Go/github.com/mattermost/mattermost-server

Mattermost doesn't rate limit login requests, allowing DoS in github.com/mattermost/mattermost-server

Modified: 4/2/2026

Mattermost doesn't rate limit login requests, allowing DoS

Modified: 4/6/2026

Mattermost doesn't enforce administrator authorization on the {{setDefaultInstance}} call within the {{/gitlab connect}} command handler

Modified: 9/28/2026

Mattermost Server allows XSS via redirect URL

Modified: 11/5/2025

Mattermost fails to properly validate User-Agent header tokens

Modified: 3/26/2026

Mattermost doesn't properly validate channel membership at the time of data retrieval

Modified: 2/23/2026

Mattermost Fails to Restrict Certain Operations on System Admins

Modified: 9/10/2026

Mattermost Server password reset email requests can be sent to attacker-provided email addresses

Modified: 2/19/2026

Mattermost fails to limit the size of responses from integration action endpoints

Modified: 3/26/2026

Mattermost Server exposes team creator's e-mail address to other members

Modified: 12/15/2025

Mattermost Server does not check if cookies are used over SSL

Modified: 11/5/2025

Mattermost doesn't validate the TIFF IFD offset in the image header before allocating memory

Modified: 7/7/2026

Mattermost fails to properly validate login method restrictions

Modified: 4/1/2026

Mattermost has a Missing Authorization vulnerability

Modified: 11/5/2025

Mattermost fails to preserve the redacted state of burn-on-read posts during deletion

Modified: 3/23/2026

Mattermost Missing Authorization vulnerability

Modified: 9/17/2025

Mattermost doesn't validate that a username returned during bot registration belongs to a bot account

Modified: 9/10/2026

Mattermost vulnerable to information disclosure

Modified: 7/25/2025

Mattermost fails to properly validate OAuth state tokens during OpenID Connect authentication

Modified: 12/17/2025

Mattermost has an Incorrect Authorization vulnerability

Modified: 11/5/2025

Mattermost Fails to Properly Validate Team Role Modification

Modified: 8/29/2025

Mattermost Server vulnerable to XSS through channel headers

Modified: 2/19/2026

Mattermost Server's Session ID and Session Token are potentially compromised

Modified: 11/5/2025

Mattermost fails to bound memory allocation when processing PSD image files

Modified: 4/27/2026

Mattermost allows an unauthorized Guest user access to Playbook

Modified: 7/28/2025

Mattermost doesn't set permissions on downloaded bulk export

Modified: 6/25/2026

Mattermost Server is vulnerable to XSS through author_link field in Slack attachments

Modified: 12/9/2025

Mattermost has Insufficiently Protected Credentials

Modified: 7/29/2025

Mattermost fails to sanitize team email addresses

Modified: 12/15/2025

Mattermost allows authenticated administrator to execute LDAP search filter injection

Modified: 6/11/2025

Mattermost fails to properly validate team membership when processing channel mentions

Modified: 4/1/2026

Mattermost allows team admins to promote guests to team admins

Modified: 6/5/2024

Mattermost Server does not restrict SAML certificate path for System Administrators

Modified: 2/22/2026

Mattermost doesn't filter nil elements from outgoing webhook attachment payloads before processing

Modified: 7/7/2026

Denial of service in Mattermost

Modified: 11/8/2023

Mattermost Server is vulnerable to a Denial of Service attack through `invite_people` command

Modified: 11/25/2025

Mattermost fails to use consistent error responses when handling the /mute command

Modified: 3/23/2026

Mattermost Server exposes information stored by a web browser

Modified: 11/5/2025

Mattermost fails to fully validate role changes

Modified: 6/5/2024

Mattermost vulnerable to cross-site scripting (XSS)

Modified: 12/6/2023

Mattermost Server allows attackers to log sensitive information via DEBUG REST API logging endpoint

Modified: 2/3/2026

Mattermost allows a removed team member to enumerate all public channels within a private team

Modified: 3/23/2026

Mattermost Open Redirect vulnerability

Modified: 9/17/2025

Mattermost doesn't require role-management authorization when setting the scheme_admin flag on group syncable link and patch endpoints

Modified: 8/26/2026

Mattermost has a Missing Authorization vulnerability

Modified: 11/5/2025

Mattermost has a Missing Authorization vulnerability

Modified: 11/5/2025

Mattermost Missing Authentication for Critical Function

Modified: 7/29/2025

Mattermost doesn't validate file ownership and access control

Modified: 7/7/2026

Mattermost Server is vulnerable to Code Injection through its LDAP fields

Modified: 11/5/2025

Mattermost doesn't sanitize sensitive configuration fields in the Mattermost Calls plugin

Modified: 6/25/2026

Mattermost Server exposes OAuth personal access tokens to attackers

Modified: 12/9/2025

Mattermost Server is vulnerable to XSS through display name field

Modified: 2/3/2026

Mattermost crashes web clients via a malformed custom status

Modified: 6/5/2024

Mattermost does not verify remote cluster channel access when processing shared channel membership removals

Modified: 6/25/2026

Mattermost vulnerable to information disclosure

Modified: 12/6/2023

Mattermost Server vulnerable to XSS via an uploaded file

Modified: 2/3/2026

Mattermost Server is vulnerable CSV Injection

Modified: 2/3/2026

Mattermost Server is vulnerable to Directory Traversal by System Admins

Modified: 12/15/2025

Mattermost doesn't sanitize FileInfo.Name received from federated peers during shared channel file sync

Modified: 8/26/2026

Mattermost doesn't verify channel membership when processing AI-assisted message rewrites

Modified: 6/25/2026

Mattermost Server is vulnerable to DoS through maliciously crafted posts

Modified: 2/3/2026

Mattermost allows other users to determine when users had read channels via channel member objects

Modified: 11/27/2025

Mattermost fails to properly authentication inviter's permissions to private channel

Modified: 12/6/2023

Mattermost Server is vulnerable to XSS via a Legal or Support setting

Modified: 11/5/2025

Mattermost doesn't sanitize the Remote Cluster API response on PATCH operations

Modified: 8/26/2026

Mattermost doesn't sanitize sensitive configuration fields before including them in support packet generation

Modified: 6/25/2026

Mattermost makes Use of Weak Hash

Modified: 9/17/2025

Mattermost doesn't validate user permissions when creating Jira issues from Mattermost posts

Modified: 2/23/2026

Mattermost is vulnerable to CPU exhaustion via crafted HTTP request

Modified: 2/27/2026

Mattermost Server does not prevent System Admin from arbitrary file creation

Modified: 12/9/2025

Mattermost Server exposes sensitive information via its System Console UI

Modified: 11/5/2025

Mattermost Server is vulnerable to XSS attacks against an OAuth 2.0 allow/deny page

Modified: 12/9/2025

Mattermost Server exposes private team invite ID

Modified: 2/3/2026

Mattermost doesn't enforce PermissionInviteUser when setting AllowOpenInvite or AllowedDomains during team creation

Modified: 9/10/2026

Mattermost has a Path Traversal issue

Modified: 6/25/2026

Mattermost Server vulnerable to Cross-site Scripting through file preview feature

