Advisories · Technology
Mattermost.
Every CVE that names Mattermost among its affected products, newest first. Vendors and products are as the CNA wrote them; check the affected versions on each record.
- CVSS 6.5 Medium
Mattermost Server Denial of Service via Animated GIF Emoji Upload
- Mattermost
- CWE-409
- CVSS 4.3 Medium
Denial of service via unbounded document content extraction in Mattermost Server
- Mattermost
- Denial of service
- CVSS 6.5 Medium
Posting a malicious markdown image crashes the Mattermost Desktop App
- Mattermost
- CWE-754
- CVSS 5.7 Medium
Mattermost Desktop App crashes when malformed arguments are provided to some exposed IPC methods
- Mattermost
- Denial of service
- CVSS 4.3 Medium
Unscoped updates to other playbooks' metric configuration
- Mattermost
- Broken access control
- CVSS 3.8 Low
Mattermost schemes teams endpoint exposes private team invite IDs
- Mattermost
- Broken access control
- CVSS 4.3 Medium
Remote cluster metadata enumeration via /share-channel autocomplete
- Mattermost
- Broken access control
- CVSS 5.4 Medium
Deactivated guest accounts can authenticate via magic-link token in Mattermost REST API login endpoint
- Mattermost
- CWE-305
- CVSS 6.5 Medium
Crafted message attachment causes client-side denial of service via markdown parser regex backtracking in Mattermost
- Mattermost
- Denial of service
- CVSS 6.5 Medium
Unauthorized users can trigger interactive post actions in private channels via action cookie channel mismatch in Mattermost
- Mattermost
- Broken access control
- CVSS 5.4 Medium
Ordinary group/direct message member can enable group_constrained and remove all channel participants
- Mattermost
- Broken access control
- CVSS 4.9 Medium
Incoming webhook user attribution via unvalidated webhook owner
- Mattermost
- Broken access control
- CVSS 4.3 Medium
Authenticated remote cluster can modify or delete posts it does not own in Mattermost Connected Workspaces shared channels
- Mattermost
- Broken access control
- CVSS 5.9 Medium
Deactivated user accounts can continue to obtain valid OAuth access tokens via refresh token grant in Mattermost
- Mattermost
- CWE-305
- CVSS 6.5 Medium
SSRF via unvalidated attachment URLs in Mattermost Agents plugin MCP server
- Mattermost
- Server-side request forgery (SSRF)
- CVSS 6.8 Medium
Mattermost Agents plugin logs unsanitized OpenAI API keys on authentication errors
- Mattermost
- Information disclosure
- CVSS 3.5 Low
Markdown image rendering bypass in AI bot tool result posts in Mattermost
- Mattermost
- CWE-693
- CVSS 6.5 Medium
Overly long URLs crash the Mattermost Desktop App
- Mattermost
- Denial of service
- CVSS 6.3 Medium
Mattermost Desktop App fails to restrict the allow list of domains which NTLM credentials are passed
- Mattermost
- Hard-coded credentials
- CVSS 8.0 High
Path traversal in Mattermost Legal Hold plugin via unsanitized file name from federated peer allows arbitrary file write.
- Mattermost
- Path traversal
- CVSS 6.1 Medium
Mobile SSO authentication flow allows credential theft via malicious server
- Mattermost
- Cross-site request forgery (CSRF)
- CVSS 6.5 Medium
Opening a window with {{javascript:alert()}} as URL causes crash in the Mattermost Desktop App
- Mattermost
- CWE-939
- CVSS 3.5 Low
Calling window.close() from server-side content causes crash in the Mattermost Desktop App
- Mattermost
- CWE-754
- CVSS 6.5 Medium
Instance and webhook GitLab plugin commands were able to be run by non-admin users
- Mattermost
- Broken access control
- CVSS 4.3 Medium
Incomplete group locking implementation
- Mattermost
- Broken access control
- CVSS 4.3 Medium
Group prefix matching bypass for subscriptions
- Mattermost
- Broken access control
- CVSS 8.3 High
Authorization Bypass in Mattermost Legal Hold Plugin Due to Missing Return After Permission Check
- Mattermost
- Broken access control
- CVSS 2.2 Low
Missing timestamp validation in Zoom webhook handler
- Mattermost
- CWE-754
- CVSS 4.9 Medium
Improper Input Validation in Zoom Plugin Webhook Handler
- Mattermost
- Denial of service
- CVSS 4.3 Medium
Permalink Preview Information Disclosure After Permission Revocation
- Mattermost
- CWE-672
- CVSS 3.8 Low
Team Admin Privilege Escalation to Demote Members to Guest
- Mattermost
- Broken access control
- CVSS 5.8 Medium
DoS in Calls plugin via malformed msgpack in websocket request.
