MEDIUM5.3Go
GHSA-2j87-p623-8cc2· CVE-2025-27936, GO-2025-3618Mattermost vulnerable to Observable Timing Discrepancy
Modified: 9/10/2026
package
Go/github.com/mattermost/mattermost-plugin-msteams
pkg:go/github.com/mattermost/mattermost-plugin-msteams
HIGH7.6Go
GHSA-4ppj-6chv-5pgc· CVE-2026-2476, GO-2026-4784Mattermost Microsoft Teams Plugin fails to properly mask sensitive configuration values
Modified: 3/23/2026
MEDIUM6.5Go
GHSA-5rfv-h47g-xj42· CVE-2026-24661, GO-2026-5153Mattermost MS Teams plugin doesn't limit the request body size on the /changes webhook endpoint
Modified: 6/25/2026
LOW3.7Go
GHSA-x274-8qfc-hrgf· CVE-2026-21388, GO-2026-5734Mattermost MS Teams plugin doesn't limit the request body size on the /lifecycle webhook endpoint
Modified: 6/25/2026
—Go
GO-2025-3618· CVE-2025-27936, GHSA-2j87-p623-8cc2Mattermost vulnerable to Observable Timing Discrepancy in github.com/mattermost/mattermost-plugin-msteams
Modified: 2/4/2026
—Go
GO-2026-4784· CVE-2026-2476, GHSA-4ppj-6chv-5pgcMattermost Microsoft Teams Plugin fails to properly mask sensitive configuration values in github.com/mattermost/mattermost-plugin-msteams
Modified: 3/23/2026
—Go
GO-2026-5153· CVE-2026-24661, GHSA-5rfv-h47g-xj42Mattermost MS Teams plugin doesn't limit the request body size on the /changes webhook endpoint in github.com/mattermost/mattermost-plugin-msteams
Modified: 6/25/2026
—Go
GO-2026-5734· CVE-2026-21388, GHSA-x274-8qfc-hrgfMattermost MS Teams plugin doesn't limit the request body size on the /lifecycle webhook endpoint in github.com/mattermost/mattermost-plugin-msteams
Modified: 6/25/2026