Unauthorized access on archived channels

Weak SSRF Filtering

Malicious remote can create arbitrary channels

Creating posts with user-defined IDs permitted in CreatePost API

Playbooks access/modification by removed team member

HTML injection via channel autocomplete

A team member can soft delete other teams that they are not part of

Disabling publicly-shared boards does not disable existing publicly available board links

Unrestricted navigation due to unvalidated mattermost server redirection

Stored XSS via SVG attachment on Boards

Unauthorized email invite to a private channel

HTML Injection while inviting Guests

Mattermost 6.0 and earlier fails to sufficiently validate the email address during registration, which allows attackers to trick users into signing up using attacker-controlled…

Unauthenticated webhook request with null notification entry could crash the Microsoft Calendar plugin.

Plugin bot username conflict allows user account to be used as bot identity in Mattermost Server

Persistent notification timing attack causing server denial of service

MS Teams plugin OAuth allows editing arbitrary posts

Repeated LDAP login failures can lock an LDAP account

Leaked User IDs and Metadata of Deleted DMs

Misleading UI for undefined admin console settings in Calls causes security confusion

Domain Restriction Bypass on Registration

Silent Desktop Screenshot Capture

User creation date manipulation in POST /api/v4/users

LaTeX post content manipulation via renderer state leak across contexts

Channel IDs of archived/restored channels leaked via webhook events

Lack of permission check when updating the profile picture of a remote user (shared channels enabled)

Inaccessible Post Information Leak via Run Timeline IDOR

Public endpoint /metrics of Calls plugin reveals channel IDs

Log Flooding due to specially crafted requests in different endpoints

Denial of Service via Link Preview in /api/v4/redirect_location

File Information Leak via IDOR in file_id in Draft Posts

Lack of URL normalization allows rendering previews for disallowed domains

Information disclosure in linked message previews

Incorrect defaults can cause attackers to bypass rate limitations

Mattermost invitation tokens not bound to invited email address allowing unauthorized team and private channel access

SSRF via Host Header Spoofing in Custom Slash Commands

Mattermost fails to reject OAuth application sessions in account type switch, allowing account takeover via bearer token

Mattermost logs plaintext authentication tokens in debug-level server logs on failed auth attempts

Disclosure of AD/LDAP bind password via Test Connection

Incoming webhook user attribution via unvalidated webhook owner

Path traversal in Mattermost Legal Hold plugin via unsanitized file name from federated peer allows arbitrary file write.

Arbitrary File Read via Advanced Logging Support Packet

Improper Input Validation in Zoom Plugin Webhook Handler

Password hash and MFA secret returned in user email verification endpoint

Nil pointer dereference in bulk import crashes server

Path Traversal in Template Upload Allows Uploading Files Outside Target Directory

Import Path Traversal Enables Unauthorized Unsigned Plugin Installation

Arbitrary file read by system admin via path traversal

Syatem admin profile modification by delegated granular administration role

Zipbomb DoS via Missing Slack Import Validation