Modified: 11/5/2025

Mattermost fails to enforce invite permissions when updating team settings

Modified: 4/1/2026

Mattermost doesn't validate 7zip archive structure before processing

Modified: 6/25/2026

Mattermost fails to properly enforce read permissions in search API endpoints

Modified: 3/23/2026

Mattermost boards plugin fails to restrict download access to files

Modified: 9/26/2025

Mattermost Server mishandles redirect denial action

Modified: 2/3/2026

Mattermost Server vulnerable to CSRF if CORS is enabled

Modified: 2/26/2026

Mattermost allows an attacker to edit arbitrary posts via a crafted MSTeams plugin OAuth redirect URL

Modified: 11/18/2025

Mattermost Server is vulnerable to Uncontrolled Resource Consumption

Modified: 11/5/2025

Mattermost doesn't sanitize team member data when returned via API to users without elevated permissions

Modified: 7/7/2026

Mattermost allows attackers to take over arbitrary user accounts via overly permissive substring matching flaw

Modified: 6/25/2026

Mattermost doesn't validate user channel membership when attaching Mattermost posts as comments to Jira issues

Modified: 2/27/2026

Mattermost Server vulnerable to user account takeover when Single Sign-On OAuth2 is used

Modified: 2/19/2026

Mattermost Fails to Properly Perform Viewer Role Authorization

Modified: 3/25/2025

Mattermost fails to filter invite IDs based on user permissions

Modified: 3/23/2026

Mattermost Server has Insufficient Session Expiration when used as an OAuth 2.0 service provider

Modified: 2/3/2026

Mattermost Server exposes account details to any Team Administrator

Modified: 11/5/2025

Mattermost doesn't enforce bot-specific permission checks on the user active status endpoint

Modified: 9/28/2026

Mattermost Server allows attackers to gain privileges by accessing unintended API endpoints with users' credentials

Modified: 1/6/2026

Mattermost Server has intermittent Authorization bypass for resource-owners

Modified: 2/3/2026

Mattermost Fails to Validate File Paths

Modified: 8/29/2025

Mattermost fails to canonicalize IPv4-mapped IPv6 addresses before reserved IP validation

Modified: 3/23/2026

Uncontrolled Resource Consumption in Mattermost server

Modified: 12/6/2023

Mattermost Server is vulnerable to XSS through lack of link relationship attributes `noreferrer` and `noopener`

Modified: 11/5/2025

Mattermost has Potential Server Crash due to Unvalidated Import Data

Modified: 8/29/2025

Mattermost Server allows users with a session ID to revoke another users' session

Modified: 12/15/2025

Mattermost allows members with permission to convert public channels to private and convert private to public

Modified: 9/10/2026

Mattermost Server exposes sensitive user status information via REST API version 4 endpoint

Modified: 2/3/2026

Mattermost Server is vulnerable to XSS through customizable theme color-code values

Modified: 11/5/2025

Mattermost doesn't invalidate cached authentication state for active WebSocket connections during global session revocation

Modified: 9/28/2026

Mattermost Server's OAuth 2.0 service is vulnerable to attack through Missing Authorization

Modified: 11/5/2025

Mattermost Server is vulnerable to Path Traversal when files are stored locally

Modified: 12/9/2025

Mattermost Open Redirect vulnerability

Modified: 9/17/2025

Mattermost doesn't validate that the RefreshedToken differs from the original invite token during remote cluster invite confirmation

Modified: 6/25/2026

Mattermost doesn't enforce the PostEditTimeLimit on non-message post fields

Modified: 6/25/2026

Mattermost Server server restarts may provide attackers with API access

Modified: 2/19/2026

Mattermost Server: Insufficient Password-Reset Link Invalidation

Modified: 11/5/2025

Mattermost fails to properly restrict access to archived channel search API

Modified: 11/17/2025

Mattermost doesn't validate the response body of proxied images

Modified: 6/25/2026

Mattermost Server vulnerable to Denial of Service through `@` character prefix inserted into JavaScript field names

Modified: 12/9/2025

Mattermost doesn't enforce request body size limits on plugin HTTP endpoints

Modified: 7/7/2026

Mattermost doesn't enforce client identity binding during the OAuth authorization code redemption flow

Modified: 6/25/2026

Mattermost Server is vulnerable to webhook and slash command manipulation

Modified: 12/15/2025

Mattermost doesn't authenticate Atlassian Connect installed callbacks, allowing a remote unauthenticated attacker to inject a rogue sharedSecret

Modified: 9/28/2026

Mattermost Server exposes team invite IDs through API endpoints

Modified: 12/9/2025

Mattermost allows guest users to view information about public teams they are not members of

Modified: 6/11/2025

Mattermost doesn't escape some variables that could contain malicious content during error page composition

Modified: 6/25/2026

Mattermost Server uses weak hashing for OAuth, email verification tokens and invitations

Modified: 2/19/2026

Mattermost Server allows an attacker to specify a full pathname of a log file

Modified: 2/19/2026

Mattermost doesn't require system-level permission when patching protected default system roles

Modified: 9/10/2026

Mattermost doesn't limit the size of the request body on the start meeting API endpoint

Modified: 6/25/2026

Mattermost Server has X.509 Improper Certificate Validation

Modified: 2/22/2026

Mattermost Server allows attackers to create buttons that can launch API requests

Modified: 12/15/2025

Mattermost fails to properly handle very long passwords

Modified: 3/23/2026

Mattermost Server is vulnerable to XSS through crafted links

Modified: 11/5/2025

Mattermost has session spoofing due to lack of single-use consumption of guest magic link tokens enforcement

Modified: 6/25/2026

Mattermost Server allows System Admin to modify LDAP account names and email addresses

Modified: 11/5/2025

Mattermost fails to to verify the token used during code exchange

Modified: 12/15/2025

Mattermost Incorrect Authorization vulnerability

Modified: 11/17/2025

Mattermost allows system administrators to access password hashes and MFA secrets

Modified: 11/18/2025

Mattermost is vulnerable to DoS due to infinite re-renders on API errors

Modified: 2/27/2026

Mattermost doesn't validate channel ownership of an existing subscription before applying edits

Modified: 9/28/2026

Mattermost doesn't validate whether users were correctly owned by the correct Connected Workspace

Modified: 6/25/2026

Mattermost fails to limit the size of a request path

Modified: 5/12/2025

Mattermost doesn't archive the channel before removing persistent notifications

Modified: 7/7/2026

Mattermost allows attackers to spoof permalink embeds

Modified: 3/23/2026

Mattermost Fails to Sanitize File Names

Modified: 8/29/2025

Mattermost fails to sanitize sensitive data in WebSocket messages

Modified: 4/1/2026

Mattermost Lack of Access Control Validation

Modified: 8/29/2025

Mattermost Server exposes sensitive information about team URLs via an API

Modified: 11/5/2025

Mattermost Fails to Validate Remote Cluster Upload Sessions

Modified: 8/29/2025

Mattermost allows authenticated users to write files to arbitrary locations

Modified: 7/28/2025

Mattermost Does Not Sanitize the Team Invite ID

Modified: 8/29/2025

Mattermost Server Resource Exhaustion

Modified: 12/18/2024

Mattermost Server does not enforce rate limits on password change attempts

Modified: 11/5/2025

Mattermost allows unauthorized channel member management through playbook runs

Modified: 7/28/2025

Mattermost Path Traversal vulnerability

Modified: 9/26/2025

Mattermost allows authenticated users to gain access to private repositories

Modified: 7/7/2026

Mattermost password hash disclosure vulnerability

Modified: 7/22/2025

Mattermost Server SAML implementation does not require encryption or signature verification as default

