github.com/mattermost/mattermost-server (Go)
Advisories
809
Latest version
—
License
—
OpenSSF Scorecard
—
How to fix
Upgrading to 11.7.1 or later clears every advisory below that has a fix.
Upgrade commands
go
go get github.com/mattermost/mattermost-server@v11.7.1 && go mod tidyKnown vulnerabilities
| Advisory | Severity | Affected | Fixed in |
|---|---|---|---|
| GHSA-xmfh-3ccg-c9fx Mattermost has an Incorrect Authorization issue |
Low EPSS 0.32% |
>= 11.7.0, < 11.7.1 | 11.7.1 |
| GHSA-xmfh-3ccg-c9fx Mattermost has an Incorrect Authorization issue |
Low EPSS 0.32% |
>= 10.11.0+incompatible, < 10.11.18+incompatible>= 11.7.0+incompatible, < 11.7.1+incompatible | 10.11.18+incompatible11.7.1+incompatible |
| GHSA-xmfh-3ccg-c9fx Mattermost has an Incorrect Authorization issue |
Low EPSS 0.32% |
>= 10.11.0, < 10.11.18 | 10.11.18 |
| GHSA-h998-hxxj-8q83 Mattermost doesn't invalidate cached authentication state for active WebSocket connections during global session revocation |
Medium EPSS 0.33% |
>= 11.6.0, < 11.6.3 | 11.6.3 |
| GHSA-h998-hxxj-8q83 Mattermost doesn't invalidate cached authentication state for active WebSocket connections during global session revocation |
Medium EPSS 0.33% |
>= 10.11.0+incompatible, < 10.11.18+incompatible>= 11.5.0+incompatible, < 11.5.6+incompatible>= 11.6.0+incompatible, < 11.6.3+incompatible>= 11.7.0+incompatible, < 11.7.1+incompatible | 10.11.18+incompatible11.5.6+incompatible11.6.3+incompatible11.7.1+incompatible |
| GHSA-h998-hxxj-8q83 Mattermost doesn't invalidate cached authentication state for active WebSocket connections during global session revocation |
Medium EPSS 0.33% |
>= 10.11.0, < 10.11.18 | 10.11.18 |
| GHSA-h998-hxxj-8q83 Mattermost doesn't invalidate cached authentication state for active WebSocket connections during global session revocation |
Medium EPSS 0.33% |
>= 11.7.0, < 11.7.1 | 11.7.1 |
| GHSA-h998-hxxj-8q83 Mattermost doesn't invalidate cached authentication state for active WebSocket connections during global session revocation |
Medium EPSS 0.33% |
>= 11.5.0, < 11.5.6 | 11.5.6 |
| GHSA-g5vr-6pgg-74qv Mattermost doesn't enforce bot-specific permission checks on the user active status endpoint |
Low EPSS 0.32% |
>= 10.11.0+incompatible, < 10.11.18+incompatible>= 11.7.0+incompatible, < 11.7.1+incompatible | 10.11.18+incompatible11.7.1+incompatible |
| GHSA-g5vr-6pgg-74qv Mattermost doesn't enforce bot-specific permission checks on the user active status endpoint |
Low EPSS 0.32% |
>= 10.11.0, < 10.11.18 | 10.11.18 |
| GHSA-g5vr-6pgg-74qv Mattermost doesn't enforce bot-specific permission checks on the user active status endpoint |
Low EPSS 0.32% |
>= 11.7.0, < 11.7.1 | 11.7.1 |
| GHSA-jqgv-39mg-7c2r Mattermost doesn't authenticate Atlassian Connect installed callbacks, allowing a remote unauthenticated attacker to inject a rogue sharedSecret |
Medium EPSS 0.30% |
>= 11.6.0, < 11.6.3 | 11.6.3 |
| GHSA-jqgv-39mg-7c2r Mattermost doesn't authenticate Atlassian Connect installed callbacks, allowing a remote unauthenticated attacker to inject a rogue sharedSecret |
Medium EPSS 0.30% |
>= 11.7.0, < 11.7.1 | 11.7.1 |
| GHSA-jqgv-39mg-7c2r Mattermost doesn't authenticate Atlassian Connect installed callbacks, allowing a remote unauthenticated attacker to inject a rogue sharedSecret |
Medium EPSS 0.30% |
>= 10.11.0+incompatible, < 10.11.18+incompatible>= 11.5.0+incompatible, < 11.5.6+incompatible>= 11.6.0+incompatible, < 11.6.3+incompatible>= 11.7.0+incompatible, < 11.7.1+incompatible | 10.11.18+incompatible11.5.6+incompatible11.6.3+incompatible11.7.1+incompatible |
| GHSA-jqgv-39mg-7c2r Mattermost doesn't authenticate Atlassian Connect installed callbacks, allowing a remote unauthenticated attacker to inject a rogue sharedSecret |
Medium EPSS 0.30% |
>= 10.11.0, < 10.11.18 | 10.11.18 |
| GHSA-jqgv-39mg-7c2r Mattermost doesn't authenticate Atlassian Connect installed callbacks, allowing a remote unauthenticated attacker to inject a rogue sharedSecret |
Medium EPSS 0.30% |
>= 11.5.0, < 11.5.6 | 11.5.6 |
| GHSA-mxq2-5jpg-7474 Mattermost doesn't validate channel ownership of an existing subscription before applying edits |
Medium EPSS 0.24% |
>= 10.11.0+incompatible, < 10.11.18+incompatible>= 11.5.0+incompatible, < 11.5.6+incompatible>= 11.6.0+incompatible, < 11.6.3+incompatible>= 11.7.0+incompatible, < 11.7.1+incompatible | 10.11.18+incompatible11.5.6+incompatible11.6.3+incompatible11.7.1+incompatible |
| GHSA-mxq2-5jpg-7474 Mattermost doesn't validate channel ownership of an existing subscription before applying edits |
Medium EPSS 0.24% |
>= 11.6.0, < 11.6.3 | 11.6.3 |
| GHSA-mxq2-5jpg-7474 Mattermost doesn't validate channel ownership of an existing subscription before applying edits |
Medium EPSS 0.24% |
>= 11.7.0, < 11.7.1 | 11.7.1 |
| GHSA-mxq2-5jpg-7474 Mattermost doesn't validate channel ownership of an existing subscription before applying edits |
Medium EPSS 0.24% |
>= 11.5.0, < 11.5.6 | 11.5.6 |
| GHSA-mxq2-5jpg-7474 Mattermost doesn't validate channel ownership of an existing subscription before applying edits |
Medium EPSS 0.24% |
>= 10.11.0, < 10.11.18 | 10.11.18 |
| GHSA-2g8v-grq3-hq2g Mattermost doesn't enforce administrator authorization on the {{setDefaultInstance}} call within the {{/gitlab connect}} command handler |
Medium EPSS 0.29% |
>= 11.7.0, < 11.7.1 | 11.7.1 |
| GHSA-2g8v-grq3-hq2g Mattermost doesn't enforce administrator authorization on the {{setDefaultInstance}} call within the {{/gitlab connect}} command handler |
Medium EPSS 0.29% |
>= 10.11.0, < 10.11.18 | 10.11.18 |
| GHSA-2g8v-grq3-hq2g Mattermost doesn't enforce administrator authorization on the {{setDefaultInstance}} call within the {{/gitlab connect}} command handler |
Medium EPSS 0.29% |
>= 11.5.0, < 11.5.6 | 11.5.6 |
| GHSA-2g8v-grq3-hq2g Mattermost doesn't enforce administrator authorization on the {{setDefaultInstance}} call within the {{/gitlab connect}} command handler |
Medium EPSS 0.29% |
>= 11.6.0, < 11.6.3 | 11.6.3 |
| GHSA-2g8v-grq3-hq2g Mattermost doesn't enforce administrator authorization on the {{setDefaultInstance}} call within the {{/gitlab connect}} command handler |
Medium EPSS 0.29% |
>= 10.11.0+incompatible, < 10.11.18+incompatible>= 11.5.0+incompatible, < 11.5.6+incompatible>= 11.6.0+incompatible, < 11.6.3+incompatible>= 11.7.0+incompatible, < 11.7.1+incompatible | 10.11.18+incompatible11.5.6+incompatible11.6.3+incompatible11.7.1+incompatible |
| GHSA-6hxm-w4hv-vgvw Mattermost doesn't require role-management authorization when setting the scheme_admin flag on group syncable link and patch endpoints |
High EPSS 0.31% |
>= 11.6.0, < 11.6.1 | 11.6.1 |
| GHSA-6hxm-w4hv-vgvw Mattermost doesn't require role-management authorization when setting the scheme_admin flag on group syncable link and patch endpoints |
High EPSS 0.31% |
>= 11.5.0, < 11.5.5 | 11.5.5 |
| GHSA-6hxm-w4hv-vgvw Mattermost doesn't require role-management authorization when setting the scheme_admin flag on group syncable link and patch endpoints |
High EPSS 0.31% |
>= 10.11.0, < 10.11.17 | 10.11.17 |
| GHSA-6hxm-w4hv-vgvw Mattermost doesn't require role-management authorization when setting the scheme_admin flag on group syncable link and patch endpoints |
High EPSS 0.31% |
>= 10.11.0+incompatible, < 10.11.17+incompatible>= 11.5.0+incompatible, < 11.5.5+incompatible>= 11.6.0+incompatible, < 11.6.1+incompatible | 10.11.17+incompatible11.5.5+incompatible11.6.1+incompatible |
| GHSA-9p44-r552-4wp9 Mattermost doesn't sanitize the Remote Cluster API response on PATCH operations |
Medium EPSS 0.26% |
>= 11.5.0, < 11.5.5 | 11.5.5 |
| GHSA-9p44-r552-4wp9 Mattermost doesn't sanitize the Remote Cluster API response on PATCH operations |
Medium EPSS 0.26% |
>= 10.11.0, < 10.11.16 | 10.11.16 |
| GHSA-9p44-r552-4wp9 Mattermost doesn't sanitize the Remote Cluster API response on PATCH operations |
Medium EPSS 0.26% |
>= 10.11.0+incompatible, < 10.11.16+incompatible>= 11.5.0+incompatible, < 11.5.5+incompatible>= 11.6.0+incompatible, < 11.6.1+incompatible | 10.11.16+incompatible11.5.5+incompatible11.6.1+incompatible |
| GHSA-9p44-r552-4wp9 Mattermost doesn't sanitize the Remote Cluster API response on PATCH operations |
Medium EPSS 0.26% |
>= 11.6.0, < 11.6.1 | 11.6.1 |
| GHSA-8qq9-cqj8-82w4 Mattermost doesn't sanitize FileInfo.Name received from federated peers during shared channel file sync |
High EPSS 0.30% |
>= 10.11.0, < 10.11.17 | 10.11.17 |
| GHSA-8qq9-cqj8-82w4 Mattermost doesn't sanitize FileInfo.Name received from federated peers during shared channel file sync |
High EPSS 0.30% |
>= 11.5.0, < 11.5.5 | 11.5.5 |
| GHSA-8qq9-cqj8-82w4 Mattermost doesn't sanitize FileInfo.Name received from federated peers during shared channel file sync |
High EPSS 0.30% |
>= 11.6.0, < 11.6.1 | 11.6.1 |
| GHSA-8qq9-cqj8-82w4 Mattermost doesn't sanitize FileInfo.Name received from federated peers during shared channel file sync |
High EPSS 0.30% |
>= 10.11.0+incompatible, < 10.11.17+incompatible>= 11.5.0+incompatible, < 11.5.5+incompatible>= 11.6.0+incompatible, < 11.6.1+incompatible | 10.11.17+incompatible11.5.5+incompatible11.6.1+incompatible |
| GHSA-m2w9-h2mm-79qr Mattermost doesn't require system-level permission when patching protected default system roles |
High EPSS 0.26% |
>= 10.11.0, < 10.11.17 | 10.11.17 |
| GHSA-m2w9-h2mm-79qr Mattermost doesn't require system-level permission when patching protected default system roles |
High EPSS 0.26% |
>= 11.6.0, < 11.6.1 | 11.6.1 |
| GHSA-m2w9-h2mm-79qr Mattermost doesn't require system-level permission when patching protected default system roles |
High EPSS 0.26% |
>= 11.5.0, < 11.5.5 | 11.5.5 |
| GHSA-m2w9-h2mm-79qr Mattermost doesn't require system-level permission when patching protected default system roles |
High EPSS 0.26% |
>= 10.11.0+incompatible, < 10.11.17+incompatible>= 11.5.0+incompatible, < 11.5.5+incompatible>= 11.6.0+incompatible, < 11.6.1+incompatible | 10.11.17+incompatible11.5.5+incompatible11.6.1+incompatible |
| GHSA-c28q-m4gf-vg4q Mattermost doesn't enforce PermissionInviteUser when setting AllowOpenInvite or AllowedDomains during team creation |
Medium EPSS 0.15% |
>= 10.11.0+incompatible, < 10.11.17+incompatible>= 11.5.0+incompatible, < 11.5.5+incompatible>= 11.6.0+incompatible, < 11.6.1+incompatible | 10.11.17+incompatible11.5.5+incompatible11.6.1+incompatible |
| GHSA-c28q-m4gf-vg4q Mattermost doesn't enforce PermissionInviteUser when setting AllowOpenInvite or AllowedDomains during team creation |
Medium EPSS 0.15% |
>= 11.6.0, < 11.6.1 | 11.6.1 |
