Summary
Ein Angreifer kann mehrere Schwachstellen in Mattermost Server und Mobile ausnutzen, um Informationen offenzulegen oder einen Denial of Service zu verursachen.
Product
Mattermost ist ein webbasierter Instant-Messaging-Dienst.
Vulnerabilities 7
-
Medium 6.5
Lack of MFA enforcement in WebSocket connections
Mattermost versions <11 fail to enforce multi-factor authentication on WebSocket connections which allows unauthenticated users to access sensitive information via WebSocket events
-
Medium 6.1
Inadequate validation of SSO redirect credentials permits credential theft
Mattermost Mobile Apps versions <=2.32.0 fail to verify that SSO redirect tokens originate from the trusted server, which allows a malicious Mattermost instance or on-path attacker to obtain user session credentials via crafted token-in-URL responses
-
Medium 5.4
MS Teams plugin OAuth allows editing arbitrary posts
Mattermost versions 10.11.x <= 10.11.3, 10.5.x <= 10.5.11, 10.12.x <= 10.12.0 fail to validate the relationship between the post being updated and the MSTeams plugin OAuth flow which allows an attacker to edit arbitrary posts via a crafted MSTeams plugin OAut…
-
Medium 4.9
Password hash and MFA secret returned in user email verification endpoint
Mattermost versions 10.11.x <= 10.11.3, 10.5.x <= 10.5.11, 10.12.x <= 10.12.0 fail to sanitize user data which allows system administrators to access password hashes and MFA secrets via the POST /api/v4/users/{user_id}/email/verify/member endpoint
-
Medium 4.3
Guest user can discover archived public channels
Mattermost versions <11 fail to properly restrict access to archived channel search API which allows guest users to discover archived public channels via the `/api/v4/teams/{team_id}/channels/search_archived` endpoint
-
Low 3.1
Cross-team channel membership access
Mattermost versions 10.11.x <= 10.11.3, 10.5.x <= 10.5.11 fail to properly validate team membership permissions in the Add Channel Member API which allows users from one team to access user metadata and channel membership information from other teams via the …
-
Low 3.0
Channel member objects leak read status
Mattermost versions 10.11.x <= 10.11.3, 10.5.x <= 10.5.11 fail to enforce access permissions on the Agents plugin which allows other users to determine when users had read channels via channel member objects
Revision history
-
#4
Schreibfehler korrigiert
-
#3
CVE ergänzt
-
#2
Anpassung aufgrund neuer Informationen von Mattermost
-
#1
Initiale Fassung
References
-
Mattermost Security Updates vom 2025-10-15
https://mattermost.com/security-updates/