Modified: 2/19/2026

Mattermost has a Missing Authorization vulnerability

Modified: 11/5/2025

Mattermost Server: initial_load API exposes unnecessary information

Modified: 11/5/2025

Mattermost Server: Files may be rendered inline instead of downloaded, allowing script execution

Modified: 11/5/2025

Mattermost doesn't validate user-supplied input in API request handlers

Modified: 7/7/2026

Mattermost doesn't restrict role_updated websocket event broadcasts to members of the affected team or channel

Modified: 9/10/2026

Mattermost fails to validate user's authentication method when processing account auth type switch

Modified: 3/23/2026

Mattermost Server is vulnerable to SQL Injection when executing multiple POST requests

Modified: 12/15/2025

Denial of service in Mattermost

Modified: 9/10/2026

Mattermost doesn't check the create_post channel permission during post edit operations

Modified: 6/25/2026

Mattermost Incorrect Authorization vulnerability

Modified: 7/28/2025

Mattermost doesn't validate the Host header when constructing response URLs for custom slash command

Modified: 6/25/2026

Mattermost Server SSRF Vulnerability via the Agents Plugin

Modified: 8/29/2025

Mattermost Server does not safeguard against phishing via error page links

Modified: 2/3/2026

Mattermost did not properly restrict channel creation

Modified: 7/25/2025

Mattermost Server allows XSS via CSRF

Modified: 11/5/2025

Mattermost doesn't verify that post actions invoking `/share-issue-publicly` were created by the Jira plugin

Modified: 2/27/2026

Mattermost's detailed error messages reveal the full file path

Modified: 6/5/2024

Mattermost Server has low entropy for authorization data as an OAuth 2.0 Service Provider

Modified: 12/9/2025

Mattermost doesn't properly validate msgpack-encoded WebSocket frames before memory allocation

Modified: 7/7/2026

Mattermost Incorrect Authorization vulnerability

Modified: 7/28/2025

Mattermost fails to limit the number of active sessions

Modified: 5/12/2025

Mattermost Server does not neutralize HTML content in an Email template field

Modified: 2/3/2026

Mattermost doesn't enforce slash command trigger-word uniqueness during command updates

Modified: 6/25/2026

Mattermost doesn't prevent disclosure of created user password

Modified: 6/25/2026

Mattermost Server does not properly restrict use of slash commands

Modified: 12/15/2025

Mattermost Path Traversal vulnerability

Modified: 7/29/2025

Mattermost Server has Improper Authorization for Integration Requests

Modified: 2/22/2026

Mattermost allows regular users to access archived channel content and files

Modified: 11/18/2025

Mattermost has an Invite Token Replay Vulnerability via Channel Membership Manipulation

Modified: 12/30/2025

Mattermost Fails to Sanitize Path Traversal Sequences

Modified: 8/29/2025

Mattermost Server is vulnerable to channel invisibility DoS via misformatted post

Modified: 2/26/2026

Mattermost has an Incorrect Authorization issue

Modified: 10/1/2026

Mattermost does not enforce MFA on WebSocket connections

Modified: 11/17/2025

Mattermost fails to validate team-specific upload_file permissions

Modified: 3/23/2026

Mattermost has an Observable Timing Discrepancy vulnerability

Modified: 11/5/2025

Mattermost fails to bound memory allocation when processing DOC files

Modified: 3/23/2026

Mattermost doesn't validate the X-Requested-With header on the burn-on-read reveal endpoint

Modified: 6/25/2026

Mattermost users could access some sensitive information via API call in github.com/mattermost/mattermost-server

Modified: 3/3/2026

Insecure plugin handling in Mattermost in github.com/mattermost/mattermost-server

Modified: 3/3/2026

Resource exhaustion in Mattermost in github.com/mattermost/mattermost-server

Modified: 3/3/2026

Improper Control of a Resource Through its Lifetime in Mattermost in github.com/mattermost/mattermost-server

Modified: 3/3/2026

Cross-site Scripting in Mattermost in github.com/mattermost/mattermost-server

Modified: 3/3/2026

Improper Privilege Management in Mattermost in github.com/mattermost/mattermost-server

Modified: 3/3/2026

Mattermost Server Sensitive Data Exposure in github.com/mattermost/mattermost

Modified: 3/3/2026

Mattermost allows demoted guests to change group names in github.com/mattermost/mattermost-server

Modified: 2/4/2026

Mattermost Cross-site Scripting vulnerability in github.com/mattermost/mattermost-server

Modified: 2/4/2026

Mattermost notified all users in the channel when using WebSockets to respond individually in github.com/mattermost/mattermost-server

Modified: 2/4/2026

Mattermost viewing archived public channels permissions vulnerability in github.com/mattermost/mattermost-server

Modified: 2/4/2026

Mattermost vulnerable to denial of service via large number of emoji reactions in github.com/mattermost/mattermost-server

Modified: 2/4/2026

Mattermost fails to check the required permissions in github.com/mattermost/mattermost-server

Modified: 2/4/2026

Mattermost race condition in github.com/mattermost/mattermost-server

Modified: 2/4/2026

Mattermost denial of service through long emoji value in github.com/mattermost/mattermost-server

Modified: 8/7/2026

Mattermost leaks details of AD/LDAP groups of a teams in github.com/mattermost/mattermost-server

Modified: 8/7/2026

Mattermost post fetching without auditing in compliance export in github.com/mattermost/mattermost-server

Modified: 2/4/2026

Mattermost allows attackers access to posts in channels they are not a member of in github.com/mattermost/mattermost-server

Modified: 2/4/2026

Mattermost fails to check the "invite_guest" permission in github.com/mattermost/mattermost-server

Modified: 2/4/2026

Mattermost fails to limit the number of role names in github.com/mattermost/mattermost-server

Modified: 2/4/2026

Mattermost fails to properly restrict the access of files attached to posts in github.com/mattermost/mattermost-server

Modified: 2/4/2026

Mattermost incorrectly allows access individual posts in github.com/mattermost/mattermost-server

Modified: 8/7/2026

Mattermost Server doesn't limit the number of user preferences in github.com/mattermost/mattermost-server

Modified: 3/3/2026

Mattermost fails to authenticate the source of certain types of post actions in github.com/mattermost/mattermost-server

Modified: 3/3/2026

Mattermost Server Improper Access Control in github.com/mattermost/mattermost-server

Modified: 3/3/2026

Mattermost Server Improper Access Control in github.com/mattermost/mattermost-server