| GHSA-c28q-m4gf-vg4q Mattermost doesn't enforce PermissionInviteUser when setting AllowOpenInvite or AllowedDomains during team creation |
Medium EPSS 0.15% |
>= 10.11.0, < 10.11.17 | 10.11.17 |
| GHSA-c28q-m4gf-vg4q Mattermost doesn't enforce PermissionInviteUser when setting AllowOpenInvite or AllowedDomains during team creation |
Medium EPSS 0.15% |
>= 11.5.0, < 11.5.5 | 11.5.5 |
| GHSA-3vmp-whvv-5v9v Mattermost doesn't validate that a username returned during bot registration belongs to a bot account |
Medium EPSS 0.19% |
>= 10.11.0+incompatible, < 10.11.17+incompatible>= 11.5.0+incompatible, < 11.5.5+incompatible>= 11.6.0+incompatible, < 11.6.1+incompatible | 10.11.17+incompatible11.5.5+incompatible11.6.1+incompatible |
| GHSA-3vmp-whvv-5v9v Mattermost doesn't validate that a username returned during bot registration belongs to a bot account |
Medium EPSS 0.19% |
>= 11.6.0, < 11.6.1 | 11.6.1 |
| GHSA-3vmp-whvv-5v9v Mattermost doesn't validate that a username returned during bot registration belongs to a bot account |
Medium EPSS 0.19% |
>= 11.5.0, < 11.5.5 | 11.5.5 |
| GHSA-3vmp-whvv-5v9v Mattermost doesn't validate that a username returned during bot registration belongs to a bot account |
Medium EPSS 0.19% |
>= 10.11.0, < 10.11.17 | 10.11.17 |
| GHSA-rp4v-qc77-phm4 Mattermost doesn't restrict role_updated websocket event broadcasts to members of the affected team or channel |
Medium EPSS 0.18% |
>= 11.5.0, < 11.5.5 | 11.5.5 |
| GHSA-rp4v-qc77-phm4 Mattermost doesn't restrict role_updated websocket event broadcasts to members of the affected team or channel |
Medium EPSS 0.18% |
>= 10.11.0, < 10.11.17 | 10.11.17 |
| GHSA-rp4v-qc77-phm4 Mattermost doesn't restrict role_updated websocket event broadcasts to members of the affected team or channel |
Medium EPSS 0.18% |
>= 10.11.0+incompatible, < 10.11.17+incompatible>= 11.5.0+incompatible, < 11.5.5+incompatible>= 11.6.0+incompatible, < 11.6.1+incompatible | 10.11.17+incompatible11.5.5+incompatible11.6.1+incompatible |
| GHSA-rp4v-qc77-phm4 Mattermost doesn't restrict role_updated websocket event broadcasts to members of the affected team or channel |
Medium EPSS 0.18% |
>= 11.6.0, < 11.6.1 | 11.6.1 |
| GHSA-5gmf-x7hg-97wf Mattermost doesn't filter nil elements from outgoing webhook attachment payloads before processing |
Medium EPSS 0.28% |
>= 11.5.0, < 11.5.4 | 11.5.4 |
| GHSA-5gmf-x7hg-97wf Mattermost doesn't filter nil elements from outgoing webhook attachment payloads before processing |
Medium EPSS 0.28% |
>= 11.6.0, < 11.6.1 | 11.6.1 |
| GHSA-5gmf-x7hg-97wf Mattermost doesn't filter nil elements from outgoing webhook attachment payloads before processing |
Medium EPSS 0.28% |
>= 10.11.0+incompatible, < 10.11.15+incompatible>= 11.4.0+incompatible, < 11.4.5+incompatible>= 11.5.0+incompatible, < 11.5.4+incompatible>= 11.6.0+incompatible, < 11.6.1+incompatible | 10.11.15+incompatible11.4.5+incompatible11.5.4+incompatible11.6.1+incompatible |
| GHSA-5gmf-x7hg-97wf Mattermost doesn't filter nil elements from outgoing webhook attachment payloads before processing |
Medium EPSS 0.28% |
>= 10.11.0, < 10.11.15 | 10.11.15 |
| GHSA-5gmf-x7hg-97wf Mattermost doesn't filter nil elements from outgoing webhook attachment payloads before processing |
Medium EPSS 0.28% |
>= 11.4.0, < 11.4.5 | 11.4.5 |
| GHSA-r5vf-grcx-5vqp Mattermost allows authenticated users to gain access to private repositories |
Medium EPSS 0.14% |
>= 11.5.0, < 11.5.4 | 11.5.4 |
| GHSA-r5vf-grcx-5vqp Mattermost allows authenticated users to gain access to private repositories |
Medium EPSS 0.14% |
>= 10.11.0, < 10.11.15 | 10.11.15 |
| GHSA-r5vf-grcx-5vqp Mattermost allows authenticated users to gain access to private repositories |
Medium EPSS 0.14% |
>= 11.6.0, < 11.6.1 | 11.6.1 |
| GHSA-r5vf-grcx-5vqp Mattermost allows authenticated users to gain access to private repositories |
Medium EPSS 0.14% |
>= 10.11.0+incompatible, < 10.11.15+incompatible>= 11.4.0+incompatible, < 11.4.5+incompatible>= 11.5.0+incompatible, < 11.5.4+incompatible>= 11.6.0+incompatible, < 11.6.1+incompatible | 10.11.15+incompatible11.4.5+incompatible11.5.4+incompatible11.6.1+incompatible |
| GHSA-r5vf-grcx-5vqp Mattermost allows authenticated users to gain access to private repositories |
Medium EPSS 0.14% |
>= 11.4.0, < 11.4.5 | 11.4.5 |
| GHSA-37j2-3vv8-cf24 Mattermost doesn't validate the TIFF IFD offset in the image header before allocating memory |
Medium EPSS 0.24% |
>= 11.6.0, < 11.6.1 | 11.6.1 |
| GHSA-37j2-3vv8-cf24 Mattermost doesn't validate the TIFF IFD offset in the image header before allocating memory |
Medium EPSS 0.24% |
>= 11.5.0, < 11.5.4 | 11.5.4 |
| GHSA-37j2-3vv8-cf24 Mattermost doesn't validate the TIFF IFD offset in the image header before allocating memory |
Medium EPSS 0.24% |
>= 10.11.0+incompatible, < 10.11.15+incompatible>= 11.4.0+incompatible, < 11.4.5+incompatible>= 11.5.0+incompatible, < 11.5.4+incompatible>= 11.6.0+incompatible, < 11.6.1+incompatible | 10.11.15+incompatible11.4.5+incompatible11.5.4+incompatible11.6.1+incompatible |
| GHSA-37j2-3vv8-cf24 Mattermost doesn't validate the TIFF IFD offset in the image header before allocating memory |
Medium EPSS 0.24% |
>= 10.11.0, < 10.11.15 | 10.11.15 |
| GHSA-37j2-3vv8-cf24 Mattermost doesn't validate the TIFF IFD offset in the image header before allocating memory |
Medium EPSS 0.24% |
>= 11.4.0, < 11.4.5 | 11.4.5 |
| GHSA-w9m8-p4cc-4qj9 Mattermost doesn't properly validate msgpack-encoded WebSocket frames before memory allocation |
High EPSS 0.34% |
>= 10.11.0, < 10.11.15 | 10.11.15 |
| GHSA-w9m8-p4cc-4qj9 Mattermost doesn't properly validate msgpack-encoded WebSocket frames before memory allocation |
High EPSS 0.34% |
>= 11.6.0, < 11.6.1 | 11.6.1 |
| GHSA-w9m8-p4cc-4qj9 Mattermost doesn't properly validate msgpack-encoded WebSocket frames before memory allocation |
High EPSS 0.34% |
>= 11.5.0, < 11.5.4 | 11.5.4 |
| GHSA-w9m8-p4cc-4qj9 Mattermost doesn't properly validate msgpack-encoded WebSocket frames before memory allocation |
High EPSS 0.34% |
>= 11.4.0, < 11.4.5 | 11.4.5 |
| GHSA-w9m8-p4cc-4qj9 Mattermost doesn't properly validate msgpack-encoded WebSocket frames before memory allocation |
High EPSS 0.34% |
>= 10.11.0+incompatible, < 10.11.15+incompatible>= 11.4.0+incompatible, < 11.4.5+incompatible>= 11.5.0+incompatible, < 11.5.4+incompatible>= 11.6.0+incompatible, < 11.6.1+incompatible | 10.11.15+incompatible11.4.5+incompatible11.5.4+incompatible11.6.1+incompatible |
| GHSA-jmvr-r5hm-fxfr Mattermost doesn't enforce request body size limits on plugin HTTP endpoints |
High EPSS 0.25% |
>= 10.11.0, < 10.11.15 | 10.11.15 |
| GHSA-jmvr-r5hm-fxfr Mattermost doesn't enforce request body size limits on plugin HTTP endpoints |
High EPSS 0.25% |
>= 10.11.0+incompatible, < 10.11.15+incompatible>= 11.4.0+incompatible, < 11.4.5+incompatible>= 11.5.0+incompatible, < 11.5.4+incompatible>= 11.6.0+incompatible, < 11.6.1+incompatible | 10.11.15+incompatible11.4.5+incompatible11.5.4+incompatible11.6.1+incompatible |
| GHSA-jmvr-r5hm-fxfr Mattermost doesn't enforce request body size limits on plugin HTTP endpoints |
High EPSS 0.25% |
>= 11.4.0, < 11.4.5 | 11.4.5 |
| GHSA-jmvr-r5hm-fxfr Mattermost doesn't enforce request body size limits on plugin HTTP endpoints |
High EPSS 0.25% |
>= 11.5.0, < 11.5.4 | 11.5.4 |
| GHSA-jmvr-r5hm-fxfr Mattermost doesn't enforce request body size limits on plugin HTTP endpoints |
High EPSS 0.25% |
>= 11.6.0, < 11.6.1 | 11.6.1 |
| GHSA-rmvv-8v8w-rf7x Mattermost doesn't validate user-supplied input in API request handlers |
Medium EPSS 0.25% |
>= 11.5.0, < 11.5.4 | 11.5.4 |
| GHSA-rmvv-8v8w-rf7x Mattermost doesn't validate user-supplied input in API request handlers |
Medium EPSS 0.25% |
>= 11.6.0, < 11.6.1 | 11.6.1 |
| GHSA-rmvv-8v8w-rf7x Mattermost doesn't validate user-supplied input in API request handlers |
Medium EPSS 0.25% |
>= 10.11.0+incompatible, < 10.11.15+incompatible>= 11.4.0+incompatible, < 11.4.5+incompatible>= 11.5.0+incompatible, < 11.5.4+incompatible>= 11.6.0+incompatible, < 11.6.1+incompatible | 10.11.15+incompatible11.4.5+incompatible11.5.4+incompatible11.6.1+incompatible |
| GHSA-rmvv-8v8w-rf7x Mattermost doesn't validate user-supplied input in API request handlers |
Medium EPSS 0.25% |
>= 11.4.0, < 11.4.5 | 11.4.5 |
| GHSA-rmvv-8v8w-rf7x Mattermost doesn't validate user-supplied input in API request handlers |
Medium EPSS 0.25% |
>= 10.11.0, < 10.11.15 | 10.11.15 |
| GHSA-pg7c-462j-grxv Mattermost doesn't archive the channel before removing persistent notifications |
Medium EPSS 0.17% |
>= 11.6.0, < 11.6.1 | 11.6.1 |
| GHSA-pg7c-462j-grxv Mattermost doesn't archive the channel before removing persistent notifications |
Medium EPSS 0.17% |
>= 10.11.0, < 10.11.15 | 10.11.15 |
| GHSA-pg7c-462j-grxv Mattermost doesn't archive the channel before removing persistent notifications |
Medium EPSS 0.17% |
>= 10.11.0+incompatible, < 10.11.15+incompatible>= 11.4.0+incompatible, < 11.4.5+incompatible>= 11.5.0+incompatible, < 11.5.4+incompatible>= 11.6.0+incompatible, < 11.6.1+incompatible | 10.11.15+incompatible11.4.5+incompatible11.5.4+incompatible11.6.1+incompatible |
| GHSA-pg7c-462j-grxv Mattermost doesn't archive the channel before removing persistent notifications |
Medium EPSS 0.17% |
>= 11.4.0, < 11.4.5 | 11.4.5 |
| GHSA-pg7c-462j-grxv Mattermost doesn't archive the channel before removing persistent notifications |
Medium EPSS 0.17% |
>= 11.5.0, < 11.5.4 | 11.5.4 |
| GHSA-ffpr-pfr4-g354 Mattermost doesn't sanitize team member data when returned via API to users without elevated permissions |
Medium EPSS 0.18% |
>= 11.6.0, < 11.6.1 | 11.6.1 |
| GHSA-ffpr-pfr4-g354 Mattermost doesn't sanitize team member data when returned via API to users without elevated permissions |
Medium EPSS 0.18% |
>= 10.11.0+incompatible, < 10.11.15+incompatible>= 11.4.0+incompatible, < 11.4.5+incompatible>= 11.5.0+incompatible, < 11.5.4+incompatible>= 11.6.0+incompatible, < 11.6.1+incompatible | 10.11.15+incompatible11.4.5+incompatible11.5.4+incompatible11.6.1+incompatible |
| GHSA-ffpr-pfr4-g354 Mattermost doesn't sanitize team member data when returned via API to users without elevated permissions |
Medium EPSS 0.18% |
>= 11.5.0, < 11.5.4 | 11.5.4 |
| GHSA-ffpr-pfr4-g354 Mattermost doesn't sanitize team member data when returned via API to users without elevated permissions |
Medium EPSS 0.18% |
>= 11.4.0, < 11.4.5 | 11.4.5 |
| GHSA-ffpr-pfr4-g354 Mattermost doesn't sanitize team member data when returned via API to users without elevated permissions |
Medium EPSS 0.18% |
