Admin RCE via Malicious Plugin Upload on CI Test Instances

Unbounded memory consumption during PDF text extraction

Mattermost allows authenticated users to trigger excessive memory allocation via crafted msgpack binary WebSocket frames

Insufficient length validation when parsing Zoom chat transcriptions

Mattermost local image proxy allows server memory exhaustion via unbounded image response buffering

Mattermost leaks interactive-message integration secrets to non-admin users via post-deletion events and thread reads

Mattermost guest account privilege escalation via member roles API

Outgoing OAuth connection client secret exposure during connection validation

Mattermost server missing request body size limit on plugin routes allows denial of service by an authenticated user

Data Retention Teams Endpoint Leaks Private Team Invite ID

Missing property field ownership validation in Playbooks run property update endpoint

Unbounded zlib decompression in Calls SDP WebSocket messages

Uploading a crafted image causes excessive memory allocation in the Mattermost Server

Mattermost Boards plugin didn’t enforce role-based authorization on board channel link allowing board editors to expose boards to arbitrary channels

Boards plugin panics on WebSocket command with non-string field types

Boards archive import endpoint allows resource exhaustion via zip bomb and file size limit bypass in Mattermost

Mattermost Server Denial of Service via Animated GIF Emoji Upload

Posting a malicious markdown image crashes the Mattermost Desktop App

Mattermost Desktop App crashes when malformed arguments are provided to some exposed IPC methods

Crafted message attachment causes client-side denial of service via markdown parser regex backtracking in Mattermost

Unauthorized users can trigger interactive post actions in private channels via action cookie channel mismatch in Mattermost

Deactivated user accounts can continue to obtain valid OAuth access tokens via refresh token grant in Mattermost

SSRF via unvalidated attachment URLs in Mattermost Agents plugin MCP server

Overly long URLs crash the Mattermost Desktop App

Mattermost Remote Cluster PATCH API Leaks Authentication Tokens

Server panic via outgoing webhook responses

Denial of service via crafted TIFF file upload

Opening a window with {{javascript:alert()}} as URL causes crash in the Mattermost Desktop App

Prevent password disclosure and force reset during Slack import

Missing authorization check in AI message rewrite endpoint allows access to private thread content

Instance and webhook GitLab plugin commands were able to be run by non-admin users

Memory Exhaustion via Malicious 7zip File Upload

Improper Input Validation in MS Teams Meetings API Handler

SVG content served through Mattermost image proxy despite Content-Type restrictions causes client-side denial of service

Race Condition in Guest Magic Link Authentication Allows Token Reuse

Unbounded Request Body Read in MS Teams Plugin {{/changes}} Webhook Endpoint

Unbounded Request Body Read in MS Teams Plugin {{/lifecycle}} Webhook Endpoint

Zip Bomb Denial of Service via Unrestricted Archive Decompression

Denial of Service via HTTP/2 single packet attack on login endpoint

Arbitrary application execution via unvalidated server-controlled URLs in Help menu

Application-Level DoS via infinite re-render loop in user profile handling

DoS from quadratic complexity in model.ParseHashtags

DoS in Calls plugin via malformed UTF-8 in WebSocket request

Inadequate validation of SSO redirect credentials permits credential theft

Mattermost Desktop App crashes when clicking on malformed external URL

IDOR in board file download allows any user to download any file by UUID

Mattermost Server exposes sensitive user credentials during shared channel membership synchronization

IDOR in CreatePost API allows for timeboxed message disclosure

Data exfiltration via AI plugin Jira tool

Denial of Service Via Malicious GIF