Modified: 2/4/2026

Mattermost allows team admins to promote guests to team admins in github.com/mattermost/mattermost-server

Modified: 3/3/2026

Mattermost fails to fully validate role changes in github.com/mattermost/mattermost-server

Modified: 3/3/2026

Mattermost crashes web clients via a malformed custom status in github.com/mattermost/mattermost-server

Modified: 3/3/2026

Mattermost fails to limit the size of a request path in github.com/mattermost/mattermost-server

Modified: 3/3/2026

Mattermost's detailed error messages reveal the full file path in github.com/mattermost/mattermost-server

Modified: 3/3/2026

Mattermost fails to limit the number of active sessions in github.com/mattermost/mattermost-server

Modified: 3/3/2026

Mattermost allows a remote actor to permanently delete local data by abusing dangerous error handling in github.com/mattermost/mattermost-server

Modified: 3/3/2026

Mattermost allows remote actor to set arbitrary RemoteId values for synced users in github.com/mattermost/mattermost-server

Modified: 3/3/2026

Mattermost allows remote actor to create/update/delete posts in arbitrary channels in github.com/mattermost/mattermost-server

Modified: 3/3/2026

Mattermost allows a user on a remote to set their remote username prop to an arbitrary string in github.com/mattermost/mattermost-server

Modified: 3/3/2026

Mattermost failed to disallow the modification of local users when syncing users in shared channels in github.com/mattermost/mattermost-server

Modified: 3/3/2026

Mattermost failed to properly validate that the channel that comes from the sync message is a shared channel in github.com/mattermost/mattermost-server

Modified: 3/3/2026

Mattermost failed to properly validate synced reactions in github.com/mattermost/mattermost-server

Modified: 3/3/2026

Mattermost allows a remote actor to make an arbitrary local channel read-only in github.com/mattermost/mattermost-server

Modified: 3/3/2026

Mattermost did not properly restrict channel creation in github.com/mattermost/mattermost-server

Modified: 3/3/2026

Mattermost allows guest user with read access to upload files to a channel in github.com/mattermost/mattermost-server

Modified: 3/3/2026

Mattermost allows team admin user without "Add Team Members" permission to disable invite URL in github.com/mattermost/mattermost-server

Modified: 3/3/2026

Mattermost allows user with systems manager role with read-only access to teams to perform write operations on teams in github.com/mattermost/mattermost-server

Modified: 3/3/2026

Mattermost allows unsolicited invites to expose access to local channels in github.com/mattermost/mattermost-server

Modified: 3/3/2026

Mattermost doesn't redact remote users' original email addresses in github.com/mattermost/mattermost-server

Modified: 3/3/2026

Mattermost doesn't restrict which roles can promote a user as system admin in github.com/mattermost/mattermost-server

Modified: 3/3/2026

Mattermost allows remote/synthetic users to create sessions, reset passwords in github.com/mattermost/mattermost-server

Modified: 3/3/2026

Mattermost Cross-Site Request Forgery vulnerability in github.com/mattermost/mattermost-server

Modified: 3/3/2026

Mattermost fails to strip `embeds` from `metadata` when broadcasting `posted` events in github.com/mattermost/mattermost-server

Modified: 2/4/2026

Mattermost incorrectly issues two sessions when using desktop SSO in github.com/mattermost/mattermost-server

Modified: 2/4/2026

Mattermost Server allows user to get private channel names in github.com/mattermost/mattermost-server

Modified: 2/4/2026

Mattermost Server Path Traversal vulnerability that leads to Cross-Site Request Forgery in github.com/mattermost/mattermost-server

Modified: 2/4/2026

Mattermost Server vulnerable to application crash from attacker-generated large response in github.com/mattermost/mattermost-server

Modified: 2/4/2026

Mattermost server allows authenticated user to delete arbitrary post in github.com/mattermost/mattermost-server

Modified: 2/4/2026

Mattermost Server Resource Exhaustion in github.com/mattermost/mattermost-server

Modified: 3/3/2026

Mattermost Improper Validation of Specified Type of Input vulnerability in github.com/mattermost/mattermost-server

Modified: 3/3/2026

Mattermost Race Condition vulnerability in github.com/mattermost/mattermost-server

Modified: 3/3/2026

Mattermost Data Amplification vulnerability in github.com/mattermost/mattermost-server

Modified: 3/3/2026

Mattermost Incorrect Authorization vulnerability in github.com/mattermost/mattermost-server

Modified: 2/4/2026

Mattermost Improper Validation of Specified Type of Input vulnerability in github.com/mattermost/mattermost-server

Modified: 2/4/2026

Mattermost has Improper Check for Unusual or Exceptional Conditions in github.com/mattermost/mattermost-server

Modified: 2/4/2026

Mattermost fails to properly validate post props in github.com/mattermost/mattermost-server

Modified: 2/4/2026

Mattermost Incorrect Type Conversion or Cast in github.com/mattermost/mattermost-server

Modified: 2/4/2026

Mattermost fails to properly validate post props in github.com/mattermost/mattermost-server

Modified: 2/4/2026

Mattermost webapp crash via a crafted post in github.com/mattermost/mattermost-server

Modified: 2/4/2026

Mattermost allows reading arbitrary files related to importing boards in github.com/mattermost/mattermost-server

Modified: 2/4/2026

Mattermost fails to restrict channel export of archived channels in github.com/mattermost/mattermost-server

Modified: 2/4/2026

Mattermost fails to invalidate all active sessions when converting a user to a bot in github.com/mattermost/mattermost-server

Modified: 2/4/2026

Mattermost allows reading arbitrary files in github.com/mattermost/mattermost-server

Modified: 2/4/2026

Mattermost Fails to Properly Perform Viewer Role Authorization in github.com/mattermost/mattermost-server

Modified: 3/3/2026

Mattermost Fails to Enforce Certain Search APIs in github.com/mattermost/mattermost-server

Modified: 3/3/2026

Mattermost Fails to Restrict Command Execution in Archived Channels in github.com/mattermost/mattermost-server

Modified: 3/3/2026

Mattermost Fails to Enforce MFA on Plugin Endpoints in github.com/mattermost/mattermost-server

Modified: 3/3/2026

Mattermost Fails to Restrict Bookmark Creation and Updates in Archived Channels in github.com/mattermost/mattermost-server

Modified: 3/3/2026

Mattermost fail to prompt for explicit approval before adding a team admin to a private channel in github.com/mattermost/mattermost-server

Modified: 3/3/2026

Mattermost allows members with permission to convert public channels to private and convert private to public in github.com/mattermost/mattermost-server

Modified: 2/4/2026

Mattermost Fails to Enforce Proper Access Controls on `/api/v4/audits` Endpoint in github.com/mattermost/mattermost-server

Modified: 2/4/2026

Mattermost Fails to Restrict Certain Operations on System Admins in github.com/mattermost/mattermost-server

Modified: 2/4/2026

Mattermost vulnerable to Incorrect Implementation of Authentication Algorithm in github.com/mattermost/mattermost-server