>= 10.11.0, < 10.11.15 | 10.11.15 |
| GHSA-7pf2-9c95-w332 Mattermost doesn't validate file ownership and access control |
High EPSS 0.15% |
>= 10.11.0+incompatible, < 10.11.15+incompatible>= 11.4.0+incompatible, < 11.4.5+incompatible>= 11.5.0+incompatible, < 11.5.4+incompatible>= 11.6.0+incompatible, < 11.6.1+incompatible | 10.11.15+incompatible11.4.5+incompatible11.5.4+incompatible11.6.1+incompatible |
| GHSA-7pf2-9c95-w332 Mattermost doesn't validate file ownership and access control |
High EPSS 0.15% |
>= 10.11.0, < 10.11.15 | 10.11.15 |
| GHSA-7pf2-9c95-w332 Mattermost doesn't validate file ownership and access control |
High EPSS 0.15% |
>= 11.4.0, < 11.4.5 | 11.4.5 |
| GHSA-7pf2-9c95-w332 Mattermost doesn't validate file ownership and access control |
High EPSS 0.15% |
>= 11.5.0, < 11.5.4 | 11.5.4 |
| GHSA-7pf2-9c95-w332 Mattermost doesn't validate file ownership and access control |
High EPSS 0.15% |
>= 11.6.0, < 11.6.1 | 11.6.1 |
| GHSA-c4r7-j7pp-r8mp Mattermost has a Path Traversal issue |
Critical EPSS 0.33% |
>= 10.11.0+incompatible, < 10.11.15+incompatible>= 11.4.0+incompatible, < 11.4.5+incompatible>= 11.5.0+incompatible, < 11.5.4+incompatible>= 11.6.0+incompatible, < 11.6.1+incompatible | 10.11.15+incompatible11.4.5+incompatible11.5.4+incompatible11.6.1+incompatible |
| GHSA-c4r7-j7pp-r8mp Mattermost has a Path Traversal issue |
Critical EPSS 0.33% |
>= 10.11.0, < 10.11.15 | 10.11.15 |
| GHSA-c4r7-j7pp-r8mp Mattermost has a Path Traversal issue |
Critical EPSS 0.33% |
>= 11.4.0, < 11.4.5 | 11.4.5 |
| GHSA-c4r7-j7pp-r8mp Mattermost has a Path Traversal issue |
Critical EPSS 0.33% |
>= 11.5.0, < 11.5.4 | 11.5.4 |
| GHSA-c4r7-j7pp-r8mp Mattermost has a Path Traversal issue |
Critical EPSS 0.33% |
>= 11.6.0, < 11.6.1 | 11.6.1 |
| GO-2026-5173 Mattermost has an Incorrect Authorization issue |
Medium EPSS 0.15% |
all versions | No fix yet |
| GHSA-82j6-4fq7-fx62 Mattermost doesn't sanitize sensitive configuration fields in the Mattermost Calls plugin |
High EPSS 0.27% |
>= 10.11.0, < 10.11.14 | 10.11.14 |
| GHSA-82j6-4fq7-fx62 Mattermost doesn't sanitize sensitive configuration fields in the Mattermost Calls plugin |
High EPSS 0.27% |
>= 11.5.0, < 11.5.2 | 11.5.2 |
| GHSA-82j6-4fq7-fx62 Mattermost doesn't sanitize sensitive configuration fields in the Mattermost Calls plugin |
High EPSS 0.27% |
>= 10.11.0+incompatible, < 10.11.14+incompatible>= 11.4.0+incompatible, < 11.4.4+incompatible>= 11.5.0+incompatible, < 11.5.2+incompatible | 10.11.14+incompatible11.4.4+incompatible11.5.2+incompatible |
| GHSA-82j6-4fq7-fx62 Mattermost doesn't sanitize sensitive configuration fields in the Mattermost Calls plugin |
High EPSS 0.27% |
>= 11.4.0, < 11.4.4 | 11.4.4 |
| GHSA-9p64-jpc7-m2rp Mattermost doesn't sanitize sensitive configuration fields before including them in support packet generation |
High EPSS 0.30% |
>= 10.11.0+incompatible, < 10.11.14+incompatible>= 11.4.0+incompatible, < 11.4.4+incompatible>= 11.5.0+incompatible, < 11.5.2+incompatible | 10.11.14+incompatible11.4.4+incompatible11.5.2+incompatible |
| GHSA-9p64-jpc7-m2rp Mattermost doesn't sanitize sensitive configuration fields before including them in support packet generation |
High EPSS 0.30% |
< 5.3.2-0.20260326202606-fac92f4a71f3 | 5.3.2-0.20260326202606-fac92f4a71f3 |
| GHSA-wvgv-4fc3-2rcp Mattermost doesn't prevent disclosure of created user password |
Medium EPSS 0.23% |
< 5.3.2-0.20260311102650-3057ae7e83e9 | 5.3.2-0.20260311102650-3057ae7e83e9 |
| GHSA-wvgv-4fc3-2rcp Mattermost doesn't prevent disclosure of created user password |
Medium EPSS 0.23% |
>= 10.11.0+incompatible, < 10.11.14+incompatible>= 11.4.0+incompatible, < 11.4.4+incompatible>= 11.5.0+incompatible, < 11.5.2+incompatible | 10.11.14+incompatible11.4.4+incompatible11.5.2+incompatible |
| GO-2026-5494 Mattermost doesn't check public/private permissions |
Medium EPSS 0.17% |
>= 10.11.0+incompatible, < 10.11.14+incompatible>= 11.4.0+incompatible, < 11.4.4+incompatible>= 11.5.0+incompatible, < 11.5.2+incompatible | 10.11.14+incompatible11.4.4+incompatible11.5.2+incompatible |
| GHSA-xvcx-mgpc-5xh3 Mattermost doesn't validate the X-Requested-With header on the burn-on-read reveal endpoint |
Medium EPSS 0.11% |
>= 11.4.0+incompatible, < 11.4.4+incompatible>= 11.5.0+incompatible, < 11.5.2+incompatible | 11.4.4+incompatible11.5.2+incompatible |
| GHSA-xvcx-mgpc-5xh3 Mattermost doesn't validate the X-Requested-With header on the burn-on-read reveal endpoint |
Medium EPSS 0.11% |
< 5.3.2-0.20260327001745-7a339a6438f5 | 5.3.2-0.20260327001745-7a339a6438f5 |
| GHSA-vqp5-2mrp-qqxg Mattermost doesn't validate the Host header when constructing response URLs for custom slash command |
Medium EPSS 0.14% |
< 5.3.2-0.20260325160634-e738016c5920 | 5.3.2-0.20260325160634-e738016c5920 |
| GHSA-vqp5-2mrp-qqxg Mattermost doesn't validate the Host header when constructing response URLs for custom slash command |
Medium EPSS 0.14% |
>= 10.11.0+incompatible, < 10.11.14+incompatible>= 11.5.0+incompatible, < 11.5.2+incompatible | 10.11.14+incompatible11.5.2+incompatible |
| GHSA-8r89-8w26-cq32 Mattermost doesn't verify channel membership when processing AI-assisted message rewrites |
Medium EPSS 0.21% |
< 5.3.2-0.20260401090745-f4d1abe7e8f5 | 5.3.2-0.20260401090745-f4d1abe7e8f5 |
| GHSA-8r89-8w26-cq32 Mattermost doesn't verify channel membership when processing AI-assisted message rewrites |
Medium EPSS 0.21% |
>= 11.5.0+incompatible, < 11.5.2+incompatible | 11.5.2+incompatible |
| GO-2026-5404 Mattermost doesn't check if {{team_id}} was being changed when updating playbooks |
Medium EPSS 0.14% |
>= 10.11.0+incompatible, < 10.11.14+incompatible>= 11.5.0+incompatible, < 11.5.2+incompatible | 10.11.14+incompatible11.5.2+incompatible |
| GHSA-wvcv-9xpm-7mqc Mattermost doesn't enforce slash command trigger-word uniqueness during command updates |
Medium EPSS 0.15% |
>= 10.11.0+incompatible, < 10.11.14+incompatible>= 11.4.0+incompatible, < 11.4.4+incompatible>= 11.5.0+incompatible, < 11.5.2+incompatible | 10.11.14+incompatible11.4.4+incompatible11.5.2+incompatible |
| GHSA-wvcv-9xpm-7mqc Mattermost doesn't enforce slash command trigger-word uniqueness during command updates |
Medium EPSS 0.15% |
< 5.3.2-0.20260306123948-f5fe8ded6b63 | 5.3.2-0.20260306123948-f5fe8ded6b63 |
| GHSA-cjm8-jxpw-g43m Mattermost doesn't validate 7zip archive structure before processing |
Medium EPSS 0.24% |
< 5.3.2-0.20260325191733-fb11968f8798 | 5.3.2-0.20260325191733-fb11968f8798 |
| GHSA-cjm8-jxpw-g43m Mattermost doesn't validate 7zip archive structure before processing |
Medium EPSS 0.24% |
>= 10.11.0+incompatible, < 10.11.14+incompatible>= 11.4.0+incompatible, < 11.4.4+incompatible>= 11.5.0+incompatible, < 11.5.2+incompatible | 10.11.14+incompatible11.4.4+incompatible11.5.2+incompatible |
| GHSA-jp3f-x449-4q75 Mattermost doesn't enforce client identity binding during the OAuth authorization code redemption flow |
Low EPSS 0.12% |
>= 10.11.0+incompatible, < 10.11.14+incompatible>= 11.5.0+incompatible, < 11.5.2+incompatible | 10.11.14+incompatible11.5.2+incompatible |
| GHSA-jp3f-x449-4q75 Mattermost doesn't enforce client identity binding during the OAuth authorization code redemption flow |
Low EPSS 0.12% |
< 5.3.2-0.20260318173148-e9ae890a013b | 5.3.2-0.20260318173148-e9ae890a013b |
| GHSA-hqpj-f3jh-29vx Mattermost doesn't validate that the RefreshedToken differs from the original invite token during remote cluster invite confirmation |
Medium EPSS 0.14% |
>= 10.11.0+incompatible, < 10.11.14+incompatible>= 11.5.0+incompatible, < 11.5.2+incompatible | 10.11.14+incompatible11.5.2+incompatible |
| GHSA-hqpj-f3jh-29vx Mattermost doesn't validate that the RefreshedToken differs from the original invite token during remote cluster invite confirmation |
Medium EPSS 0.14% |
< 5.3.2-0.20260313190740-742e0be95074 | 5.3.2-0.20260313190740-742e0be95074 |
| GHSA-v549-xx3c-6pc8 Mattermost doesn't check the create_post channel permission during post edit operations |
Medium EPSS 0.15% |
>= 10.11.0+incompatible, < 10.11.14+incompatible>= 11.4.0+incompatible, < 11.4.4+incompatible>= 11.5.0+incompatible, < 11.5.2+incompatible | 10.11.14+incompatible11.4.4+incompatible11.5.2+incompatible |
| GHSA-v549-xx3c-6pc8 Mattermost doesn't check the create_post channel permission during post edit operations |
Medium EPSS 0.15% |
< 5.3.2-0.20260316171743-090408f09f53 | 5.3.2-0.20260316171743-090408f09f53 |
| GHSA-jx93-pf6x-874r Mattermost doesn't escape some variables that could contain malicious content during error page composition |
Medium EPSS 0.14% |
< 5.3.2-0.20260310115442-5a1ea95044dc | 5.3.2-0.20260310115442-5a1ea95044dc |
| GHSA-jx93-pf6x-874r Mattermost doesn't escape some variables that could contain malicious content during error page composition |
Medium EPSS 0.14% |
>= 10.11.0+incompatible, < 10.11.14+incompatible>= 11.5.0+incompatible, < 11.5.2+incompatible | 10.11.14+incompatible11.5.2+incompatible |
| GHSA-m3p3-8frq-q7qh Mattermost doesn't limit the size of the request body on the start meeting API endpoint |
Medium EPSS 0.24% |
>= 11.4.0, < 11.4.4 | 11.4.4 |
| GHSA-m3p3-8frq-q7qh Mattermost doesn't limit the size of the request body on the start meeting API endpoint |
Medium EPSS 0.24% |
>= 11.5.0, < 11.5.2 | 11.5.2 |
| GHSA-m3p3-8frq-q7qh Mattermost doesn't limit the size of the request body on the start meeting API endpoint |
Medium EPSS 0.24% |
>= 10.11.0, < 10.11.14 | 10.11.14 |
| GHSA-m3p3-8frq-q7qh Mattermost doesn't limit the size of the request body on the start meeting API endpoint |
Medium EPSS 0.24% |
>= 10.11.0+incompatible, < 10.11.14+incompatible>= 11.4.0+incompatible, < 11.4.4+incompatible>= 11.5.0+incompatible, < 11.5.2+incompatible | 10.11.14+incompatible11.4.4+incompatible11.5.2+incompatible |
| GHSA-8h9w-w78c-vvr3 Mattermost does not verify remote cluster channel access when processing shared channel membership removals |
Medium EPSS 0.15% |
< 5.3.2-0.20260216150504-8738f8c4b3d4 | 5.3.2-0.20260216150504-8738f8c4b3d4 |
| GHSA-8h9w-w78c-vvr3 Mattermost does not verify remote cluster channel access when processing shared channel membership removals |
Medium EPSS 0.15% |
>= 10.11.0+incompatible, < 10.11.14+incompatible>= 11.4.0+incompatible, < 11.4.4+incompatible>= 11.5.0+incompatible, < 11.5.2+incompatible | 10.11.14+incompatible11.4.4+incompatible11.5.2+incompatible |
| GHSA-j76w-p754-g2w7 Mattermost doesn't validate the response body of proxied images |
Medium EPSS 0.24% |
