31 results · Clear filters · Feed
-
High 7.6
CVE-2026-6961: Path traversal via unsanitized FileInfo.Name in Mattermost federation sync
Mattermost versions 11.6.x <= 11.6.1, 11.5.x <= 11.5.4, 10.11.x <= 10.11.15, 10.11.x <= 10.11.16 Mattermost fails to sanitize FileInfo.Name received from federated peers during shared channel file sync, which allows an attacker who controls a federated server…
-
High 8.8
Mattermost group syncable endpoints allow privilege escalation via scheme_admin
Mattermost versions 11.6.x <= 11.6.1, 11.5.x <= 11.5.4, 10.11.x <= 10.11.15, 10.11.x <= 10.11.16 Mattermost fails to require role-management authorization when setting the scheme_admin flag on group syncable link and patch endpoints, which allows a user with …
-
High 7.5
Unauthenticated WebSocket binary frame causes denial of service in Mattermost Server
Mattermost versions 11.6.x <= 11.6.0, 11.5.x <= 11.5.3, 11.4.x <= 11.4.4, 10.11.x <= 10.11.14 fail to properly validate msgpack-encoded WebSocket frames before memory allocation which allows an unauthenticated remote attacker to crash the server process and c…
-
High 8.0
Path traversal in integration action URL leading to arbitrary API execution via system admin’s auth token.
Mattermost versions 11.6.x <= 11.6.0, 11.5.x <= 11.5.3, 11.4.x <= 11.4.4, 10.11.x <= 10.11.14 fail to check integration URL for path traversal which allows an malicious authenticated user to call an arbitrary API via system admin Mattermost auth token using v…
-
High 8.7
Sensitive credentials exposed in plaintext in Mattermost support packets
Mattermost versions 11.5.x <= 11.5.1, 10.11.x <= 10.11.13, 11.4.x <= 11.4.3 fail to sanitize sensitive configuration fields before including them in support packet generation, which allows a Mattermost System Admin or any party with access to a support packet…
-
High 7.6
Mattermost Calls plugin exposes TURN server credentials in plaintext in support packets
Mattermost versions 11.5.x <= 11.5.1, 10.11.x <= 10.11.13, 11.4.x <= 11.4.3 fail to sanitize sensitive configuration fields in the Mattermost Calls plugin which allows an attacker with access to a support packet to obtain TURN server credentials via the plain…
-
High 8.0
Terminal Escape Injection in mmctl Report Posts Command
Mattermost versions 11.2.x <= 11.2.2, 10.11.x <= 10.11.10, 11.4.x <= 11.4.0, 11.3.x <= 11.3.1 fail to sanitize user-controlled post content in the mmctl commands terminal output which allows attackers to manipulate administrator terminals via crafted messages…
-
High 7.5
DoS attack via login attempts with multi-megabyte passwords
Mattermost versions 11.3.x <= 11.3.0, 11.2.x <= 11.2.2, 10.11.x <= 10.11.10 fail to properly handle very long passwords, which allows an attacker to overload the server CPU and memory via executing login attempts with multi-megabyte passwords. Mattermost Advi…
-
High 7.2
Mattermost Jira plugin user spoofing enables Jira request forgery.
Mattermost versions 11.1.x <= 11.1.0, 11.0.x <= 11.0.5, 10.12.x <= 10.12.3, 10.11.x <= 10.11.7 with the Jira plugin enabled and Mattermost Jira plugin versions <=4.4.0 fail to enforce authentication and issue-key path restrictions in the Jira plugin, which al…
-
High 8.1
Arbitrary Mattermost Team can be joined by manipulating the OAuth state
Mattermost versions 10.11.x <= 10.11.1, 10.10.x <= 10.10.2, 10.5.x <= 10.5.10 fail to verify a user has permission to join a Mattermost team using the original invite token which allows any attacked to join any team on a Mattermost server regardless of restri…
-
High 8.1
Arbitrary Mattermost Team can be joined by manipulating the SAML RelayState
Mattermost versions 10.11.x <= 10.11.1, 10.10.x <= 10.10.2, 10.5.x <= 10.5.10 fail to verify a user has permission to join a Mattermost team using the original invite token which allows any attacked to join any team on a Mattermost server regardless of restri…
-
High 8.0
Admin RCE via prepackaged plugins by way of misconfigured imports directory
Mattermost versions 10.8.x <= 10.8.3, 10.5.x <= 10.5.8, 9.11.x <= 9.11.17, 10.10.x <= 10.10.1, 10.9.x <= 10.9.3 fail to validate import directory path configuration which allows admin users to execute arbitrary code via malicious plugin upload to prepackaged …
-
High 7.6
One-Click Mattermost Account Takeover via Poisoned RelayState SAML Parameter
Mattermost versions 10.10.x <= 10.10.1, 10.5.x <= 10.5.9, 10.9.x <= 10.9.4 fail to validate the redirect_to parameter, allowing an attacker to craft a malicious link that, once a user authenticates with their SAML provider, could post the user’s cookies to an…
-
High 7.5
Bypassing MFA Enforcement on Plugin Endpoints
Mattermost versions 10.4.x <= 10.4.2, 10.3.x <= 10.3.3, 9.11.x <= 9.11.8, 10.5.x <= 10.5.0 fail to enforce MFA on plugin endpoints, which allows authenticated attackers to bypass MFA protections via API requests to plugin-specific routes.