Modified: 2/4/2026

Mattermost Incorrect Authorization vulnerability in github.com/mattermost/mattermost-server

Modified: 2/4/2026

Mattermost vulnerable to Observable Timing Discrepancy in github.com/mattermost/mattermost-plugin-msteams

Modified: 2/4/2026

Mattermost Incorrect Authorization vulnerability in github.com/mattermost/mattermost-server

Modified: 2/4/2026

Mattermost Missing Authentication for Critical Function in github.com/mattermost/mattermost-server

Modified: 2/4/2026

Mattermost Incorrect Authorization vulnerability in github.com/mattermost/mattermost-server

Modified: 2/4/2026

Mattermost doesn't restrict domains LLM can request to contact upstream in github.com/mattermost/mattermost-server

Modified: 2/4/2026

Mattermost Incorrect Authorization vulnerability in github.com/mattermost/mattermost-server

Modified: 2/4/2026

Mattermost Playbooks fails to properly validate the props used by the RetrospectivePost custom post type in github.com/mattermost/mattermost-plugin-playbooks

Modified: 2/4/2026

Mattermost Playbooks fails to validate the uniqueness and quantity of task actions in github.com/mattermost/mattermost-plugin-playbooks

Modified: 2/4/2026

Mattermost Playbooks fails to properly validate permissions in github.com/mattermost/mattermost-plugin-playbooks

Modified: 2/4/2026

Mattermost Fails to Verify User's Permissions When Accessing Groups in github.com/mattermost/mattermost-server

Modified: 3/3/2026

Mattermost Fails to Lockout LDAP Users After Repeated Login Failures in github.com/mattermost/mattermost-server

Modified: 3/3/2026

Mattermost Fails to Validate Team Invite Permissions in github.com/mattermost/mattermost-server

Modified: 3/3/2026

Mattermost Fails to Check User Access to `ExperimentalSettings` in github.com/mattermost/mattermost-server

Modified: 3/3/2026

Mattermost improperly allows team administrators to modify team invites in github.com/mattermost/mattermost-server

Modified: 3/3/2026

Mattermost fails to properly enforce access control restrictions for System Manager roles in github.com/mattermost/mattermost-server

Modified: 8/7/2026

Mattermost fails to clear Google OAuth credentials in github.com/mattermost/mattermost-server

Modified: 3/3/2026

Mattermost fails to properly enforce access controls for guest users in github.com/mattermost/mattermost-server

Modified: 8/7/2026

Mattermost fails to properly invalidate personal access tokens upon user deactivation in github.com/mattermost/mattermost-server

Modified: 3/3/2026

Mattermost allows authenticated administrator to execute LDAP search filter injection in github.com/mattermost/mattermost-server

Modified: 3/3/2026

Mattermost allows guest users to view information about public teams they are not members of in github.com/mattermost/mattermost-server

Modified: 3/3/2026

Mattermost allows authenticated users to write files to arbitrary locations in github.com/mattermost/mattermost-server

Modified: 3/3/2026

Mattermost allows an unauthorized Guest user access to Playbook in github.com/mattermost/mattermost-server

Modified: 3/3/2026

Mattermost allows unauthorized channel member management through playbook runs in github.com/mattermost/mattermost-server

Modified: 3/3/2026

Mattermost Incorrect Authorization vulnerability in github.com/mattermost/mattermost-server

Modified: 3/3/2026

Mattermost Incorrect Authorization vulnerability in github.com/mattermost/mattermost-server

Modified: 3/3/2026

Mattermost has Insufficiently Protected Credentials in github.com/mattermost/mattermost-server

Modified: 3/3/2026

Mattermost Missing Authentication for Critical Function in github.com/mattermost/mattermost-server

Modified: 3/3/2026

Mattermost Path Traversal vulnerability in github.com/mattermost/mattermost-server

Modified: 3/3/2026

Mattermost Fails to Validate File Paths in github.com/mattermost/mattermost-server

Modified: 3/3/2026

Mattermost Fails to Properly Validate Team Role Modification in github.com/mattermost/mattermost-server

Modified: 3/3/2026

Mattermost Lack of Access Control Validation in github.com/mattermost/mattermost-server

Modified: 3/3/2026

Mattermost Fails to Validate Remote Cluster Upload Sessions in github.com/mattermost/mattermost-server

Modified: 3/3/2026

Mattermost Does Not Sanitize the Team Invite ID in github.com/mattermost/mattermost-server

Modified: 3/3/2026

Mattermost Server SSRF Vulnerability via the Agents Plugin in github.com/mattermost/mattermost-server

Modified: 3/3/2026

Mattermost Fails to Sanitize Path Traversal Sequences in github.com/mattermost/mattermost-server

Modified: 3/3/2026

Mattermost Fails to Sanitize File Names in github.com/mattermost/mattermost-server

Modified: 3/3/2026

Mattermost has Potential Server Crash due to Unvalidated Import Data in github.com/mattermost/mattermost-server

Modified: 3/3/2026

Mattermost Missing Authorization vulnerability in github.com/mattermost/mattermost-server

Modified: 3/3/2026

Mattermost Open Redirect vulnerability in github.com/mattermost/mattermost-server

Modified: 3/3/2026

Mattermost makes Use of Weak Hash in github.com/mattermost/mattermost-server

Modified: 3/3/2026

Mattermost Open Redirect vulnerability in github.com/mattermost/mattermost-server

Modified: 3/3/2026

Mattermost Path Traversal vulnerability in github.com/mattermost/mattermost-server

Modified: 3/3/2026

Mattermost boards plugin fails to restrict download access to files in github.com/mattermost/mattermost-plugin-boards

Modified: 3/3/2026

Mattermost has a Missing Authorization vulnerability in github.com/mattermost/mattermost-server

Modified: 3/3/2026

Mattermost has an Incorrect Authorization vulnerability in github.com/mattermost/mattermost-server

Modified: 3/3/2026

Guest user can discover active public channels in github.com/mattermost/mattermost-server

Modified: 3/3/2026

Mattermost has a Missing Authorization vulnerability in github.com/mattermost/mattermost-server

Modified: 3/3/2026

Mattermost has a Missing Authorization vulnerability in github.com/mattermost/mattermost-server

Modified: 3/3/2026

Mattermost has an Observable Timing Discrepancy vulnerability in github.com/mattermost/mattermost-server

Modified: 3/3/2026

Mattermost Server vulnerable to Cross-site Scripting through file preview feature in github.com/mattermost/mattermost-server

Modified: 3/3/2026

Mattermost Server is vulnerable to Uncontrolled Resource Consumption in github.com/mattermost/mattermost-server

Modified: 3/3/2026

Mattermost Server: initial_load API exposes unnecessary information in github.com/mattermost/mattermost-server

Modified: 11/5/2025

Mattermost Server is vulnerable to Code Injection through its LDAP fields in github.com/mattermost/mattermost-server

Modified: 3/3/2026

Mattermost Server is vulnerable to XSS through customizable theme color-code values in github.com/mattermost/mattermost-server