>= 0.0.0-20250731163400-5b955468ea1e, < 0.0.0-20260414103857-b21ef302025e>= 11.4.0+incompatible, < 11.4.4+incompatible>= 11.5.0+incompatible, < 11.5.2+incompatible | 0.0.0-20260414103857-b21ef302025e11.4.4+incompatible11.5.2+incompatible |
| GHSA-j76w-p754-g2w7 Mattermost doesn't validate the response body of proxied images |
Medium EPSS 0.24% |
>= 11.4.0, < 11.4.4 | 11.4.4 |
| GHSA-j76w-p754-g2w7 Mattermost doesn't validate the response body of proxied images |
Medium EPSS 0.24% |
>= 0.0.0-20250731163400-5b955468ea1e, < 0.0.0-20260414103857-b21ef302025e | 0.0.0-20260414103857-b21ef302025e |
| GHSA-j76w-p754-g2w7 Mattermost doesn't validate the response body of proxied images |
Medium EPSS 0.24% |
>= 11.5.0, < 11.5.2 | 11.5.2 |
| GHSA-hw87-6jcq-9f8q Mattermost doesn't enforce the PostEditTimeLimit on non-message post fields |
Medium EPSS 0.17% |
>= 0.0.0-20250731163400-5b955468ea1e, < 0.0.0-20260414103857-b21ef302025e | 0.0.0-20260414103857-b21ef302025e |
| GHSA-hw87-6jcq-9f8q Mattermost doesn't enforce the PostEditTimeLimit on non-message post fields |
Medium EPSS 0.17% |
>= 11.5.0, < 11.5.2 | 11.5.2 |
| GHSA-hw87-6jcq-9f8q Mattermost doesn't enforce the PostEditTimeLimit on non-message post fields |
Medium EPSS 0.17% |
>= 0.0.0-20250731163400-5b955468ea1e, < 0.0.0-20260414103857-b21ef302025e>= 11.5.0+incompatible, < 11.5.2+incompatible | 0.0.0-20260414103857-b21ef302025e11.5.2+incompatible |
| GHSA-mh4x-rmrx-3hp4 Mattermost has session spoofing due to lack of single-use consumption of guest magic link tokens enforcement |
Medium EPSS 0.15% |
>= 10.11.0-rc1+incompatible, < 10.11.13+incompatible>= 11.3.0-rc1+incompatible, < 11.3.3+incompatible>= 11.4.0-rc1+incompatible, < 11.4.3+incompatible>= 11.5.0-rc1+incompatible, < 11.5.0+incompatible | 10.11.13+incompatible11.3.3+incompatible11.4.3+incompatible11.5.0+incompatible |
| GHSA-mh4x-rmrx-3hp4 Mattermost has session spoofing due to lack of single-use consumption of guest magic link tokens enforcement |
Medium EPSS 0.15% |
>= 10.11.0-rc1, < 10.11.13 | 10.11.13 |
| GHSA-mh4x-rmrx-3hp4 Mattermost has session spoofing due to lack of single-use consumption of guest magic link tokens enforcement |
Medium EPSS 0.15% |
>= 11.5.0-rc1, < 11.5.0 | 11.5.0 |
| GHSA-mh4x-rmrx-3hp4 Mattermost has session spoofing due to lack of single-use consumption of guest magic link tokens enforcement |
Medium EPSS 0.15% |
>= 11.4.0-rc1, < 11.4.3 | 11.4.3 |
| GHSA-mh4x-rmrx-3hp4 Mattermost has session spoofing due to lack of single-use consumption of guest magic link tokens enforcement |
Medium EPSS 0.15% |
>= 11.3.0-rc1, < 11.3.3 | 11.3.3 |
| GO-2026-5495 Mattermost doesn't validate CSRF tokens on an authentication endpoint |
High EPSS 0.13% |
>= 11.3.0-rc1+incompatible, < 11.3.3+incompatible>= 11.4.0-rc1+incompatible, < 11.4.3+incompatible>= 11.5.0-rc1+incompatible, < 11.5.0+incompatible | 11.3.3+incompatible11.4.3+incompatible11.5.0+incompatible |
| GHSA-mxxh-fmjq-j6x4 Mattermost doesn't validate whether users were correctly owned by the correct Connected Workspace |
Low EPSS 0.17% |
all versions | No fix yet |
| GHSA-mxxh-fmjq-j6x4 Mattermost doesn't validate whether users were correctly owned by the correct Connected Workspace |
Low EPSS 0.17% |
>= 8.0.0-20250721062209-4952acea88ce, < 8.0.0-20260316060126-bc1a2b34b1f9 | 8.0.0-20260316060126-bc1a2b34b1f9 |
| GO-2026-5512 Mattermost allows authenticated guest users to enumerate user IDs outside their allowed visibility scope |
Medium EPSS 0.24% |
>= 10.11.0-rc1+incompatible, < 10.11.11+incompatible>= 11.2.0-rc1+incompatible, < 11.2.3+incompatible>= 11.3.0-rc1+incompatible, < 11.3.2+incompatible>= 11.4.0+incompatible, < 11.4.1+incompatible | 10.11.11+incompatible11.2.3+incompatible11.3.2+incompatible11.4.1+incompatible |
| GO-2026-5663 Mattermost doesn't validate decompressed archive entry sizes during file extraction |
Medium EPSS 0.36% |
>= 10.11.0+incompatible, < 10.11.12+incompatible>= 11.2.0+incompatible, < 11.2.4+incompatible>= 11.3.0+incompatible, < 11.3.2+incompatible>= 11.4.0+incompatible, < 11.4.1+incompatible | 10.11.12+incompatible11.2.4+incompatible11.3.2+incompatible11.4.1+incompatible |
| GHSA-4765-v66x-rqx7 Mattermost doesn't set permissions on downloaded bulk export |
Medium EPSS 0.13% |
>= 11.2.0-rc1, < 11.2.4 | 11.2.4 |
| GHSA-4765-v66x-rqx7 Mattermost doesn't set permissions on downloaded bulk export |
Medium EPSS 0.13% |
>= 11.3.0-rc1, < 11.3.2 | 11.3.2 |
| GHSA-4765-v66x-rqx7 Mattermost doesn't set permissions on downloaded bulk export |
Medium EPSS 0.13% |
>= 11.4.0-rc1, < 11.4.1 | 11.4.1 |
| GHSA-4765-v66x-rqx7 Mattermost doesn't set permissions on downloaded bulk export |
Medium EPSS 0.13% |
>= 10.11.0-rc1+incompatible, < 10.11.12+incompatible>= 11.2.0-rc1+incompatible, < 11.2.4+incompatible>= 11.3.0-rc1+incompatible, < 11.3.2+incompatible>= 11.4.0-rc1+incompatible, < 11.4.1+incompatible | 10.11.12+incompatible11.2.4+incompatible11.3.2+incompatible11.4.1+incompatible |
| GHSA-4765-v66x-rqx7 Mattermost doesn't set permissions on downloaded bulk export |
Medium EPSS 0.13% |
>= 8.0.0-20260105080200-d27a2195068d, < 8.0.0-20260217110922-b7d4a1f1f59b | 8.0.0-20260217110922-b7d4a1f1f59b |
| GHSA-4765-v66x-rqx7 Mattermost doesn't set permissions on downloaded bulk export |
Medium EPSS 0.13% |
>= 10.11.0-rc1, < 10.11.12 | 10.11.12 |
| GO-2026-5092 Mattermost allows system administrators to read arbitrary host files via malicious AdvancedLoggingJSON configuration |
Medium EPSS 0.44% |
>= 10.11.0-rc1+incompatible, < 10.11.12+incompatible>= 11.2.0-rc1+incompatible, < 11.2.4+incompatible>= 11.3.0-rc1+incompatible, < 11.3.2+incompatible>= 11.4.0-rc1+incompatible, < 11.4.1+incompatible | 10.11.12+incompatible11.2.4+incompatible11.3.2+incompatible11.4.1+incompatible |
| GO-2026-5067 Mattermost allows attackers to manipulate administrator terminals via crafted messages containing ANSI and OSC escape sequences |
High EPSS 0.28% |
>= 10.11.0-rc1+incompatible, < 10.11.11+incompatible>= 11.2.0-rc1+incompatible, < 11.2.3+incompatible>= 11.3.0-rc1+incompatible, < 11.3.2+incompatible>= 11.4.0-rc1+incompatible, < 11.4.1+incompatible | 10.11.11+incompatible11.2.3+incompatible11.3.2+incompatible11.4.1+incompatible |
| GO-2026-5393 Mattermost has an Incorrect Authorization issue |
Medium EPSS 0.14% |
>= 10.11.0-rc1+incompatible, < 10.11.11+incompatible>= 11.2.0-rc1+incompatible, < 11.2.3+incompatible>= 11.3.0-rc1+incompatible, < 11.3.2+incompatible>= 11.4.0-rc1+incompatible, < 11.4.1+incompatible | 10.11.11+incompatible11.2.3+incompatible11.3.2+incompatible11.4.1+incompatible |
| GO-2026-5629 Mattermost doesn't properly validate CSRF tokens |
Medium EPSS 0.12% |
>= 10.11.0-rc1+incompatible, < 10.11.11+incompatible>= 11.2.0-rc1+incompatible, < 11.2.3+incompatible>= 11.3.0-rc1+incompatible, < 11.3.2+incompatible>= 11.4.0-rc1+incompatible, < 11.4.1+incompatible | 10.11.11+incompatible11.2.3+incompatible11.3.2+incompatible11.4.1+incompatible |
| GHSA-fg35-5rf6-qg3g Mattermost allows attackers to take over arbitrary user accounts via overly permissive substring matching flaw |
Medium EPSS 0.18% |
>= 11.2.0-rc1, < 11.2.4 | 11.2.4 |
| GHSA-fg35-5rf6-qg3g Mattermost allows attackers to take over arbitrary user accounts via overly permissive substring matching flaw |
Medium EPSS 0.18% |
>= 10.11.0-rc1+incompatible, < 10.11.12+incompatible>= 11.2.0-rc1+incompatible, < 11.2.4+incompatible>= 11.3.0-rc1+incompatible, < 11.3.2+incompatible>= 11.4.0-rc1+incompatible, < 11.4.1+incompatible | 10.11.12+incompatible11.2.4+incompatible11.3.2+incompatible11.4.1+incompatible |
| GHSA-fg35-5rf6-qg3g Mattermost allows attackers to take over arbitrary user accounts via overly permissive substring matching flaw |
Medium EPSS 0.18% |
>= 10.11.0-rc1, < 10.11.12 | 10.11.12 |
| GHSA-fg35-5rf6-qg3g Mattermost allows attackers to take over arbitrary user accounts via overly permissive substring matching flaw |
Medium EPSS 0.18% |
>= 11.3.0-rc1, < 11.3.2 | 11.3.2 |
| GHSA-fg35-5rf6-qg3g Mattermost allows attackers to take over arbitrary user accounts via overly permissive substring matching flaw |
Medium EPSS 0.18% |
>= 11.4.0-rc1, < 11.4.1 | 11.4.1 |
| GHSA-247x-7qw8-fp98 Mattermost doesn't rate limit login requests, allowing DoS |
Medium EPSS 0.31% |
>= 11.4.0-rc1, < 11.4.1 | 11.4.1 |
| GHSA-247x-7qw8-fp98 Mattermost doesn't rate limit login requests, allowing DoS |
Medium EPSS 0.31% |
>= 11.3.0-rc1, < 11.3.2 | 11.3.2 |
| GHSA-247x-7qw8-fp98 Mattermost doesn't rate limit login requests, allowing DoS |
Medium EPSS 0.31% |
>= 10.11.0-rc1+incompatible, < 10.11.12+incompatible>= 11.2.0-rc1+incompatible, < 11.2.4+incompatible>= 11.3.0-rc1+incompatible, < 11.3.2+incompatible>= 11.4.0-rc1+incompatible, < 11.4.1+incompatible | 10.11.12+incompatible11.2.4+incompatible11.3.2+incompatible11.4.1+incompatible |
| GHSA-247x-7qw8-fp98 Mattermost doesn't rate limit login requests, allowing DoS |
Medium EPSS 0.31% |
>= 11.2.0-rc1, < 11.2.4 | 11.2.4 |
| GHSA-247x-7qw8-fp98 Mattermost doesn't rate limit login requests, allowing DoS |
Medium EPSS 0.31% |
>= 10.11.0-rc1, < 10.11.12 | 10.11.12 |
| GO-2026-5245 Mattermost: Authenticated DoS through failure to prevent rendering of external SVGs on link embeds |
High EPSS 0.36% |
>= 10.11.0-rc1+incompatible, < 10.11.2+incompatible>= 11.2.0-rc1+incompatible, < 11.2.4+incompatible>= 11.3.0-rc1+incompatible, < 11.3.2+incompatible>= 11.4.0-rc1+incompatible, < 11.4.1+incompatible | 10.11.2+incompatible11.2.4+incompatible11.3.2+incompatible11.4.1+incompatible |
| GHSA-gqv7-j2j8-qmwq Mattermost fails to canonicalize IPv4-mapped IPv6 addresses before reserved IP validation |
Medium EPSS 0.17% |
>= 10.11.0-rc1, < 10.11.11 | 10.11.11 |
| GHSA-gqv7-j2j8-qmwq Mattermost fails to canonicalize IPv4-mapped IPv6 addresses before reserved IP validation |
Medium EPSS 0.17% |
>= 11.3.0-rc1, < 11.3.1 | 11.3.1 |
| GHSA-gqv7-j2j8-qmwq Mattermost fails to canonicalize IPv4-mapped IPv6 addresses before reserved IP validation |
Medium EPSS 0.17% |
>= 11.2.0-rc1, < 11.2.3 | 11.2.3 |
| GHSA-gqv7-j2j8-qmwq Mattermost fails to canonicalize IPv4-mapped IPv6 addresses before reserved IP validation |
Medium EPSS 0.17% |
>= 10.11.0-rc1+incompatible, < 10.11.11+incompatible>= 11.2.0-rc1+incompatible, < 11.2.3+incompatible>= 11.3.0-rc1+incompatible, < 11.3.1+incompatible | 10.11.11+incompatible11.2.3+incompatible11.3.1+incompatible |
| GHSA-gqv7-j2j8-qmwq Mattermost fails to canonicalize IPv4-mapped IPv6 addresses before reserved IP validation |
Medium EPSS 0.17% |
< 5.3.2-0.20260129133647-5d787969c2d5 | 5.3.2-0.20260129133647-5d787969c2d5 |
| GHSA-cwfj-642j-gfh4 Mattermost fails to properly enforce read permissions in search API endpoints |
