User profile update exposes password hash and MFA secrets

Mattermost 6.2 and earlier fails to sufficiently process a specifically crafted GIF file when it is uploaded while drafting a post, which allows authenticated users to cause…

Mattermost server-side request forgery via OAuth endpoints configurable by a System Administrator

Mattermost ABAC parent policy bypass via policy update endpoint

SAML certificate deletion allows path traversal to delete arbitrary files outside the config directory

mmctl export download command doesn’t restrict permissions to created file to file owner

Insecure Android File Provider Paths

Insufficient validation of guest board admin privileges on archive import

Deactivated guest accounts can authenticate via magic-link token in Mattermost REST API login endpoint

Ordinary group/direct message member can enable group_constrained and remove all channel participants

GitLab Plugin Allows Non-Admin Users to Modify Default Instance Configuration

GitHub OAuth Scope Validation

Insufficient authorization in shared channel membership sync grants team-level access instead of channel-level access

Slack import bypasses email verification for team access controls

One-Click Mattermost Account Takeover via Poisoned RelayState SAML Parameter

Mattermost Playbooks exposes private channel metadata to unauthorized users via run metadata API

Mattermost Playbooks allows privilege escalation through improper access control in playbook run participant management

Bypass of System Admin User Deactivation Controls for Personal Access Tokens in Mattermost Server

Unauthorized Bot Login Using Credentials

Mattermost versions 9.8.0, 9.7.x <= 9.7.4, 9.6.x <= 9.6.2 and 9.5.x <= 9.5.5 fail to prevent users from specifying a RemoteId for their posts which allows an attacker to specify…

Mattermost fails to use  innerText / textContent when setting the channel name in the webapp during autocomplete, allowing an attacker to inject HTML to a victim's page by create…

Mattermost fails to properly validate the permissions when soft deleting a team allowing a team member to soft delete other teams that they are not part of

Mattermost 6.3.0 and earlier fails to properly sanitize the HTML content in the email invitation sent to guest users, which allows registered users with special permissions to…

Unauthenticated webhook request with null notification entry could crash the Microsoft Calendar plugin.

Plugin bot username conflict allows user account to be used as bot identity in Mattermost Server

Persistent notification timing attack causing server denial of service

MS Teams plugin OAuth allows editing arbitrary posts

Repeated LDAP login failures can lock an LDAP account

Leaked User IDs and Metadata of Deleted DMs

Misleading UI for undefined admin console settings in Calls causes security confusion

Domain Restriction Bypass on Registration

Mattermost versions 9.9.x <= 9.9.1, 9.5.x <= 9.5.7, 9.10.x <= 9.10.0, 9.8.x <= 9.8.2 fail to restrict the input in POST /api/v4/users which allows a user to manipulate the…

Mattermost versions 9.5.x <= 9.5.5 and 9.8.0 fail to properly sanitize the recipients of a webhook event which allows an attacker monitoring webhook events to retrieve the channel…

Mattermost versions 9.5.x <= 9.5.5 and 9.8.0, when using shared channels with multiple remote servers connected, fail to check that the remote server A requesting the server B to…

Mattermost fails to limit the log size of server logs allowing an attacker sending specially crafted requests to different endpoints to potentially overflow the log

Mattermost fails to properly sanitize the request to /api/v4/redirect_location allowing an attacker, sending a specially crafted request to /api/v4/redirect_location, to fill up…

Mattermost fails to normalize UTF confusable characters when determining if a preview should be generated for a hyperlink, allowing an attacker to trigger link preview on a…

Mattermost invitation tokens not bound to invited email address allowing unauthorized team and private channel access

SSRF via Host Header Spoofing in Custom Slash Commands

Mattermost fails to reject OAuth application sessions in account type switch, allowing account takeover via bearer token

Mattermost logs plaintext authentication tokens in debug-level server logs on failed auth attempts

Disclosure of AD/LDAP bind password via Test Connection

Incoming webhook user attribution via unvalidated webhook owner

Path traversal in Mattermost Legal Hold plugin via unsanitized file name from federated peer allows arbitrary file write.

Arbitrary File Read via Advanced Logging Support Packet

Improper Input Validation in Zoom Plugin Webhook Handler

Password hash and MFA secret returned in user email verification endpoint

Nil pointer dereference in bulk import crashes server

Path Traversal in Template Upload Allows Uploading Files Outside Target Directory

Import Path Traversal Enables Unauthorized Unsigned Plugin Installation