Modified: 3/3/2026

Mattermost Server does not enforce rate limits on password change attempts in github.com/mattermost/mattermost-server

Modified: 3/3/2026

Mattermost Server allows XSS via redirect URL in github.com/mattermost/mattermost-server

Modified: 3/3/2026

Mattermost Server does not check if cookies are used over SSL in github.com/mattermost/mattermost-server

Modified: 3/3/2026

Mattermost Server's Session ID and Session Token are potentially compromised in github.com/mattermost/mattermost-server

Modified: 3/3/2026

Mattermost Server is vulnerable to XSS via a Legal or Support setting in github.com/mattermost/mattermost-server

Modified: 3/3/2026

Mattermost Server exposes sensitive information via its System Console UI in github.com/mattermost/mattermost-server

Modified: 3/3/2026

Mattermost Server is vulnerable to XSS through lack of link relationship attributes `noreferrer` and `noopener` in github.com/mattermost/mattermost-server

Modified: 3/3/2026

Mattermost Server: Insufficient Password-Reset Link Invalidation in github.com/mattermost/mattermost-server

Modified: 3/3/2026

Mattermost Server allows System Admin to modify LDAP account names and email addresses in github.com/mattermost/mattermost-server

Modified: 3/3/2026

Mattermost Server exposes sensitive information about team URLs via an API in github.com/mattermost/mattermost-server

Modified: 11/5/2025

Mattermost Server exposes information stored by a web browser in github.com/mattermost/mattermost-server

Modified: 3/3/2026

Mattermost Server exposes account details to any Team Administrator in github.com/mattermost/mattermost-server

Modified: 3/3/2026

Mattermost Server is vulnerable to XSS through crafted links in github.com/mattermost/mattermost-server

Modified: 3/3/2026

Mattermost Server: Files may be rendered inline instead of downloaded, allowing script execution in github.com/mattermost/mattermost-server

Modified: 3/3/2026

Mattermost Server allows XSS via CSRF in github.com/mattermost/mattermost-server

Modified: 3/3/2026

Mattermost Server's OAuth 2.0 service is vulnerable to attack through Missing Authorization in github.com/mattermost/mattermost-server

Modified: 3/3/2026

Mattermost Incorrect Authorization vulnerability in github.com/mattermost/mattermost

Modified: 3/3/2026

Mattermost fails to properly restrict access to archived channel search API in github.com/mattermost/mattermost

Modified: 3/3/2026

Mattermost does not enforce MFA on WebSocket connections in github.com/mattermost/mattermost-server

Modified: 3/3/2026

Mattermost allows an attacker to edit arbitrary posts via a crafted MSTeams plugin OAuth redirect URL in github.com/mattermost/mattermost-server

Modified: 3/3/2026

Mattermost allows system administrators to access password hashes and MFA secrets in github.com/mattermost/mattermost-server

Modified: 3/3/2026

Mattermost allows regular users to access archived channel content and files in github.com/mattermost/mattermost-server

Modified: 3/3/2026

Mattermost allows other users to determine when users had read channels via channel member objects in github.com/mattermost/mattermost-server

Modified: 3/3/2026

Mattermost Server is vulnerable to a Denial of Service attack through `invite_people` command in github.com/mattermost/mattermost-server

Modified: 3/3/2026

Mattermost Server is vulnerable to Directory Traversal by System Admins in github.com/mattermost/mattermost-server

Modified: 12/15/2025

Mattermost fails to properly validate OAuth state tokens during OpenID Connect authentication in github.com/mattermost/mattermost-server

Modified: 3/3/2026

Mattermost fails to sanitize team email addresses in github.com/mattermost/mattermost-server

Modified: 3/3/2026

Mattermost fails to to verify the token used during code exchange in github.com/mattermost/mattermost-server

Modified: 3/3/2026

Mattermost fails to validate user permissions when deleting comments in Boards in github.com/mattermost/mattermost

Modified: 3/3/2026

Mattermost fails to validate user permissions in Boards in github.com/mattermost/mattermost

Modified: 3/3/2026

CVE-2017-18870 in github.com/mattermost/mattermost-server

Modified: 3/3/2026

Mattermost Server vulnerable to Denial of Service through `@` character prefix inserted into JavaScript field names in github.com/mattermost/mattermost-server

Modified: 3/3/2026

Mattermost Server exposes team invite IDs through API endpoints in github.com/mattermost/mattermost-server

Modified: 3/3/2026

Mattermost Server does not prevent System Admin from arbitrary file creation in github.com/mattermost/mattermost-server

Modified: 12/9/2025

Mattermost Server is vulnerable to Path Traversal when files are stored locally in github.com/mattermost/mattermost-server

Modified: 12/9/2025

Mattermost Server is vulnerable to XSS through author_link field in Slack attachments in github.com/mattermost/mattermost-server

Modified: 3/3/2026

Mattermost Server is vulnerable to XSS attacks against an OAuth 2.0 allow/deny page in github.com/mattermost/mattermost-server

Modified: 3/3/2026

Mattermost Server allows users with a session ID to revoke another users' session in github.com/mattermost/mattermost-server

Modified: 12/15/2025

Mattermost Server exposes OAuth personal access tokens to attackers in github.com/mattermost/mattermost-server

Modified: 3/3/2026

Mattermost Server has low entropy for authorization data as an OAuth 2.0 Service Provider in github.com/mattermost/mattermost-server

Modified: 3/3/2026

Mattermost Server exposes team creator's e-mail address to other members in github.com/mattermost/mattermost-server

Modified: 3/3/2026

Mattermost Server allows attackers to gain privileges by accessing unintended API endpoints with users' credentials in github.com/mattermost/mattermost-server

Modified: 3/3/2026

Mattermost Server is vulnerable to webhook and slash command manipulation in github.com/mattermost/mattermost-server

Modified: 3/3/2026

Mattermost Server allows attackers to create buttons that can launch API requests in github.com/mattermost/mattermost-server

Modified: 3/3/2026

Mattermost Server is vulnerable to SQL Injection when executing multiple POST requests in github.com/mattermost/mattermost-server

Modified: 3/3/2026

Mattermost Server does not properly restrict use of slash commands in github.com/mattermost/mattermost-server

Modified: 3/3/2026

Mattermost GitHub Plugin Bot Identity Validation Bypass Allows Arbitrary GitHub Reaction Injection in github.com/mattermost/mattermost

Modified: 3/3/2026

Mattermost has missing redirect URL validation in github.com/mattermost/mattermost

Modified: 3/3/2026

Mattermost has an Invite Token Replay Vulnerability via Channel Membership Manipulation in github.com/mattermost/mattermost

Modified: 3/3/2026

Mattermost doesn't validate user channel membership when attaching Mattermost posts as comments to Jira issues in github.com/mattermost/mattermost-server

Modified: 2/26/2026

Mattermost doesn't verify that post actions invoking `/share-issue-publicly` were created by the Jira plugin in github.com/mattermost/mattermost-server

Modified: 2/26/2026

Mattermost with Jira plugin enabled has Incorrect Implementation of Authentication Algorithm in github.com/mattermost/mattermost-plugin-jira