Medium EPSS 0.17% |
>= 10.11.0-rc1+incompatible, < 10.11.11+incompatible>= 11.2.0-rc1+incompatible, < 11.2.3+incompatible>= 11.3.0-rc1+incompatible, < 11.3.1+incompatible | 10.11.11+incompatible11.2.3+incompatible11.3.1+incompatible |
| GHSA-cwfj-642j-gfh4 Mattermost fails to properly enforce read permissions in search API endpoints |
Medium EPSS 0.17% |
< 5.3.2-0.20260107142155-0481bd1fb045 | 5.3.2-0.20260107142155-0481bd1fb045 |
| GHSA-cwfj-642j-gfh4 Mattermost fails to properly enforce read permissions in search API endpoints |
Medium EPSS 0.17% |
>= 11.3.0-rc1, < 11.3.1 | 11.3.1 |
| GHSA-cwfj-642j-gfh4 Mattermost fails to properly enforce read permissions in search API endpoints |
Medium EPSS 0.17% |
>= 11.2.0-rc1, < 11.2.3 | 11.2.3 |
| GHSA-cwfj-642j-gfh4 Mattermost fails to properly enforce read permissions in search API endpoints |
Medium EPSS 0.17% |
>= 10.11.0-rc1, < 10.11.11 | 10.11.11 |
| GHSA-rv67-7w2g-7976 Mattermost fails to validate user's authentication method when processing account auth type switch |
Low EPSS 0.15% |
>= 10.11.0-rc1+incompatible, < 10.11.11+incompatible>= 11.2.0-rc1+incompatible, < 11.2.3+incompatible>= 11.3.0-rc1+incompatible, < 11.3.1+incompatible | 10.11.11+incompatible11.2.3+incompatible11.3.1+incompatible |
| GHSA-rv67-7w2g-7976 Mattermost fails to validate user's authentication method when processing account auth type switch |
Low EPSS 0.15% |
< 5.3.2-0.20260127144908-ced9a56e3988 | 5.3.2-0.20260127144908-ced9a56e3988 |
| GHSA-rv67-7w2g-7976 Mattermost fails to validate user's authentication method when processing account auth type switch |
Low EPSS 0.15% |
>= 10.11.0-rc1, < 10.11.11 | 10.11.11 |
| GHSA-rv67-7w2g-7976 Mattermost fails to validate user's authentication method when processing account auth type switch |
Low EPSS 0.15% |
>= 11.2.0-rc1, < 11.2.3 | 11.2.3 |
| GHSA-rv67-7w2g-7976 Mattermost fails to validate user's authentication method when processing account auth type switch |
Low EPSS 0.15% |
>= 11.3.0-rc1, < 11.3.1 | 11.3.1 |
| GHSA-5mr9-crcg-8wh2 Mattermost fails to use consistent error responses when handling the /mute command |
Medium EPSS 0.19% |
< 5.3.2-0.20260130144323-5bb5261c72fa | 5.3.2-0.20260130144323-5bb5261c72fa |
| GHSA-5mr9-crcg-8wh2 Mattermost fails to use consistent error responses when handling the /mute command |
Medium EPSS 0.19% |
>= 10.11.0-rc1+incompatible, < 10.11.11+incompatible>= 11.2.0-rc1+incompatible, < 11.2.3+incompatible>= 11.3.0-rc1+incompatible, < 11.3.1+incompatible | 10.11.11+incompatible11.2.3+incompatible11.3.1+incompatible |
| GHSA-5mr9-crcg-8wh2 Mattermost fails to use consistent error responses when handling the /mute command |
Medium EPSS 0.19% |
>= 11.3.0-rc1, < 11.3.1 | 11.3.1 |
| GHSA-5mr9-crcg-8wh2 Mattermost fails to use consistent error responses when handling the /mute command |
Medium EPSS 0.19% |
>= 11.2.0-rc1, < 11.2.3 | 11.2.3 |
| GHSA-5mr9-crcg-8wh2 Mattermost fails to use consistent error responses when handling the /mute command |
Medium EPSS 0.19% |
>= 10.11.0-rc1, < 10.11.11 | 10.11.11 |
| GHSA-xpvf-6qcc-9jqc Mattermost fails to validate team-specific upload_file permissions |
Medium EPSS 0.23% |
>= 10.11.0-rc1, < 10.11.11 | 10.11.11 |
| GHSA-xpvf-6qcc-9jqc Mattermost fails to validate team-specific upload_file permissions |
Medium EPSS 0.23% |
>= 10.11.0-rc1+incompatible, < 10.11.11+incompatible>= 11.2.0-rc1+incompatible, < 11.2.3+incompatible>= 11.3.0-rc1+incompatible, < 11.3.1+incompatible | 10.11.11+incompatible11.2.3+incompatible11.3.1+incompatible |
| GHSA-xpvf-6qcc-9jqc Mattermost fails to validate team-specific upload_file permissions |
Medium EPSS 0.23% |
>= 11.3.0-rc1, < 11.3.1 | 11.3.1 |
| GHSA-xpvf-6qcc-9jqc Mattermost fails to validate team-specific upload_file permissions |
Medium EPSS 0.23% |
>= 11.2.0-rc1, < 11.2.3 | 11.2.3 |
| GHSA-xpvf-6qcc-9jqc Mattermost fails to validate team-specific upload_file permissions |
Medium EPSS 0.23% |
< 5.3.2-0.20260107144005-c7f6efdfb035 | 5.3.2-0.20260107144005-c7f6efdfb035 |
| GHSA-3rhr-jr63-hwq5 Mattermost fails to preserve the redacted state of burn-on-read posts during deletion |
Medium EPSS 0.23% |
< 5.3.2-0.20260127062706-c6b205f0d770 | 5.3.2-0.20260127062706-c6b205f0d770 |
| GHSA-3rhr-jr63-hwq5 Mattermost fails to preserve the redacted state of burn-on-read posts during deletion |
Medium EPSS 0.23% |
>= 10.11.0-rc1+incompatible, < 10.11.11+incompatible>= 11.2.0-rc1+incompatible, < 11.2.3+incompatible>= 11.3.0-rc1+incompatible, < 11.3.1+incompatible | 10.11.11+incompatible11.2.3+incompatible11.3.1+incompatible |
| GHSA-3rhr-jr63-hwq5 Mattermost fails to preserve the redacted state of burn-on-read posts during deletion |
Medium EPSS 0.23% |
>= 11.3.0-rc1, < 11.3.1 | 11.3.1 |
| GHSA-3rhr-jr63-hwq5 Mattermost fails to preserve the redacted state of burn-on-read posts during deletion |
Medium EPSS 0.23% |
>= 11.2.0-rc1, < 11.2.3 | 11.2.3 |
| GHSA-3rhr-jr63-hwq5 Mattermost fails to preserve the redacted state of burn-on-read posts during deletion |
Medium EPSS 0.23% |
>= 10.11.0-rc1, < 10.11.11 | 10.11.11 |
| GHSA-fx49-m253-27jj Mattermost fails to filter invite IDs based on user permissions |
Medium EPSS 0.17% |
>= 10.11.0-rc1+incompatible, < 10.11.11+incompatible>= 11.2.0-rc1+incompatible, < 11.2.3+incompatible>= 11.3.0-rc1+incompatible, < 11.3.1+incompatible | 10.11.11+incompatible11.2.3+incompatible11.3.1+incompatible |
| GHSA-fx49-m253-27jj Mattermost fails to filter invite IDs based on user permissions |
Medium EPSS 0.17% |
< 5.3.2-0.20260105134819-cc427af41b2a | 5.3.2-0.20260105134819-cc427af41b2a |
| GHSA-fx49-m253-27jj Mattermost fails to filter invite IDs based on user permissions |
Medium EPSS 0.17% |
>= 10.11.0-rc1, < 10.11.11 | 10.11.11 |
| GHSA-fx49-m253-27jj Mattermost fails to filter invite IDs based on user permissions |
Medium EPSS 0.17% |
>= 11.2.0-rc1, < 11.2.3 | 11.2.3 |
| GHSA-fx49-m253-27jj Mattermost fails to filter invite IDs based on user permissions |
Medium EPSS 0.17% |
>= 11.3.0-rc1, < 11.3.1 | 11.3.1 |
| GHSA-679f-wmrg-qf57 Mattermost allows a removed team member to enumerate all public channels within a private team |
Medium EPSS 0.17% |
< 5.3.2-0.20260113182106-a18b80ba4c32 | 5.3.2-0.20260113182106-a18b80ba4c32 |
| GHSA-679f-wmrg-qf57 Mattermost allows a removed team member to enumerate all public channels within a private team |
Medium EPSS 0.17% |
>= 10.11.0-rc1+incompatible, < 10.11.11+incompatible>= 11.2.0-rc1+incompatible, < 11.2.3+incompatible>= 11.3.0-rc1+incompatible, < 11.3.1+incompatible | 10.11.11+incompatible11.2.3+incompatible11.3.1+incompatible |
| GHSA-679f-wmrg-qf57 Mattermost allows a removed team member to enumerate all public channels within a private team |
Medium EPSS 0.17% |
>= 11.3.0-rc1, < 11.3.1 | 11.3.1 |
| GHSA-679f-wmrg-qf57 Mattermost allows a removed team member to enumerate all public channels within a private team |
Medium EPSS 0.17% |
>= 11.2.0-rc1, < 11.2.3 | 11.2.3 |
| GHSA-679f-wmrg-qf57 Mattermost allows a removed team member to enumerate all public channels within a private team |
Medium EPSS 0.17% |
>= 10.11.0-rc1, < 10.11.11 | 10.11.11 |
| GHSA-ph22-fw5m-w2q9 Mattermost allows attackers to spoof permalink embeds |
Medium EPSS 0.11% |
>= 10.11.0-rc1, < 10.11.11 | 10.11.11 |
| GHSA-ph22-fw5m-w2q9 Mattermost allows attackers to spoof permalink embeds |
Medium EPSS 0.11% |
< 5.3.2-0.20260123211116-9efe617be8b8 | 5.3.2-0.20260123211116-9efe617be8b8 |
| GHSA-ph22-fw5m-w2q9 Mattermost allows attackers to spoof permalink embeds |
Medium EPSS 0.11% |
>= 10.11.0-rc1+incompatible, < 10.11.11+incompatible>= 11.2.0-rc1+incompatible, < 11.2.3+incompatible>= 11.3.0-rc1+incompatible, < 11.3.1+incompatible | 10.11.11+incompatible11.2.3+incompatible11.3.1+incompatible |
| GHSA-ph22-fw5m-w2q9 Mattermost allows attackers to spoof permalink embeds |
Medium EPSS 0.11% |
>= 11.3.0-rc1, < 11.3.1 | 11.3.1 |
| GHSA-ph22-fw5m-w2q9 Mattermost allows attackers to spoof permalink embeds |
Medium EPSS 0.11% |
>= 11.2.0-rc1, < 11.2.3 | 11.2.3 |
| GHSA-34g8-9fpp-46ch Mattermost fails to limit the size of responses from integration action endpoints |
Medium EPSS 0.17% |
>= 11.3.0-rc1, < 11.3.1 | 11.3.1 |
| GHSA-34g8-9fpp-46ch Mattermost fails to limit the size of responses from integration action endpoints |
Medium EPSS 0.17% |
>= 11.2.0-rc1, < 11.2.3 | 11.2.3 |
| GHSA-34g8-9fpp-46ch Mattermost fails to limit the size of responses from integration action endpoints |
Medium EPSS 0.17% |
>= 10.11.0-rc1, < 10.11.11 | 10.11.11 |
| GHSA-34g8-9fpp-46ch Mattermost fails to limit the size of responses from integration action endpoints |
Medium EPSS 0.17% |
< 5.3.2-0.20260127165411-fe3052073dc6 | 5.3.2-0.20260127165411-fe3052073dc6 |
| GHSA-34g8-9fpp-46ch Mattermost fails to limit the size of responses from integration action endpoints |
Medium EPSS 0.17% |
>= 10.11.0-rc1+incompatible, < 10.11.11+incompatible>= 11.2.0-rc1+incompatible, < 11.2.3+incompatible>= 11.3.0-rc1+incompatible, < 11.3.1+incompatible | 10.11.11+incompatible11.2.3+incompatible11.3.1+incompatible |
| GHSA-44mv-jq72-gj49 Mattermost fails to bound memory allocation when processing PSD image files |
Medium EPSS 0.22% |
>= 10.11.0-rc1, < 10.11.11 | 10.11.11 |
| GHSA-44mv-jq72-gj49 Mattermost fails to bound memory allocation when processing PSD image files |
Medium EPSS 0.22% |
>= 10.11.0-rc1+incompatible, < 10.11.11+incompatible>= 11.2.0-rc1+incompatible, < 11.2.3+incompatible>= 11.3.0-rc1+incompatible, < 11.3.1+incompatible | 10.11.11+incompatible11.2.3+incompatible11.3.1+incompatible |
| GHSA-44mv-jq72-gj49 Mattermost fails to bound memory allocation when processing PSD image files |
Medium EPSS 0.22% |
>= 11.3.0-rc1, < 11.3.1 | 11.3.1 |
| GHSA-44mv-jq72-gj49 Mattermost fails to bound memory allocation when processing PSD image files |
Medium EPSS 0.22% |
>= 11.2.0-rc1, < 11.2.3 | 11.2.3 |
| GHSA-44mv-jq72-gj49 Mattermost fails to bound memory allocation when processing PSD image files |
Medium EPSS 0.22% |
< 5.3.2-0.20260115183946-38b413a27604 | 5.3.2-0.20260115183946-38b413a27604 |
| GHSA-2v3w-6g35-5f9v Mattermost fails to properly validate User-Agent header tokens |
Medium EPSS 0.30% |
>= 11.3.0-rc1, < 11.3.1 | 11.3.1 |
| GHSA-2v3w-6g35-5f9v Mattermost fails to properly validate User-Agent header tokens |
Medium EPSS 0.30% |
>= 11.2.0-rc1, < 11.2.3 | 11.2.3 |
| GHSA-2v3w-6g35-5f9v Mattermost fails to properly validate User-Agent header tokens |
Medium EPSS 0.30% |
>= 10.11.0-rc1, < 10.11.11 | 10.11.11 |
