Mattermost fails to properly validate permissions when demoting and deactivating a user allowing for a system/user manager to demote / deactivate another manager

Mattermost fails to delete the attachments when deleting a message in a thread allowing a simple user to still be able to access and download the attachment of a deleted message

Mattermost fails to properly truncate the postgres error log message of a search query failure allowing an attacker to cause the creation of large log files which can result in…

When creating a playbook run via the /dialog API, Mattermost fails to validate all parameters, allowing an authenticated attacker to edit an arbitrary channel post

Mattermost fails to properly check the permissions when executing commands allowing a member with no permissions to post a message in a channel to actually post it by executing…

Mattermost Apps Framework fails to verify that a secret provided in the incoming webhook request allowing an attacker to modify the contents of the post sent by the Apps

Mattermost fails to check the "Show Full Name" setting when rendering the result for the /plugins/focalboard/api/v2/users API call, allowing an attacker to learn the full name of…

The Guest account feature in Mattermost version 6.7.0 and earlier fails to properly restrict the permissions, which allows a guest user to fetch a list of all public channels in…

Missing per-channel team-scope check in ABAC access control policy unassign allows cross-team policy removal

Google OAuth Authentication Bypass for Converted Bot Accounts

Mattermost Jira plugin crafted action leaks Jira issue details

LDAP Injection in Mattermost Enterprise Edition When Using Active Directory

Mattermost Desktop App fails to enable Hardened Runtime when packaged for Mac App Store

Team admin can escalate a team member's permissions via the team member roles endpoint

Mattermost schemes teams endpoint exposes private team invite IDs

User Manager can demote bot accounts to guest without bot-management permission

Improper Permission Check Allows User Manager to Deactivate Bot Accounts

OAuth authorization code client binding not enforced during token redemption in Mattermost

Team Admin Privilege Escalation to Demote Members to Guest

Channel and Team Membership APIs inadvertently allow loss of Member privileges.

Team Privacy Settings Authorization Bypass in Mattermost Server

Access control flaw for team admins allows unauthorized team additions

Mattermost Desktop App Missing IPC Sender Validation in Calls Leave Handler

Lack of Invalidation of Legacy Remote Cluster Invite Tokens After Confirmation

Insecure string comparison enables timing attacks

Email addresses of remote users visible in props regardless of server settings

Improper post type validation on scheduled post endpoints

Mattermost thread memberships persist after team removal, exposing private channel thread metadata on re-invite

Markdown image rendering bypass in AI bot tool result posts in Mattermost

Calling window.close() from server-side content causes crash in the Mattermost Desktop App

Password Change Bypass via Auth Switch Endpoint

Channel member objects leak read status

AI plugin APIs can be triggered using post actions

Incorrect Session Creation with Desktop SSO

Plaintext pre-auth secret exposure via Desktop App diagnostics report

Mattermost Desktop App logging sensitive information and fails to clear data on server deletion

macOS TCC Bypass via Code Injection

Bypass of TCC restrictions on macOS

Time-of-check time-of-use vulnerability in common teams API

Invite token is used as part of the secure communication

Improper Access Control in Mattermost Channel Member API

Mattermost GitHub Plugin allows unauthorized GitHub reactions via reaction forwarding hijacking

Mattermost OpenID discovery endpoint request bypasses outbound connection filtering, allowing SSRF by a System Administrator

Connected Workspaces: Malicious remote server can manipulate arbitrary user's status

Team Admin Bypass of Invite Permissions via allow_open_invite Field

System Admin Cannot Access Environment settings in System Console While System Manager Can

MFA Enforcement Bypass Allows Unauthorized Removal of MFA for Other Users

Unauthorized Access to User Activity Logs API by delegated granular administration roles

Auto-Enrollment of Team Admins into Private Channels without explicit consent

Unauthorized disabling of invite URL