Modified: 3/3/2026

Mattermost Server is vulnerable to channel invisibility DoS via misformatted post in github.com/mattermost/mattermost-server

Modified: 2/26/2026

Mattermost Server exposes sensitive user status information via REST API version 4 endpoint in github.com/mattermost/mattermost-server

Modified: 3/3/2026

Mattermost Server is vulnerable to XSS through display name field in github.com/mattermost/mattermost-server

Modified: 3/3/2026

Mattermost Server has intermittent Authorization bypass for resource-owners in github.com/mattermost/mattermost-server

Modified: 3/3/2026

Mattermost Server does not safeguard against phishing via error page links in github.com/mattermost/mattermost-server

Modified: 3/3/2026

Mattermost Server allows attackers to log sensitive information via DEBUG REST API logging endpoint in github.com/mattermost/mattermost-server

Modified: 3/3/2026

Mattermost Server is vulnerable to DoS through maliciously crafted posts in github.com/mattermost/mattermost-server

Modified: 3/3/2026

Mattermost Server mishandles redirect denial action in github.com/mattermost/mattermost-server

Modified: 3/3/2026

Mattermost Server vulnerable to XSS via an uploaded file in github.com/mattermost/mattermost-server

Modified: 3/3/2026

Mattermost Server is vulnerable CSV Injection in github.com/mattermost/mattermost-server

Modified: 3/3/2026

CVE-2017-18901 in github.com/mattermost/mattermost-server

Modified: 3/3/2026

Mattermost Server vulnerable to CSRF if CORS is enabled in github.com/mattermost/mattermost-server

Modified: 2/26/2026

Mattermost Server has Insufficient Session Expiration when used as an OAuth 2.0 service provider in github.com/mattermost/mattermost-server

Modified: 3/3/2026

Mattermost Server does not neutralize HTML content in an Email template field in github.com/mattermost/mattermost-server

Modified: 3/3/2026

Mattermost is vulnerable to CPU exhaustion via crafted HTTP request in github.com/mattermost/mattermost-server

Modified: 2/26/2026

Mattermost is vulnerable to DoS due to infinite re-renders on API errors in github.com/mattermost/mattermost-server

Modified: 2/26/2026

Mattermost Server vulnerable to XSS through channel headers in github.com/mattermost/mattermost-server

Modified: 2/19/2026

Mattermost Server does not restrict SAML certificate path for System Administrators in github.com/mattermost/mattermost-server

Modified: 2/19/2026

Mattermost Server server restarts may provide attackers with API access in github.com/mattermost/mattermost-server

Modified: 2/19/2026

Mattermost Server uses weak hashing for OAuth, email verification tokens and invitations in github.com/mattermost/mattermost-server

Modified: 2/19/2026

Mattermost Server has X.509 Improper Certificate Validation in github.com/mattermost/mattermost-server

Modified: 2/19/2026

Mattermost Server has Improper Authorization for Integration Requests in github.com/mattermost/mattermost-server

Modified: 2/19/2026

Mattermost Server password reset email requests can be sent to attacker-provided email addresses in github.com/mattermost/mattermost-server

Modified: 2/19/2026

Mattermost Server vulnerable to user account takeover when Single Sign-On OAuth2 is used in github.com/mattermost/mattermost-server

Modified: 2/19/2026

Mattermost Server SAML implementation does not require encryption or signature verification as default in github.com/mattermost/mattermost-server

Modified: 2/19/2026

Mattermost Server allows an attacker to specify a full pathname of a log file in github.com/mattermost/mattermost-server

Modified: 2/19/2026

Mattermost doesn't properly validate channel membership at the time of data retrieval in github.com/mattermost/mattermost-server

Modified: 2/23/2026

Mattermost doesn't validate user permissions when creating Jira issues from Mattermost posts in github.com/mattermost/mattermost-server

Modified: 2/23/2026

Mattermost fails to properly validate login method restrictions in github.com/mattermost/mattermost-server

Modified: 2/23/2026

Mattermost fails to properly validate team membership when processing channel mentions in github.com/mattermost/mattermost-server

Modified: 2/23/2026

Mattermost fails to enforce invite permissions when updating team settings in github.com/mattermost/mattermost-server

Modified: 2/23/2026

Mattermost fails to sanitize sensitive data in WebSocket messages in github.com/mattermost/mattermost-server

Modified: 2/23/2026

Mattermost fails to properly validate User-Agent header tokens in github.com/mattermost/mattermost-server

Modified: 3/26/2026

Mattermost fails to limit the size of responses from integration action endpoints in github.com/mattermost/mattermost-server

Modified: 3/26/2026

Mattermost fails to bound memory allocation when processing PSD image files in github.com/mattermost/mattermost-server

Modified: 4/16/2026

Mattermost allows a removed team member to enumerate all public channels within a private team in github.com/mattermost/mattermost-server

Modified: 3/23/2026

Mattermost fails to properly handle very long passwords in github.com/mattermost/mattermost-server

Modified: 3/23/2026

Mattermost allows attackers to spoof permalink embeds in github.com/mattermost/mattermost-server

Modified: 3/23/2026

Mattermost fails to bound memory allocation when processing DOC files in github.com/mattermost/mattermost-server

Modified: 3/23/2026

Mattermost fails to preserve the redacted state of burn-on-read posts during deletion in github.com/mattermost/mattermost-server

Modified: 3/23/2026

Mattermost fails to filter invite IDs based on user permissions in github.com/mattermost/mattermost-server

Modified: 3/23/2026

Mattermost fails to use consistent error responses when handling the /mute command in github.com/mattermost/mattermost-server

Modified: 3/23/2026

Mattermost fails to properly enforce read permissions in search API endpoints in github.com/mattermost/mattermost-server

Modified: 3/23/2026

Mattermost fails to canonicalize IPv4-mapped IPv6 addresses before reserved IP validation in github.com/mattermost/mattermost-server

Modified: 3/23/2026

Mattermost fails to validate team-specific upload_file permissions in github.com/mattermost/mattermost-server

Modified: 3/23/2026

Mattermost fails to validate user's authentication method when processing account auth type switch in github.com/mattermost/mattermost-server

Modified: 3/23/2026

Mattermost allows attackers to manipulate administrator terminals via crafted messages containing ANSI and OSC escape sequences in github.com/mattermost/mattermost-server

Modified: 6/25/2026

Mattermost allows system administrators to read arbitrary host files via malicious AdvancedLoggingJSON configuration in github.com/mattermost/mattermost-server

Modified: 6/25/2026

Mattermost doesn't set permissions on downloaded bulk export in github.com/mattermost/mattermost-server

Modified: 6/25/2026

Mattermost has an Incorrect Authorization issue in github.com/mattermost/mattermost-server

Modified: 6/25/2026

Mattermost doesn't sanitize sensitive configuration fields in the Mattermost Calls plugin in github.com/mattermost/mattermost-plugin-calls

Modified: 6/25/2026

Mattermost: Authenticated DoS through failure to prevent rendering of external SVGs on link embeds in github.com/mattermost/mattermost-server

