access control
- CVSS 4.3 Medium
Lack of channel membership check when linking a board to a channel
- Mattermost
- Broken access control
- CVSS 6.2 Medium
WebSockets accept connections from HTTPS origin
- Mattermost
- CWE-346
- CVSS 3.5 Low
Limited blind SSRF to localhost/intranet in interactive dialog implementation
- Mattermost
- Server-side request forgery (SSRF)
- CVSS 4.3 Medium
Specially crafted search query can cause large log entries in postgres
- Mattermost
- Denial of service
- CVSS 4.3 Medium
Denial of Service while unescaping a Markdown string
- Mattermost
- Denial of service
- CVSS 6.5 Medium
Stack exhaustion in PreparePostForClientWithEmbedsAndImages
- Mattermost
- Denial of service
- CVSS 6.5 Medium
Ephemeral messages return private channel contents in permalink previews
- Mattermost
- Information disclosure
- CVSS 4.3 Medium
Playbooks lets you edit arbitrary posts
- Mattermost
- Broken access control
- CVSS 6.2 Medium
Deactivated user can retain access using oauth2 api
- Mattermost
- Broken access control
- CVSS 6.5 Medium
Collapsed Reply Threads APIs leak message contents from private channels
- Mattermost
- Broken access control
- CVSS 4.3 Medium
Channel commands execution doesn't properly verify permissions
- Mattermost
- Broken access control
- CVSS 4.3 Medium
Lack of URL normalization allows rendering previews for disallowed domains
- Mattermost
- CWE-20
- CVSS 6.7 Medium
DB username/password revealed in application logs
- Mattermost
- Information disclosure