| GHSA-2v3w-6g35-5f9v Mattermost fails to properly validate User-Agent header tokens |
Medium EPSS 0.30% |
< 5.3.2-0.20260129181235-1346cf529aef | 5.3.2-0.20260129181235-1346cf529aef |
| GHSA-2v3w-6g35-5f9v Mattermost fails to properly validate User-Agent header tokens |
Medium EPSS 0.30% |
>= 10.11.0-rc1+incompatible, < 10.11.11+incompatible>= 11.2.0-rc1+incompatible, < 11.2.3+incompatible>= 11.3.0-rc1+incompatible, < 11.3.1+incompatible | 10.11.11+incompatible11.2.3+incompatible11.3.1+incompatible |
| GHSA-xv2p-wchj-qjhp Mattermost fails to bound memory allocation when processing DOC files |
Medium EPSS 0.28% |
>= 10.11.0-rc1+incompatible, < 10.11.11+incompatible>= 11.2.0-rc1+incompatible, < 11.2.3+incompatible>= 11.3.0-rc1+incompatible, < 11.3.1+incompatible | 10.11.11+incompatible11.2.3+incompatible11.3.1+incompatible |
| GHSA-xv2p-wchj-qjhp Mattermost fails to bound memory allocation when processing DOC files |
Medium EPSS 0.28% |
< 5.3.2-0.20260123215601-86797c508c44 | 5.3.2-0.20260123215601-86797c508c44 |
| GHSA-xv2p-wchj-qjhp Mattermost fails to bound memory allocation when processing DOC files |
Medium EPSS 0.28% |
>= 10.11.0-rc1, < 10.11.11 | 10.11.11 |
| GHSA-xv2p-wchj-qjhp Mattermost fails to bound memory allocation when processing DOC files |
Medium EPSS 0.28% |
>= 11.2.0-rc1, < 11.2.3 | 11.2.3 |
| GHSA-xv2p-wchj-qjhp Mattermost fails to bound memory allocation when processing DOC files |
Medium EPSS 0.28% |
>= 11.3.0-rc1, < 11.3.1 | 11.3.1 |
| GHSA-m5rv-56xx-hfc6 Mattermost fails to properly handle very long passwords |
High EPSS 0.28% |
>= 10.11.0-rc1, < 10.11.11 | 10.11.11 |
| GHSA-m5rv-56xx-hfc6 Mattermost fails to properly handle very long passwords |
High EPSS 0.28% |
< 5.3.2-0.20260129164748-7201f42d955f | 5.3.2-0.20260129164748-7201f42d955f |
| GHSA-m5rv-56xx-hfc6 Mattermost fails to properly handle very long passwords |
High EPSS 0.28% |
>= 11.2.0-rc1, < 11.2.3 | 11.2.3 |
| GHSA-m5rv-56xx-hfc6 Mattermost fails to properly handle very long passwords |
High EPSS 0.28% |
>= 11.3.0-rc1, < 11.3.1 | 11.3.1 |
| GHSA-m5rv-56xx-hfc6 Mattermost fails to properly handle very long passwords |
High EPSS 0.28% |
>= 10.11.0-rc1+incompatible, < 10.11.11+incompatible>= 11.2.0-rc1+incompatible, < 11.2.3+incompatible>= 11.3.0-rc1+incompatible, < 11.3.1+incompatible | 10.11.11+incompatible11.2.3+incompatible11.3.1+incompatible |
| GHSA-cgjg-p2m2-qm4p Mattermost fails to enforce invite permissions when updating team settings |
Low EPSS 0.18% |
>= 10.11.0+incompatible | No fix yet |
| GHSA-cgjg-p2m2-qm4p Mattermost fails to enforce invite permissions when updating team settings |
Low EPSS 0.18% |
>= 11.2.0+incompatible | No fix yet |
| GHSA-cgjg-p2m2-qm4p Mattermost fails to enforce invite permissions when updating team settings |
Low EPSS 0.18% |
>= 11.1.0+incompatible | No fix yet |
| GHSA-cgjg-p2m2-qm4p Mattermost fails to enforce invite permissions when updating team settings |
Low EPSS 0.18% |
all versions | No fix yet |
| GHSA-cgjg-p2m2-qm4p Mattermost fails to enforce invite permissions when updating team settings |
Low EPSS 0.18% |
< 5.3.2-0.20251215190648-6404ab29acc0 | 5.3.2-0.20251215190648-6404ab29acc0 |
| GHSA-cgjg-p2m2-qm4p Mattermost fails to enforce invite permissions when updating team settings |
Low EPSS 0.18% |
>= 11.2.0 | No fix yet |
| GHSA-cgjg-p2m2-qm4p Mattermost fails to enforce invite permissions when updating team settings |
Low EPSS 0.18% |
>= 10.11.0 | No fix yet |
| GHSA-cgjg-p2m2-qm4p Mattermost fails to enforce invite permissions when updating team settings |
Low EPSS 0.18% |
>= 11.1.0 | No fix yet |
| GHSA-57cc-2pf4-mhmx Mattermost fails to properly validate team membership when processing channel mentions |
Medium EPSS 0.19% |
>= 11.2.0+incompatible | No fix yet |
| GHSA-57cc-2pf4-mhmx Mattermost fails to properly validate team membership when processing channel mentions |
Medium EPSS 0.19% |
>= 11.2.0 | No fix yet |
| GHSA-57cc-2pf4-mhmx Mattermost fails to properly validate team membership when processing channel mentions |
Medium EPSS 0.19% |
< 5.3.2-0.20251209134645-761e56bb11cc | 5.3.2-0.20251209134645-761e56bb11cc |
| GHSA-57cc-2pf4-mhmx Mattermost fails to properly validate team membership when processing channel mentions |
Medium EPSS 0.19% |
all versions | No fix yet |
| GHSA-57cc-2pf4-mhmx Mattermost fails to properly validate team membership when processing channel mentions |
Medium EPSS 0.19% |
>= 10.11.0+incompatible | No fix yet |
| GHSA-57cc-2pf4-mhmx Mattermost fails to properly validate team membership when processing channel mentions |
Medium EPSS 0.19% |
>= 11.1.0+incompatible | No fix yet |
| GHSA-57cc-2pf4-mhmx Mattermost fails to properly validate team membership when processing channel mentions |
Medium EPSS 0.19% |
>= 10.11.0 | No fix yet |
| GHSA-57cc-2pf4-mhmx Mattermost fails to properly validate team membership when processing channel mentions |
Medium EPSS 0.19% |
>= 11.1.0 | No fix yet |
| GHSA-pp9j-pf5c-659x Mattermost fails to sanitize sensitive data in WebSocket messages |
Medium EPSS 0.24% |
>= 11.2.0+incompatible | No fix yet |
| GHSA-pp9j-pf5c-659x Mattermost fails to sanitize sensitive data in WebSocket messages |
Medium EPSS 0.24% |
>= 10.11.0 | No fix yet |
| GHSA-pp9j-pf5c-659x Mattermost fails to sanitize sensitive data in WebSocket messages |
Medium EPSS 0.24% |
>= 11.2.0 | No fix yet |
| GHSA-pp9j-pf5c-659x Mattermost fails to sanitize sensitive data in WebSocket messages |
Medium EPSS 0.24% |
< 5.3.2-0.20251210191531-cd17b61de41b | 5.3.2-0.20251210191531-cd17b61de41b |
| GHSA-pp9j-pf5c-659x Mattermost fails to sanitize sensitive data in WebSocket messages |
Medium EPSS 0.24% |
all versions | No fix yet |
| GHSA-pp9j-pf5c-659x Mattermost fails to sanitize sensitive data in WebSocket messages |
Medium EPSS 0.24% |
>= 10.11.0+incompatible | No fix yet |
| GHSA-pp9j-pf5c-659x Mattermost fails to sanitize sensitive data in WebSocket messages |
Medium EPSS 0.24% |
>= 11.1.0+incompatible | No fix yet |
| GHSA-pp9j-pf5c-659x Mattermost fails to sanitize sensitive data in WebSocket messages |
Medium EPSS 0.24% |
>= 11.1.0 | No fix yet |
| GHSA-3c9r-7f29-qp32 Mattermost fails to properly validate login method restrictions |
Medium EPSS 0.20% |
>= 10.11.0 | No fix yet |
| GHSA-3c9r-7f29-qp32 Mattermost fails to properly validate login method restrictions |
Medium EPSS 0.20% |
>= 11.1.0+incompatible | No fix yet |
| GHSA-3c9r-7f29-qp32 Mattermost fails to properly validate login method restrictions |
Medium EPSS 0.20% |
>= 11.2.0 | No fix yet |
| GHSA-3c9r-7f29-qp32 Mattermost fails to properly validate login method restrictions |
Medium EPSS 0.20% |
< 5.3.2-0.20251212052346-61651b0df7ea | 5.3.2-0.20251212052346-61651b0df7ea |
| GHSA-3c9r-7f29-qp32 Mattermost fails to properly validate login method restrictions |
Medium EPSS 0.20% |
all versions | No fix yet |
| GHSA-3c9r-7f29-qp32 Mattermost fails to properly validate login method restrictions |
Medium EPSS 0.20% |
>= 10.11.0+incompatible | No fix yet |
| GHSA-3c9r-7f29-qp32 Mattermost fails to properly validate login method restrictions |
Medium EPSS 0.20% |
>= 11.2.0+incompatible | No fix yet |
| GHSA-3c9r-7f29-qp32 Mattermost fails to properly validate login method restrictions |
Medium EPSS 0.20% |
>= 11.1.0 | No fix yet |
| GHSA-9pj7-jh2r-87g8 Mattermost doesn't validate user permissions when creating Jira issues from Mattermost posts |
Medium EPSS 0.27% |
>= 11.1.0, < 11.1.3 | 11.1.3 |
| GHSA-9pj7-jh2r-87g8 Mattermost doesn't validate user permissions when creating Jira issues from Mattermost posts |
Medium EPSS 0.27% |
>= 11.2.0, < 11.2.2 | 11.2.2 |
| GHSA-9pj7-jh2r-87g8 Mattermost doesn't validate user permissions when creating Jira issues from Mattermost posts |
Medium EPSS 0.27% |
>= 10.11.0+incompatible, < 10.11.10+incompatible>= 11.1.0+incompatible, < 11.1.3+incompatible>= 11.2.0+incompatible, < 11.2.2+incompatible | 10.11.10+incompatible11.1.3+incompatible11.2.2+incompatible |
| GHSA-9pj7-jh2r-87g8 Mattermost doesn't validate user permissions when creating Jira issues from Mattermost posts |
Medium EPSS 0.27% |
>= 10.11.0, < 10.11.10 | 10.11.10 |
| GHSA-2xf7-hmf6-p64j Mattermost doesn't properly validate channel membership at the time of data retrieval |
Low EPSS 0.22% |
>= 10.11.0, < 10.11.10 | 10.11.10 |
| GHSA-2xf7-hmf6-p64j Mattermost doesn't properly validate channel membership at the time of data retrieval |
Low EPSS 0.22% |
>= 10.11.0+incompatible, < 10.11.10+incompatible | 10.11.10+incompatible |
| GHSA-mx8m-v8qm-xwr8 Mattermost is vulnerable to DoS due to infinite re-renders on API errors |
Medium EPSS 0.31% |
>= 10.11.0+incompatible, < 10.11.9+incompatible>= 11.0.1+incompatible, < 11.0.7+incompatible>= 11.1.0+incompatible, < 11.1.2+incompatible | 10.11.9+incompatible11.0.7+incompatible11.1.2+incompatible |
| GHSA-mx8m-v8qm-xwr8 Mattermost is vulnerable to DoS due to infinite re-renders on API errors |
Medium EPSS 0.31% |
>= 10.11.0, < 10.11.9 | 10.11.9 |
| GHSA-mx8m-v8qm-xwr8 Mattermost is vulnerable to DoS due to infinite re-renders on API errors |
Medium EPSS 0.31% |
>= 11.1.0, < 11.1.2 | 11.1.2 |
| GHSA-mx8m-v8qm-xwr8 Mattermost is vulnerable to DoS due to infinite re-renders on API errors |
Medium EPSS 0.31% |
>= 11.0.0, < 11.0.7 | 11.0.7 |
| GHSA-9r42-rhw3-2222 Mattermost is vulnerable to CPU exhaustion via crafted HTTP request |
Medium EPSS 0.35% |
>= 10.11.0, < 10.11.9 | 10.11.9 |
| GHSA-9r42-rhw3-2222 Mattermost is vulnerable to CPU exhaustion via crafted HTTP request |
Medium EPSS 0.35% |
>= 10.11.0+incompatible, < 10.11.9+incompatible>= 11.0.1+incompatible, < 11.2.0+incompatible | 10.11.9+incompatible11.2.0+incompatible |
| GHSA-9r42-rhw3-2222 Mattermost is vulnerable to CPU exhaustion via crafted HTTP request |
Medium EPSS 0.35% |
>= 11.0.0, < 11.2.0 | 11.2.0 |
| GHSA-vww6-79rv-3j4x Mattermost doesn't verify that post actions invoking `/share-issue-publicly` were created by the Jira plugin |
Medium EPSS 0.18% |
>= 10.11.0, < 10.11.8 | 10.11.8 |
| GHSA-vww6-79rv-3j4x Mattermost doesn't verify that post actions invoking `/share-issue-publicly` were created by the Jira plugin |
Medium EPSS 0.18% |
>= 10.12.0, < 10.12.4 | 10.12.4 |
| GHSA-vww6-79rv-3j4x Mattermost doesn't verify that post actions invoking `/share-issue-publicly` were created by the Jira plugin |
Medium EPSS 0.18% |
>= 11.0.0, < 11.0.6 | 11.0.6 |
| GHSA-vww6-79rv-3j4x Mattermost doesn't verify that post actions invoking `/share-issue-publicly` were created by the Jira plugin |
Medium EPSS 0.18% |
>= 11.1.0, < 11.1.1 | 11.1.1 |