Modified: 6/25/2026

Mattermost does not verify remote cluster channel access when processing shared channel membership removals in github.com/mattermost/mattermost-server

Modified: 6/25/2026

Mattermost doesn't verify channel membership when processing AI-assisted message rewrites in github.com/mattermost/mattermost-server

Modified: 6/25/2026

Mattermost doesn't sanitize sensitive configuration fields before including them in support packet generation in github.com/mattermost/mattermost-server

Modified: 6/25/2026

Mattermost has a Path Traversal issue in github.com/mattermost/mattermost-server

Modified: 6/25/2026

Mattermost doesn't validate 7zip archive structure before processing in github.com/mattermost/mattermost-server

Modified: 6/25/2026

Mattermost allows attackers to take over arbitrary user accounts via overly permissive substring matching flaw in github.com/mattermost/mattermost-server

Modified: 6/25/2026

Mattermost has an Incorrect Authorization issue in github.com/mattermost/mattermost-server

Modified: 6/25/2026

Mattermost doesn't check if {{team_id}} was being changed when updating playbooks in github.com/mattermost/mattermost-plugin-playbooks

Modified: 6/25/2026

Mattermost doesn't validate that the RefreshedToken differs from the original invite token during remote cluster invite confirmation in github.com/mattermost/mattermost-server

Modified: 6/25/2026

Mattermost doesn't enforce the PostEditTimeLimit on non-message post fields in github.com/mattermost/mattermost-server

Modified: 6/25/2026

Mattermost doesn't validate the response body of proxied images in github.com/mattermost/mattermost-server

Modified: 6/25/2026

Mattermost doesn't enforce client identity binding during the OAuth authorization code redemption flow in github.com/mattermost/mattermost-server

Modified: 6/25/2026

Mattermost doesn't escape some variables that could contain malicious content during error page composition in github.com/mattermost/mattermost-server

Modified: 6/25/2026

Mattermost doesn't limit the size of the request body on the start meeting API endpoint in github.com/mattermost/mattermost-plugin-msteams-meetings

Modified: 6/25/2026

Mattermost doesn't check public/private permissions in github.com/mattermost/mattermost-plugin-playbooks

Modified: 6/25/2026

Mattermost doesn't validate CSRF tokens on an authentication endpoint in github.com/mattermost/mattermost-server

Modified: 6/25/2026

Mattermost has session spoofing due to lack of single-use consumption of guest magic link tokens enforcement in github.com/mattermost/mattermost-server

Modified: 6/25/2026

Mattermost allows authenticated guest users to enumerate user IDs outside their allowed visibility scope in github.com/mattermost/mattermost-server

Modified: 6/25/2026

Mattermost doesn't validate whether users were correctly owned by the correct Connected Workspace in github.com/mattermost/mattermost-server

Modified: 6/25/2026

Mattermost doesn't properly validate CSRF tokens in github.com/mattermost/mattermost-server

Modified: 6/25/2026

Mattermost doesn't check the create_post channel permission during post edit operations in github.com/mattermost/mattermost-server

Modified: 6/25/2026

Mattermost doesn't validate decompressed archive entry sizes during file extraction in github.com/mattermost/mattermost-server

Modified: 6/25/2026

Mattermost doesn't validate the Host header when constructing response URLs for custom slash command in github.com/mattermost/mattermost-server

Modified: 6/25/2026

Mattermost doesn't enforce slash command trigger-word uniqueness during command updates in github.com/mattermost/mattermost-server

Modified: 6/25/2026

Mattermost doesn't prevent disclosure of created user password in github.com/mattermost/mattermost-server

Modified: 6/25/2026

Mattermost doesn't validate the X-Requested-With header on the burn-on-read reveal endpoint in github.com/mattermost/mattermost-server

Modified: 6/25/2026

Mattermost doesn't validate file ownership and access control in github.com/mattermost/mattermost-server

Modified: 7/7/2026

Mattermost doesn't sanitize team member data when returned via API to users without elevated permissions in github.com/mattermost/mattermost-server

Modified: 7/7/2026

Mattermost doesn't archive the channel before removing persistent notifications in github.com/mattermost/mattermost-server

Modified: 7/7/2026

Mattermost doesn't validate user-supplied input in API request handlers in github.com/mattermost/mattermost-plugin-github

Modified: 7/7/2026

Mattermost doesn't validate the TIFF IFD offset in the image header before allocating memory in github.com/mattermost/mattermost-server

Modified: 7/7/2026

Mattermost doesn't enforce request body size limits on plugin HTTP endpoints in github.com/mattermost/mattermost-plugin-github

Modified: 7/7/2026

Mattermost doesn't properly validate msgpack-encoded WebSocket frames before memory allocation in github.com/mattermost/mattermost-server

Modified: 7/7/2026

Mattermost allows authenticated users to gain access to private repositories in github.com/mattermost/mattermost-plugin-github

Modified: 7/7/2026

Mattermost doesn't filter nil elements from outgoing webhook attachment payloads before processing in github.com/mattermost/mattermost-server

Modified: 7/7/2026

Mattermost doesn't validate that a username returned during bot registration belongs to a bot account in github.com/mattermost/mattermost-server

Modified: 8/26/2026

Mattermost doesn't require role-management authorization when setting the scheme_admin flag on group syncable link and patch endpoints in github.com/mattermost/mattermost-server

Modified: 8/26/2026

Mattermost doesn't sanitize FileInfo.Name received from federated peers during shared channel file sync in github.com/mattermost/mattermost-server

Modified: 8/26/2026

Mattermost doesn't sanitize the Remote Cluster API response on PATCH operations in github.com/mattermost/mattermost-server

Modified: 8/26/2026

Mattermost doesn't enforce PermissionInviteUser when setting AllowOpenInvite or AllowedDomains during team creation in github.com/mattermost/mattermost-server

Modified: 8/26/2026

Mattermost doesn't require system-level permission when patching protected default system roles in github.com/mattermost/mattermost-server

Modified: 8/26/2026

Mattermost doesn't restrict role_updated websocket event broadcasts to members of the affected team or channel in github.com/mattermost/mattermost-server

Modified: 8/26/2026

Mattermost doesn't enforce administrator authorization on the {{setDefaultInstance}} call within the {{/gitlab connect}} command handler in github.com/mattermost/mattermost-server

Modified: 9/28/2026

Mattermost doesn't enforce bot-specific permission checks on the user active status endpoint in github.com/mattermost/mattermost-server

Modified: 9/28/2026

Mattermost doesn't invalidate cached authentication state for active WebSocket connections during global session revocation in github.com/mattermost/mattermost-server

Modified: 9/28/2026

Mattermost doesn't authenticate Atlassian Connect installed callbacks, allowing a remote unauthenticated attacker to inject a rogue sharedSecret in github.com/mattermost/mattermost-server

Modified: 9/28/2026

Mattermost doesn't validate channel ownership of an existing subscription before applying edits in github.com/mattermost/mattermost-server

Modified: 9/28/2026

Mattermost has an Incorrect Authorization issue in github.com/mattermost/mattermost-server

Modified: 10/1/2026