-
High 8.7
Malicious remote can invite itself to an arbitrary local channel
Mattermost versions 9.9.x <= 9.9.0, 9.5.x <= 9.5.6, 9.7.x <= 9.7.5 and 9.8.x <= 9.8.1 fail to disallow unsolicited invites to expose access to local channels, when shared channels are enabled, which allows a malicious remote to send an invite with the ID of a…
-
High 8.7
Malicious remote can add users to arbitrary teams and channels
Mattermost versions 9.9.x <= 9.9.0, 9.5.x <= 9.5.6, 9.7.x <= 9.7.5 and 9.8.x <= 9.8.1 fail to properly validate that the channel that comes from the sync message is a shared channel, when shared channels are enabled, which allows a malicious remote to add use…
-
High 7.4
Existing local user overwritten by malicious remote
Mattermost versions 9.9.x <= 9.9.0, 9.5.x <= 9.5.6, 9.7.x <= 9.7.5, 9.8.x <= 9.8.1 fail to disallow the modification of local users when syncing users in shared channels. which allows a malicious remote to overwrite an existing local user.
-
High 7.3
Stored XSS via SVG attachment on Boards
Boards in Mattermost allows an attacker to upload a malicious SVG image file as an attachment to a card and share it using a direct link to the file.
-
High 7.5
Mattermost Server does not check if cookies are used over SSL
An issue was discovered in Mattermost Server before 3.0.0. It does not ensure that a cookie is used over SSL.
-
High —
Mattermost Server: Insufficient Password-Reset Link Invalidation
An issue was discovered in Mattermost Server before 3.0.0. A password-reset link could be reused.
-
High 7.5
Mattermost Server does not enforce rate limits on password change attempts
An issue was discovered in Mattermost Server before 3.2.0. It mishandles brute-force attempts at password change.
-
High 7.5
Mattermost Server: initial_load API exposes unnecessary information
An issue was discovered in Mattermost Server before 3.2.0. The initial_load API disclosed unnecessary personal information.
-
High —
Mattermost Server uses weak hashing for OAuth, email verification tokens and invitations
An issue was discovered in Mattermost Server before 3.8.2, 3.7.5, and 3.6.7. Weak hashing was used for e-mail invitations, OAuth, and e-mail verification tokens.
-
High 8.1
Mattermost Server vulnerable to user account takeover when Single Sign-On OAuth2 is used
An issue was discovered in Mattermost Server before 4.0.0, 3.10.2, and 3.9.2, when Single Sign-On OAuth2 is used. An attacker could claim somebody else's account.
-
High 7.5
Mattermost Server SAML implementation does not require encryption or signature verification as default
An issue was discovered in Mattermost Server before 3.9.0 when SAML is used. Encryption and signature verification are not mandatory.
-
High —
Mattermost Server allows an attacker to specify a full pathname of a log file
An issue was discovered in Mattermost Server before 3.8.2, 3.7.5, and 3.6.7. It allows an attacker to specify a full pathname of a log file.
-
High 8.8
Mattermost Server vulnerable to CSRF if CORS is enabled
An issue was discovered in Mattermost Server before 4.0.0, 3.10.2, and 3.9.2. CSRF can occur if CORS is enabled.
-
High 8.8
Mattermost Server does not properly restrict use of slash commands
An issue was discovered in Mattermost Server before 4.3.0, 4.2.1, and 4.1.2. It allows a bypass of restrictions on use of slash commands.
-
High 8.1
Mattermost Server has intermittent Authorization bypass for resource-owners
An issue was discovered in Mattermost Server before 4.2.0, 4.1.1, and 4.0.5, when used as an OAuth 2.0 service provider. Sometimes. resource-owner authorization is bypassed, allowing account takeover.
-
High 7.5
Mattermost Server vulnerable to Denial of Service through `@` character prefix inserted into JavaScript field names
An issue was discovered in Mattermost Server before 4.5.0, 4.4.5, 4.3.4, and 4.2.2. It allows attackers to cause a denial of service (application crash) via an @ character before a JavaScript field name.
-
High 7.5
Mattermost Server is vulnerable to a Denial of Service attack through `invite_people` command
An issue was discovered in Mattermost Server before 5.1. It allows attackers to cause a denial of service via the invite_people slash command.