Files of archived channels accessible with the “Allow users to view archived channels” option disabled

Denial of service in mattermost mobile apps and server via emoji reactions

Incorrect Authorization leads to Channel Member Count Leak

Details of archived public channels are leaked to members of another team

Lack of restriction to manage group names for freshly demoted guests

Keywords that trigger mentions are leaked to other users

Leak Inaccessible Playbook Information via Channel Action IDOR

IDOR when updating the tasks of a private playbook run

Insecure Direct Object Reference in /plugins/focalboard/ api/v2/users of Mattermost Boards

Permalink previews displayed for posts in archived channels even if users are disallowed to view archived channels

Users full name disclosure through Mattermost Boards with Show Full Name Option disabled

Username and Icon override can be used by members when Hardened Mode is enabled

Denial of Service via crashing the Calls Plugin

Mobile app freezes when receiving a post with hundreds of emojis

Full name disclosure via team top membership with Show Full Name option disabled

A system/user manager can demote / deactivate another manager

Attachment of deleted message in a thread remains accessible and downloadable

channel DoS by sharing a boards link

Lack of channel membership check when linking a board to a channel

Limited blind SSRF to localhost/intranet in interactive dialog implementation

Specially crafted search query can cause large log entries in postgres

Playbooks lets you edit arbitrary posts

Channel commands execution doesn't properly verify permissions

App Framework does not checks for the secret provided in the incoming webhook request

Archiving a team broadcasts unsanitized data over WebSockets

Full name revealed via /plugins/focalboard/api/v2/users

Guest accounts can list all public channels

Restricted custom admin role can bypass the restrictions and view the server logs and server config.json file contents

Missing per-channel team-scope check in ABAC access control policy unassign allows cross-team policy removal

Google OAuth Authentication Bypass for Converted Bot Accounts

Mattermost Jira plugin crafted action leaks Jira issue details

LDAP Injection in Mattermost Enterprise Edition When Using Active Directory

Missing authorization allows users to access arbitrary security levels on Jira through webhooks (Jira Plugin)

Mattermost Desktop App fails to enable Hardened Runtime when packaged for Mac App Store

Team admin can escalate a team member's permissions via the team member roles endpoint

Mattermost schemes teams endpoint exposes private team invite IDs

User Manager can demote bot accounts to guest without bot-management permission

Improper Permission Check Allows User Manager to Deactivate Bot Accounts

OAuth authorization code client binding not enforced during token redemption in Mattermost

Team Admin Privilege Escalation to Demote Members to Guest

Channel and Team Membership APIs inadvertently allow loss of Member privileges.

Team Privacy Settings Authorization Bypass in Mattermost Server

Access control flaw for team admins allows unauthorized team additions

Invite ID available to team admins even without the "Add Members" permission

Mattermost Desktop App Missing IPC Sender Validation in Calls Leave Handler

Lack of Invalidation of Legacy Remote Cluster Invite Tokens After Confirmation

Insecure string comparison enables timing attacks

Email addresses of remote users visible in props regardless of server settings

Improper post type validation on scheduled post endpoints

Mattermost thread memberships persist after team removal, exposing private channel thread metadata on re-invite