- Mattermost
- CWE-1287
- CVSS 6.6 Medium
Admin RCE via Malicious Plugin Upload on CI Test Instances
- Mattermost
- Broken access control
- CVSS 4.6 Medium
Mattermost allows external websites to open within the app, exposing preload functionality to non-trusted sites.
- Mattermost
- CWE-829
- CVSS 7.6 High
Arbitrary application execution via unvalidated server-controlled URLs in Help menu
- Mattermost
- CWE-939
- CVSS 3.9 Low
Mattermost Desktop App fails to enable Hardened Runtime when packaged for Mac App Store
- Mattermost
- CWE-693
- CVSS 6.1 Medium
Inadequate validation of SSO redirect credentials permits credential theft
- Mattermost
- Cross-site request forgery (CSRF)
- CVSS 6.1 Medium
Mattermost Desktop DoS when user has basic authentication server configured
- Mattermost
- CWE-754
- CVSS 3.5 Low
Mattermost Desktop App crashes when clicking on malformed external URL
- Mattermost
- CWE-1287
- CVSS 2.0 Low
Unauthorized Notification Exposure in Mobile App Under Specific Conditions
- Mattermost
- Authentication bypass
- CVSS 6.5 Medium
Denial of Service Via Malicious GIF
- Mattermost
- CWE-1287
- CVSS 9.6 CriticalCritical · CVSS 9+
SQL Injection in Mattermost Boards via board category ID reordering
- Mattermost
- SQL injection
- CVSS 3.1 Low
Leaked User IDs and Metadata of Deleted DMs
- Mattermost
- CWE-754
- CVSS 6.5 Medium
Mobile crash via object that can't be cast to String in Attachment Field
- Mattermost
- CWE-1287
- CVSS 6.5 Medium
Mobile crash via improper validation of proto style in attachments
- Mattermost
- CWE-704
- CVSS 4.3 Medium
Mobile crash via file with specially crafted filename
- Mattermost
- CWE-1287
- CVSS 6.5 Medium
Insufficient Input Validation on Post Props
- Mattermost
- CWE-1287
- CVSS 6.5 Medium
Insufficient Input Validation on Post Props
- Mattermost
- CWE-1287
- CVSS 5.7 Medium
Insecure Android File Provider Paths
- Mattermost
- Broken access control
- CVSS 4.6 Medium
Improper propagation of permission scheme updates across cluster nodes
- Mattermost
- Broken access control
- CVSS 8.2 High
Domain Restriction Bypass on Registration
- Mattermost
- CWE-754
- CVSS 4.3 Medium
Private channel names leaking when Elasticsearch is enabled
- Mattermost
- Information disclosure
- CVSS 3.1 Low
MFA Code Replay
- Mattermost
- Authentication bypass
- CVSS 2.7 Low
Unauthorized Access to view channels' details
- Mattermost
- Broken access control
- CVSS 4.3 Medium
Insufficient Authorization On Unlinked Channel Files
- Mattermost
- Broken access control
- CVSS 5.4 Medium
Unauthorized access on archived channels
- Mattermost
- Broken access control
- CVSS 3.1 Low
Weak SSRF Filtering
- Mattermost
- Server-side request forgery (SSRF)
- CVSS 3.1 Low
Unauthorized access on archived channels via file links
- Mattermost
- Broken access control
- CVSS 4.5 Medium
Mobile password gets saved in dictionary under conditions
- Mattermost
- CWE-693
- CVSS 5.3 Medium
User creation date manipulation in POST /api/v4/users
- Mattermost
- CWE-754