| GHSA-vww6-79rv-3j4x Mattermost doesn't verify that post actions invoking `/share-issue-publicly` were created by the Jira plugin |
Medium EPSS 0.18% |
>= 10.11.0+incompatible, < 10.11.8+incompatible>= 10.12.0+incompatible, < 10.12.4+incompatible>= 11.0.1+incompatible, < 11.0.6+incompatible>= 11.1.0+incompatible, < 11.1.1+incompatible | 10.11.8+incompatible10.12.4+incompatible11.0.6+incompatible11.1.1+incompatible |
| GHSA-fmqf-pmcm-8cx9 Mattermost doesn't validate user channel membership when attaching Mattermost posts as comments to Jira issues |
Medium EPSS 0.19% |
>= 11.0.0, < 11.0.6 | 11.0.6 |
| GHSA-fmqf-pmcm-8cx9 Mattermost doesn't validate user channel membership when attaching Mattermost posts as comments to Jira issues |
Medium EPSS 0.19% |
>= 10.11.0+incompatible, < 10.11.8+incompatible>= 10.12.0+incompatible, < 10.12.4+incompatible>= 11.0.1+incompatible, < 11.0.6+incompatible>= 11.1.0+incompatible, < 11.1.1+incompatible | 10.11.8+incompatible10.12.4+incompatible11.0.6+incompatible11.1.1+incompatible |
| GHSA-fmqf-pmcm-8cx9 Mattermost doesn't validate user channel membership when attaching Mattermost posts as comments to Jira issues |
Medium EPSS 0.19% |
>= 11.1.0, < 11.1.1 | 11.1.1 |
| GHSA-fmqf-pmcm-8cx9 Mattermost doesn't validate user channel membership when attaching Mattermost posts as comments to Jira issues |
Medium EPSS 0.19% |
>= 10.12.0, < 10.12.4 | 10.12.4 |
| GHSA-fmqf-pmcm-8cx9 Mattermost doesn't validate user channel membership when attaching Mattermost posts as comments to Jira issues |
Medium EPSS 0.19% |
>= 10.11.0, < 10.11.8 | 10.11.8 |
| GO-2026-4275 Mattermost with Jira plugin enabled has Incorrect Implementation of Authentication Algorithm |
High EPSS 0.26% |
all versions | No fix yet |
| GHSA-x3r8-2hmh-89f5 Mattermost has an Invite Token Replay Vulnerability via Channel Membership Manipulation |
Low EPSS 0.20% |
< 11.0.4 | 11.0.4 |
| GHSA-x3r8-2hmh-89f5 Mattermost has an Invite Token Replay Vulnerability via Channel Membership Manipulation |
Low EPSS 0.20% |
< 11.0.4+incompatible | 11.0.4+incompatible |
| GO-2025-4248 Mattermost has missing redirect URL validation |
Medium EPSS 0.15% |
all versions | No fix yet |
| GO-2025-4247 Mattermost GitHub Plugin Bot Identity Validation Bypass Allows Arbitrary GitHub Reaction Injection |
Low EPSS 0.18% |
>= 10.11.0-rc1+incompatible | No fix yet |
| GO-2025-4183 CVE-2017-18870 in github.com/mattermost/mattermost-server |
Not rated yet EPSS 0.62% |
all versions | No fix yet |
| GO-2025-4178 Mattermost fails to validate user permissions in Boards |
Medium EPSS 0.22% |
all versions | No fix yet |
| GO-2025-4172 Mattermost fails to validate user permissions when deleting comments in Boards |
Medium EPSS 0.18% |
all versions | No fix yet |
| GHSA-mp6x-97xj-9x62 Mattermost fails to to verify the token used during code exchange |
Critical EPSS 0.45% |
all versions | No fix yet |
| GHSA-mp6x-97xj-9x62 Mattermost fails to to verify the token used during code exchange |
Critical EPSS 0.45% |
>= 11.0.0, < 11.0.3 | 11.0.3 |
| GHSA-mp6x-97xj-9x62 Mattermost fails to to verify the token used during code exchange |
Critical EPSS 0.45% |
>= 10.12.0, < 10.12.2 | 10.12.2 |
| GHSA-mp6x-97xj-9x62 Mattermost fails to to verify the token used during code exchange |
Critical EPSS 0.45% |
>= 10.11.0, < 10.11.5 | 10.11.5 |
| GHSA-mp6x-97xj-9x62 Mattermost fails to to verify the token used during code exchange |
Critical EPSS 0.45% |
>= 10.5.0, < 10.5.13 | 10.5.13 |
| GHSA-4g87-9x45-cx2h Mattermost fails to sanitize team email addresses |
Medium EPSS 0.23% |
>= 10.12.0, < 10.12.2 | 10.12.2 |
| GHSA-4g87-9x45-cx2h Mattermost fails to sanitize team email addresses |
Medium EPSS 0.23% |
all versions | No fix yet |
| GHSA-4g87-9x45-cx2h Mattermost fails to sanitize team email addresses |
Medium EPSS 0.23% |
>= 10.5.0, < 10.5.13 | 10.5.13 |
| GHSA-4g87-9x45-cx2h Mattermost fails to sanitize team email addresses |
Medium EPSS 0.23% |
>= 10.11.0, < 10.11.5 | 10.11.5 |
| GHSA-4g87-9x45-cx2h Mattermost fails to sanitize team email addresses |
Medium EPSS 0.23% |
>= 11.0.0, < 11.0.3 | 11.0.3 |
| GHSA-3x39-62h4-f8j6 Mattermost fails to properly validate OAuth state tokens during OpenID Connect authentication |
Critical EPSS 0.37% |
>= 10.11.0, < 10.11.5 | 10.11.5 |
| GHSA-3x39-62h4-f8j6 Mattermost fails to properly validate OAuth state tokens during OpenID Connect authentication |
Critical EPSS 0.37% |
>= 10.5.0, < 10.5.13 | 10.5.13 |
| GHSA-3x39-62h4-f8j6 Mattermost fails to properly validate OAuth state tokens during OpenID Connect authentication |
Critical EPSS 0.37% |
>= 11.0.0, < 11.0.4 | 11.0.4 |
| GHSA-3x39-62h4-f8j6 Mattermost fails to properly validate OAuth state tokens during OpenID Connect authentication |
Critical EPSS 0.37% |
all versions | No fix yet |
| GHSA-3x39-62h4-f8j6 Mattermost fails to properly validate OAuth state tokens during OpenID Connect authentication |
Critical EPSS 0.37% |
>= 10.12.0, < 10.12.2 | 10.12.2 |
| GHSA-9hh7-6558-qfp2 Mattermost allows other users to determine when users had read channels via channel member objects |
Low EPSS 0.18% |
>= 10.5.0+incompatible, < 10.5.12+incompatible>= 10.11.0+incompatible, < 10.11.4+incompatible | 10.5.12+incompatible10.11.4+incompatible |
| GHSA-9hh7-6558-qfp2 Mattermost allows other users to determine when users had read channels via channel member objects |
Low EPSS 0.18% |
>= 10.11.0, < 10.11.4 | 10.11.4 |
| GHSA-9hh7-6558-qfp2 Mattermost allows other users to determine when users had read channels via channel member objects |
Low EPSS 0.18% |
>= 10.5.0, < 10.5.12 | 10.5.12 |
| GHSA-mqp8-pgg5-7x7m Mattermost allows system administrators to access password hashes and MFA secrets |
Medium EPSS 0.30% |
>= 10.12.0, < 10.12.1 | 10.12.1 |
| GHSA-mqp8-pgg5-7x7m Mattermost allows system administrators to access password hashes and MFA secrets |
Medium EPSS 0.30% |
>= 10.5.0+incompatible, < 10.5.12+incompatible>= 10.11.0+incompatible, < 10.11.4+incompatible>= 10.12.0+incompatible, < 10.12.1+incompatible | 10.5.12+incompatible10.11.4+incompatible10.12.1+incompatible |
| GHSA-mqp8-pgg5-7x7m Mattermost allows system administrators to access password hashes and MFA secrets |
Medium EPSS 0.30% |
>= 10.5.0, < 10.5.12 | 10.5.12 |
| GHSA-mqp8-pgg5-7x7m Mattermost allows system administrators to access password hashes and MFA secrets |
Medium EPSS 0.30% |
>= 10.11.0, < 10.11.4 | 10.11.4 |
| GHSA-ff85-qw3h-g9vp Mattermost allows an attacker to edit arbitrary posts via a crafted MSTeams plugin OAuth redirect URL |
Medium EPSS 0.20% |
>= 10.12.0, < 10.12.1 | 10.12.1 |
| GHSA-ff85-qw3h-g9vp Mattermost allows an attacker to edit arbitrary posts via a crafted MSTeams plugin OAuth redirect URL |
Medium EPSS 0.20% |
>= 10.5.0, < 10.5.12 | 10.5.12 |
| GHSA-ff85-qw3h-g9vp Mattermost allows an attacker to edit arbitrary posts via a crafted MSTeams plugin OAuth redirect URL |
Medium EPSS 0.20% |
>= 10.11.0, < 10.11.4 | 10.11.4 |
| GHSA-ff85-qw3h-g9vp Mattermost allows an attacker to edit arbitrary posts via a crafted MSTeams plugin OAuth redirect URL |
Medium EPSS 0.20% |
>= 10.5.0+incompatible, < 10.5.12+incompatible>= 10.11.0+incompatible, < 10.11.4+incompatible>= 10.12.0+incompatible, < 10.12.1+incompatible | 10.5.12+incompatible10.11.4+incompatible10.12.1+incompatible |
| GHSA-xpg8-8xpv-948p Mattermost does not enforce MFA on WebSocket connections |
High EPSS 0.32% |
< 11.1.0 | 11.1.0 |
| GHSA-xpg8-8xpv-948p Mattermost does not enforce MFA on WebSocket connections |
High EPSS 0.32% |
< 11.1.0+incompatible | 11.1.0+incompatible |
| GHSA-x3hx-ch7p-8xgg Mattermost allows regular users to access archived channel content and files |
Medium EPSS 0.18% |
< 11.0.0-alpha.1 | 11.0.0-alpha.1 |
| GHSA-x3hx-ch7p-8xgg Mattermost allows regular users to access archived channel content and files |
Medium EPSS 0.18% |
< 11.0.0-alpha.1+incompatible | 11.0.0-alpha.1+incompatible |
| GHSA-j6gg-r5jc-47cm Mattermost fails to properly restrict access to archived channel search API |
Medium EPSS 0.21% |
< 5.3.2-0.20250815165020-c8d66301415d | 5.3.2-0.20250815165020-c8d66301415d |
| GHSA-j6gg-r5jc-47cm Mattermost fails to properly restrict access to archived channel search API |
Medium EPSS 0.21% |
all versions | No fix yet |
| GHSA-mqcj-8c2g-h97q Mattermost Incorrect Authorization vulnerability |
Medium EPSS 0.20% |
>= 10.5.0+incompatible, < 10.5.12+incompatible>= 10.11.0+incompatible, < 10.11.4+incompatible | 10.5.12+incompatible10.11.4+incompatible |
| GHSA-mqcj-8c2g-h97q Mattermost Incorrect Authorization vulnerability |
Medium EPSS 0.20% |
< 5.3.2-0.20250905150616-ba86dfc5876b | 5.3.2-0.20250905150616-ba86dfc5876b |
| GHSA-mqcj-8c2g-h97q Mattermost Incorrect Authorization vulnerability |
Medium EPSS 0.20% |
>= 10.5.0, < 10.5.12 | 10.5.12 |
| GHSA-mqcj-8c2g-h97q Mattermost Incorrect Authorization vulnerability |
Medium EPSS 0.20% |
>= 10.11.0, < 10.11.4 | 10.11.4 |
| GHSA-r6qj-894f-5hr2 Mattermost has a Missing Authorization vulnerability |
High EPSS 0.34% |
>= 10.5.0+incompatible, < 10.5.11+incompatible>= 10.10.0+incompatible, < 10.10.3+incompatible>= 10.11.0+incompatible, < 10.11.2+incompatible | 10.5.11+incompatible10.10.3+incompatible10.11.2+incompatible |
| GHSA-r6qj-894f-5hr2 Mattermost has a Missing Authorization vulnerability |
High EPSS 0.34% |
>= 10.11.0, < 10.11.2 | 10.11.2 |
| GHSA-r6qj-894f-5hr2 Mattermost has a Missing Authorization vulnerability |
High EPSS 0.34% |
>= 10.10.0, < 10.10.3 | 10.10.3 |
| GHSA-r6qj-894f-5hr2 Mattermost has a Missing Authorization vulnerability |
High EPSS 0.34% |
>= 10.5.0, < 10.5.11 | 10.5.11 |
| GHSA-6q7m-p8cc-998r Mattermost has a Missing Authorization vulnerability |
High EPSS 0.42% |
>= 10.11.0, < 10.11.2 | 10.11.2 |
| GHSA-6q7m-p8cc-998r Mattermost has a Missing Authorization vulnerability |
High EPSS 0.42% |
>= 10.5.0+incompatible, < 10.5.11+incompatible>= 10.10.0+incompatible, < 10.10.3+incompatible>= 10.11.0+incompatible, < 10.11.2+incompatible | 10.5.11+incompatible10.10.3+incompatible10.11.2+incompatible |
| GHSA-6q7m-p8cc-998r Mattermost has a Missing Authorization vulnerability |
High EPSS 0.42% |
>= 10.5.0, < 10.5.11 | 10.5.11 |
| GHSA-6q7m-p8cc-998r Mattermost has a Missing Authorization vulnerability |
High EPSS 0.42% |
>= 10.10.0, < 10.10.3 | 10.10.3 |
| GHSA-xr3w-rmvj-f6m7 Mattermost has an Observable Timing Discrepancy vulnerability |
Low EPSS 0.27% |
>= 10.5.0, < 10.5.11 | 10.5.11 |
| GHSA-xr3w-rmvj-f6m7 Mattermost has an Observable Timing Discrepancy vulnerability |
Low EPSS 0.27% |
