Markdown image rendering bypass in AI bot tool result posts in Mattermost

Calling window.close() from server-side content causes crash in the Mattermost Desktop App

Password Change Bypass via Auth Switch Endpoint

Channel member objects leak read status

AI plugin APIs can be triggered using post actions

Incorrect Session Creation with Desktop SSO

CSRF issue allows disconnecting a user's Jira connection through a simple post message (Jira Plugin)

Plaintext pre-auth secret exposure via Desktop App diagnostics report

Mattermost Desktop App logging sensitive information and fails to clear data on server deletion

macOS TCC Bypass via Code Injection

Bypass of TCC restrictions on macOS

Denial of Service via specially crafted gif image

Time-of-check time-of-use vulnerability in common teams API

Invite token is used as part of the secure communication

Improper Access Control in Mattermost Channel Member API

Users maintain access to active call after being removed from a channel

Member can create team with team override scheme

Mattermost GitHub Plugin allows unauthorized GitHub reactions via reaction forwarding hijacking

Mattermost OpenID discovery endpoint request bypasses outbound connection filtering, allowing SSRF by a System Administrator

Connected Workspaces: Malicious remote server can manipulate arbitrary user's status

Team Admin Bypass of Invite Permissions via allow_open_invite Field

System Admin Cannot Access Environment settings in System Console While System Manager Can

MFA Enforcement Bypass Allows Unauthorized Removal of MFA for Other Users

Unauthorized Access to User Activity Logs API by delegated granular administration roles

Auto-Enrollment of Team Admins into Private Channels without explicit consent

Unauthorized disabling of invite URL

RemoteClusterFrame payloads are audit logged in full

Mattermost versions 9.6.0, 9.5.x before 9.5.3, and 8.1.x before 8.1.12 fail to fully validate role changes which allows an attacker authenticated as team admin to demote users to…

Mattermost versions 9.6.0, 9.5.x before 9.5.3, and 8.1.x before 8.1.12 fail to fully validate role changes, which allows an attacker authenticated as a team admin to promote…

System Role with manage posts permission can read posts of Direct Messages

A User Manager role with user edit permissions could manage/update bots

Inconsistent state in UI after boards permission change by system admin

Disclosure of team owner email address when when accessing the teams API

Disclosure of team owner email address when regenerating Invite ID

Mattermost Desktop App plugin popout scheme validation bypass

A race condition in Mattermost versions 8.1.x before 8.1.9, and 9.4.x before 9.4.2 allows an authenticated attacker to gain unauthorized access to individual posts' contents via…

Missing timestamp validation in Zoom webhook handler