Skip to content
OpenAdvisories
Medium WID-SEC-2026-4009 14 CVEs

Mattermost: Mehrere Schwachstellen

Published Oct 15, 2026 · Updated Oct 15, 2026 · de-DE

Vendor: Mattermost Product: Mattermost Platform: Linux Platform: Windows

Summary

Ein Angreifer kann mehrere Schwachstellen in Mattermost ausnutzen, um Sicherheitsvorkehrungen zu umgehen, um seine Privilegien zu erhöhen, um einen Denial of Service Angriff durchzuführen, um Informationen offenzulegen, um Dateien zu manipulieren.

Product

Mattermost ist ein webbasierter Instant-Messaging-Dienst.

Vulnerabilities 14

  • High 7.1
    CVE-2026-16453

    Mattermost SAML RelayState forgery allows unauthorized team membership

    Mattermost versions 11.10.x <= 11.10.0, 11.7.x <= 11.7.9, 11.9.x <= 11.9.1, 11.8.x <= 11.8.5 fail to verify the integrity of the SAML RelayState POST parameter which allows an authenticated SAML user to join any team, including invite-only teams, via forging …

    Mattermost Mattermost
  • Medium 6.5
    CVE-2026-16251

    Mattermost local image proxy allows server memory exhaustion via unbounded image response buffering

    Mattermost versions 11.10.x <= 11.10.0, 11.7.x <= 11.7.9, 11.9.x <= 11.9.1, 11.8.x <= 11.8.5 fail to limit the size of remote image responses buffered in memory during local image proxy direct fetches, which allows a remote attacker to cause memory exhaustion…

    Mattermost Mattermost
  • Medium 6.5
    CVE-2026-18551

    Mattermost guest account privilege escalation via member roles API

    Mattermost versions 11.10.x <= 11.10.0, 11.7.x <= 11.7.9, 11.9.x <= 11.9.1, 11.8.x <= 11.8.5 fail to validate the combination of guest and admin scheme roles which allows an authenticated attacker to escalate a guest account to team or channel admin via a cra…

    Mattermost Mattermost
  • Medium 6.5
    CVE-2026-19541

    Outgoing OAuth connection client secret exposure during connection validation

    Mattermost versions 11.9.x <= 11.9.1, 11.8.x <= 11.8.5, 11.7.x <= 11.7.10, 11.10.x <= 11.10.1 fail to require re-entry of the stored client secret when validating an outgoing OAuth connection, which allows an authenticated user with permission to manage outgo…

    Mattermost Mattermost
  • Medium 6.5
    CVE-2026-19621

    Mattermost leaks interactive-message integration secrets to non-admin users via post-deletion events and thread reads

    Mattermost versions 11.10.x <= 11.10.0, 11.7.x <= 11.7.9, 11.9.x <= 11.9.1, 11.8.x <= 11.8.5 fail to strip action integration secrets from post payloads before broadcasting post-deletion web socket events and returning thread API responses, which allows an au…

    Mattermost Mattermost
  • Medium 6.4
    CVE-2026-18795

    Missing server side validation allowed user to quarantine a DM and GM post

    Mattermost versions 11.10.x <= 11.10.0, 11.7.x <= 11.7.9, 11.9.x <= 11.9.1, 11.8.x <= 11.8.5 fail to enforce DM/GM check on server side which allows an authenticated user to quarantine a post belonging to DM or GM via direct API call.. Mattermost Advisory ID:…

    Mattermost Mattermost
  • Medium 4.9
    CVE-2026-19601

    Disclosure of AD/LDAP bind password via Test Connection

    Mattermost versions 11.9.x <= 11.9.1, 11.8.x <= 11.8.5, 11.7.x <= 11.7.10, 11.10.x <= 11.10.1 fail to invalidate the stored AD/LDAP bind password when other connection settings (such as the server address) are changed, which allows a System Console administra…

    Mattermost Mattermost
  • Medium 4.5
    CVE-2026-19600

    Mattermost logs plaintext authentication tokens in debug-level server logs on failed auth attempts

    Mattermost versions 11.9.x <= 11.9.1, 11.8.x <= 11.8.5, 11.7.x <= 11.7.10, 11.10.x <= 11.10.1 fail to sanitize authentication tokens before writing them to server log entries, which allows an attacker with access to server logs to obtain valid session tokens …

    Mattermost Mattermost
  • Medium 4.4
    CVE-2026-19076

    Mattermost fails to reject OAuth application sessions in account type switch, allowing account takeover via bearer token

    Mattermost versions 11.10.x <= 11.10.0, 11.7.x <= 11.7.9, 11.9.x <= 11.9.1, 11.8.x <= 11.8.5 fail to reject OAuth application sessions in the account type switch endpoint, which allows an attacker with a valid OAuth bearer token for a target user to permanent…

    Mattermost Mattermost
  • Medium 4.3
    CVE-2026-18256

    Private team metadata disclosure via the team search API

    Mattermost versions 11.10.x <= 11.10.0, 11.7.x <= 11.7.9, 11.9.x <= 11.9.1, 11.8.x <= 11.8.5 fail to properly restrict private teams from public team search results, which allows an authenticated user without permission to list private teams to disclose the I…

    Mattermost Mattermost
  • Medium 4.3
    CVE-2026-18560

    Improper order of authorisations in Mattermost GetFile API leads to an authenticated user to determine a post’s quarantined status

    Mattermost versions 11.10.x <= 11.10.0, 11.7.x <= 11.7.9, 11.9.x <= 11.9.1, 11.8.x <= 11.8.5 fail to validate user’s permissions before other validations which allows non-content reviewers to infer a post’s flagged status via direct API call.. Mattermost Advi…

    Mattermost Mattermost
  • Medium 4.3
    CVE-2026-18799

    Mattermost Server fails to restrict Slack import account binding, allowing team admins to forge posts as existing users

    Mattermost versions 11.10.x <= 11.10.0, 11.7.x <= 11.7.9, 11.9.x <= 11.9.1, 11.8.x <= 11.8.5 fail to restrict Slack import account binding to system administrator-initiated imports which allows an authenticated attacker with team admin privileges to force-add…

    Mattermost Mattermost
  • Medium 4.3
    CVE-2026-19603

    Private channel ID disclosure via user status endpoints

    Mattermost versions 11.9.x <= 11.9.1, 11.8.x <= 11.8.5, 11.7.x <= 11.7.10, 11.10.x <= 11.10.1 fail to sanitize the active channel field returned by the user status API endpoints, which allows an authenticated user to learn the channel ID of a private channel …

    Mattermost Mattermost
  • Medium 4.3
    CVE-2026-19867

    Uncapped mention keys in user notification properties allow CPU exhaustion during post processing

    Mattermost versions 11.10.x <= 11.10.0, 11.9.x <= 11.9.1, 11.8.x <= 11.8.5, 11.7.x <= 11.7.10 fail to cap the number and size of mention keys stored in a user's notification properties, and to bound the quadratic multibyte-keyword matching performed for each …

    Mattermost Mattermost

Revision history

  1. #1

    Initiale Fassung

References