HIGH7.6Go
GHSA-82j6-4fq7-fx62· CVE-2026-6347, GO-2026-5238Mattermost doesn't sanitize sensitive configuration fields in the Mattermost Calls plugin
Modified: 6/25/2026
package
Go/github.com/mattermost/mattermost-plugin-calls
pkg:go/github.com/mattermost/mattermost-plugin-calls
MEDIUM4.3Go
GHSA-gmx5-frv9-9m9f· CVE-2025-62190, GO-2025-4254Mattermost has CSRF vulnerability via Calls Widget page
Modified: 12/30/2025
MEDIUM6.5Go
GHSA-j5vq-62gr-8v3r· CVE-2025-12689, GO-2025-4255Mattermost fails to check Websocket request for proper UTF-8 format potentially crashing Calls plug-in
Modified: 12/30/2025
—Go
GO-2025-4254· CVE-2025-62190, GHSA-gmx5-frv9-9m9fMattermost has CSRF vulnerability via Calls Widget page in github.com/mattermost/mattermost-plugin-calls
Modified: 3/3/2026
—Go
GO-2025-4255· CVE-2025-12689, GHSA-j5vq-62gr-8v3rMattermost fails to check Websocket request for proper UTF-8 format potentially crashing Calls plug-in in github.com/mattermost/mattermost-plugin-calls
Modified: 3/3/2026
—Go
GO-2026-5238· CVE-2026-6347, GHSA-82j6-4fq7-fx62Mattermost doesn't sanitize sensitive configuration fields in the Mattermost Calls plugin in github.com/mattermost/mattermost-plugin-calls
Modified: 6/25/2026