>= 10.5.0+incompatible, < 10.5.11+incompatible>= 10.11.0+incompatible, < 10.11.3+incompatible | 10.5.11+incompatible10.11.3+incompatible |
| GHSA-xr3w-rmvj-f6m7 Mattermost has an Observable Timing Discrepancy vulnerability |
Low EPSS 0.27% |
>= 10.11.0, < 10.11.3 | 10.11.3 |
| GHSA-3q4q-wqm6-hvf3 Mattermost has a Missing Authorization vulnerability |
Medium EPSS 0.30% |
>= 10.5.0+incompatible, < 10.5.11+incompatible>= 10.10.0+incompatible, < 10.10.3+incompatible>= 10.11.0+incompatible, < 10.11.3+incompatible | 10.5.11+incompatible10.10.3+incompatible10.11.3+incompatible |
| GHSA-3q4q-wqm6-hvf3 Mattermost has a Missing Authorization vulnerability |
Medium EPSS 0.30% |
>= 10.5.0, < 10.5.11 | 10.5.11 |
| GHSA-3q4q-wqm6-hvf3 Mattermost has a Missing Authorization vulnerability |
Medium EPSS 0.30% |
>= 10.10.0, < 10.10.3 | 10.10.3 |
| GHSA-3q4q-wqm6-hvf3 Mattermost has a Missing Authorization vulnerability |
Medium EPSS 0.30% |
>= 10.11.0, < 10.11.3 | 10.11.3 |
| GHSA-424h-xj87-m937 Mattermost has an Incorrect Authorization vulnerability |
Medium EPSS 0.33% |
>= 10.5.0, < 10.5.11 | 10.5.11 |
| GHSA-424h-xj87-m937 Mattermost has an Incorrect Authorization vulnerability |
Medium EPSS 0.33% |
>= 10.11.0, < 10.11.3 | 10.11.3 |
| GHSA-424h-xj87-m937 Mattermost has an Incorrect Authorization vulnerability |
Medium EPSS 0.33% |
>= 10.5.0+incompatible, < 10.5.11+incompatible>= 10.11.0+incompatible, < 10.11.3+incompatible | 10.5.11+incompatible10.11.3+incompatible |
| GHSA-7cr3-38jm-6p45 Mattermost has a Missing Authorization vulnerability |
Medium EPSS 0.31% |
all versions | No fix yet |
| GHSA-7cr3-38jm-6p45 Mattermost has a Missing Authorization vulnerability |
Medium EPSS 0.31% |
>= 10.5.0, < 10.5.11 | 10.5.11 |
| GHSA-7cr3-38jm-6p45 Mattermost has a Missing Authorization vulnerability |
Medium EPSS 0.31% |
>= 10.11.0, < 10.11.3 | 10.11.3 |
| GHSA-f72g-52v7-mg3p Mattermost boards plugin fails to restrict download access to files |
Medium EPSS 0.27% |
>= 10.5.0-rc1, < 10.5.9 | 10.5.9 |
| GHSA-f72g-52v7-mg3p Mattermost boards plugin fails to restrict download access to files |
Medium EPSS 0.27% |
>= 9.11.0-rc1, < 9.11.18 | 9.11.18 |
| GHSA-f72g-52v7-mg3p Mattermost boards plugin fails to restrict download access to files |
Medium EPSS 0.27% |
>= 9.11.0-rc1+incompatible, < 9.11.18+incompatible>= 10.5.0-rc1+incompatible, < 10.5.9+incompatible | 9.11.18+incompatible10.5.9+incompatible |
| GHSA-qx3f-6vq3-8j8m Mattermost Path Traversal vulnerability |
High EPSS 0.64% |
>= 10.8.0, < 10.8.4 | 10.8.4 |
| GHSA-qx3f-6vq3-8j8m Mattermost Path Traversal vulnerability |
High EPSS 0.64% |
>= 9.11.0, < 9.11.18 | 9.11.18 |
| GHSA-qx3f-6vq3-8j8m Mattermost Path Traversal vulnerability |
High EPSS 0.64% |
>= 10.10.0, < 10.10.2 | 10.10.2 |
| GHSA-qx3f-6vq3-8j8m Mattermost Path Traversal vulnerability |
High EPSS 0.64% |
>= 10.9.0, < 10.9.4 | 10.9.4 |
| GHSA-qx3f-6vq3-8j8m Mattermost Path Traversal vulnerability |
High EPSS 0.64% |
>= 9.11.0+incompatible, < 9.11.18+incompatible>= 10.5.0+incompatible, < 10.5.9+incompatible>= 10.8.0+incompatible, < 10.8.4+incompatible>= 10.9.0+incompatible, < 10.9.4+incompatible>= 10.10.0+incompatible, < 10.10.2+incompatible | 9.11.18+incompatible10.5.9+incompatible10.8.4+incompatible10.9.4+incompatible10.10.2+incompatible |
| GHSA-qx3f-6vq3-8j8m Mattermost Path Traversal vulnerability |
High EPSS 0.64% |
>= 10.5.0, < 10.5.9 | 10.5.9 |
| GHSA-hm95-jx66-g2gh Mattermost Open Redirect vulnerability |
Medium EPSS 0.17% |
>= 10.5.0, < 10.5.10 | 10.5.10 |
| GHSA-hm95-jx66-g2gh Mattermost Open Redirect vulnerability |
Medium EPSS 0.17% |
>= 10.5.0+incompatible, < 10.5.10+incompatible | 10.5.10+incompatible |
| GHSA-69j8-prx2-vx98 Mattermost Open Redirect vulnerability |
Medium EPSS 0.18% |
>= 10.10.0, < 10.10.2 | 10.10.2 |
| GHSA-69j8-prx2-vx98 Mattermost Open Redirect vulnerability |
Medium EPSS 0.18% |
>= 10.5.0, < 10.5.10 | 10.5.10 |
| GHSA-69j8-prx2-vx98 Mattermost Open Redirect vulnerability |
Medium EPSS 0.18% |
>= 10.9.0, < 10.9.5 | 10.9.5 |
| GHSA-69j8-prx2-vx98 Mattermost Open Redirect vulnerability |
Medium EPSS 0.18% |
>= 10.5.0+incompatible, < 10.5.10+incompatible>= 10.9.0+incompatible, < 10.9.5+incompatible>= 10.10.0+incompatible, < 10.10.2+incompatible | 10.5.10+incompatible10.9.5+incompatible10.10.2+incompatible |
| GHSA-9p92-x77w-9fw2 Mattermost makes Use of Weak Hash |
Medium EPSS 0.15% |
>= 10.9.0, < 10.9.4 | 10.9.4 |
| GHSA-9p92-x77w-9fw2 Mattermost makes Use of Weak Hash |
Medium EPSS 0.15% |
>= 10.8.0, < 10.8.4 | 10.8.4 |
| GHSA-9p92-x77w-9fw2 Mattermost makes Use of Weak Hash |
Medium EPSS 0.15% |
>= 10.5.0, < 10.5.9 | 10.5.9 |
| GHSA-9p92-x77w-9fw2 Mattermost makes Use of Weak Hash |
Medium EPSS 0.15% |
>= 9.11.0, < 9.11.18 | 9.11.18 |
| GHSA-9p92-x77w-9fw2 Mattermost makes Use of Weak Hash |
Medium EPSS 0.15% |
>= 10.10.0, < 10.10.2 | 10.10.2 |
| GHSA-9p92-x77w-9fw2 Mattermost makes Use of Weak Hash |
Medium EPSS 0.15% |
>= 9.11.0+incompatible, < 9.11.18+incompatible>= 10.5.0+incompatible, < 10.5.9+incompatible>= 10.8.0+incompatible, < 10.8.4+incompatible>= 10.9.0+incompatible, < 10.9.4+incompatible>= 10.10.0+incompatible, < 10.10.2+incompatible | 9.11.18+incompatible10.5.9+incompatible10.8.4+incompatible10.9.4+incompatible10.10.2+incompatible |
| GHSA-3vcm-c42p-3hhf Mattermost Missing Authorization vulnerability |
Medium EPSS 0.26% |
>= 10.10.0+incompatible, < 10.10.2+incompatible | 10.10.2+incompatible |
| GHSA-3vcm-c42p-3hhf Mattermost Missing Authorization vulnerability |
Medium EPSS 0.26% |
>= 10.10.0, < 10.10.2 | 10.10.2 |
| GHSA-h469-4fcf-p23h Mattermost has Potential Server Crash due to Unvalidated Import Data |
Medium EPSS 0.32% |
>= 10.10.0, < 10.10.1 | 10.10.1 |
| GHSA-h469-4fcf-p23h Mattermost has Potential Server Crash due to Unvalidated Import Data |
Medium EPSS 0.32% |
>= 9.11.0, < 9.11.18 | 9.11.18 |
| GHSA-h469-4fcf-p23h Mattermost has Potential Server Crash due to Unvalidated Import Data |
Medium EPSS 0.32% |
>= 9.11.0+incompatible, < 9.11.18+incompatible>= 10.5.0+incompatible, < 10.5.9+incompatible>= 10.8.0+incompatible, < 10.8.4+incompatible>= 10.9.0+incompatible, < 10.9.4+incompatible>= 10.10.0+incompatible, < 10.10.1+incompatible | 9.11.18+incompatible10.5.9+incompatible10.8.4+incompatible10.9.4+incompatible10.10.1+incompatible |
| GHSA-h469-4fcf-p23h Mattermost has Potential Server Crash due to Unvalidated Import Data |
Medium EPSS 0.32% |
>= 10.5.0, < 10.5.9 | 10.5.9 |
| GHSA-h469-4fcf-p23h Mattermost has Potential Server Crash due to Unvalidated Import Data |
Medium EPSS 0.32% |
>= 10.8.0, < 10.8.4 | 10.8.4 |
| GHSA-h469-4fcf-p23h Mattermost has Potential Server Crash due to Unvalidated Import Data |
Medium EPSS 0.32% |
>= 10.9.0, < 10.9.4 | 10.9.4 |
| GHSA-pj6f-rc94-gw53 Mattermost Fails to Sanitize File Names |
Medium EPSS 0.77% |
>= 10.9.0, < 10.9.4 | 10.9.4 |
| GHSA-pj6f-rc94-gw53 Mattermost Fails to Sanitize File Names |
Medium EPSS 0.77% |
>= 10.5.0+incompatible, < 10.5.9+incompatible>= 10.8.0+incompatible, < 10.8.4+incompatible>= 10.9.0+incompatible, < 10.9.4+incompatible>= 10.10.0+incompatible, < 10.10.1+incompatible | 10.5.9+incompatible10.8.4+incompatible10.9.4+incompatible10.10.1+incompatible |
| GHSA-pj6f-rc94-gw53 Mattermost Fails to Sanitize File Names |
Medium EPSS 0.77% |
>= 10.5.0, < 10.5.9 | 10.5.9 |
| GHSA-pj6f-rc94-gw53 Mattermost Fails to Sanitize File Names |
Medium EPSS 0.77% |
>= 10.8.0, < 10.8.4 | 10.8.4 |
| GHSA-pj6f-rc94-gw53 Mattermost Fails to Sanitize File Names |
Medium EPSS 0.77% |
>= 10.10.0, < 10.10.1 | 10.10.1 |
| GHSA-x67c-v8jr-p29r Mattermost Fails to Sanitize Path Traversal Sequences |
Medium EPSS 0.41% |
>= 9.11.0+incompatible, < 9.11.18+incompatible>= 10.5.0+incompatible, < 10.5.9+incompatible>= 10.8.0+incompatible, < 10.8.4+incompatible>= 10.9.0+incompatible, < 10.9.3+incompatible | 9.11.18+incompatible10.5.9+incompatible10.8.4+incompatible10.9.3+incompatible |
| GHSA-x67c-v8jr-p29r Mattermost Fails to Sanitize Path Traversal Sequences |
Medium EPSS 0.41% |
>= 10.5.0, < 10.5.9 | 10.5.9 |
| GHSA-x67c-v8jr-p29r Mattermost Fails to Sanitize Path Traversal Sequences |
Medium EPSS 0.41% |
>= 9.11.0, < 9.11.18 | 9.11.18 |
| GHSA-x67c-v8jr-p29r Mattermost Fails to Sanitize Path Traversal Sequences |
Medium EPSS 0.41% |
>= 10.8.0, < 10.8.4 | 10.8.4 |
| GHSA-x67c-v8jr-p29r Mattermost Fails to Sanitize Path Traversal Sequences |
Medium EPSS 0.41% |
>= 10.9.0, < 10.9.3 | 10.9.3 |
| GHSA-4276-cm8c-788h Mattermost Fails to Properly Validate Team Role Modification |
Low EPSS 0.20% |
>= 9.11.0, < 9.11.18 | 9.11.18 |
| GHSA-4276-cm8c-788h Mattermost Fails to Properly Validate Team Role Modification |
Low EPSS 0.20% |
>= 9.11.0+incompatible, < 9.11.18+incompatible>= 10.5.0+incompatible, < 10.5.9+incompatible | 9.11.18+incompatible10.5.9+incompatible |
| GHSA-4276-cm8c-788h Mattermost Fails to Properly Validate Team Role Modification |
Low EPSS 0.20% |
>= 10.5.0, < 10.5.9 | 10.5.9 |
| GHSA-pwvr-grqg-7vp2 Mattermost Lack of Access Control Validation |
Medium EPSS 0.20% |
>= 10.5.0, < 10.5.9 | 10.5.9 |
| GHSA-pwvr-grqg-7vp2 Mattermost Lack of Access Control Validation |
Medium EPSS 0.20% |
>= 10.5.0+incompatible, < 10.5.9+incompatible | 10.5.9+incompatible |
| GHSA-q453-638c-h4mr Mattermost Fails to Validate Remote Cluster Upload Sessions |
Medium EPSS 0.30% |
>= 9.11.0, < 9.11.18 | 9.11.18 |
| GHSA-q453-638c-h4mr Mattermost Fails to Validate Remote Cluster Upload Sessions |
Medium EPSS 0.30% |
>= 10.9.0, < 10.9.3 | 10.9.3 |
| GHSA-q453-638c-h4mr Mattermost Fails to Validate Remote Cluster Upload Sessions |
Medium EPSS 0.30% |
>= 10.10.0, < 10.10.1 | 10.10.1 |
| GHSA-q453-638c-h4mr Mattermost Fails to Validate Remote Cluster Upload Sessions |
Medium EPSS 0.30% |
>= 9.11.0+incompatible, < 9.11.18+incompatible>= 10.5.0+incompatible, < 10.5.9+incompatible>= 10.8.0+incompatible, < 10.8.4+incompatible>= 10.9.0+incompatible, < 10.9.3+incompatible>= 10.10.0+incompatible, < 10.10.1+incompatible | 9.11.18+incompatible10.5.9+incompatible10.8.4+incompatible10.9.3+incompatible10.10.1+incompatible |
| GHSA-q453-638c-h4mr Mattermost Fails to Validate Remote Cluster Upload Sessions |
Medium EPSS 0.30% |
>= 10.5.0, < 10.5.9 | 10.5.9 |
| GHSA-q453-638c-h4mr Mattermost Fails to Validate Remote Cluster Upload Sessions |
Medium EPSS 0.30% |
>= 10.8.0, < 10.8.4 | 10.8.4 |
| GHSA-qj47-w9f2-qg44 Mattermost Does Not Sanitize the Team Invite ID |
Medium EPSS 0.22% |
>= 10.8.0, < 10.8.4 | 10.8.4 |
| GHSA-qj47-w9f2-qg44 Mattermost Does Not Sanitize the Team Invite ID |
Medium EPSS 0.22% |
>= 9.11.0+incompatible, < 9.11.18+incompatible>= 10.5.0+incompatible, < 10.5.9+incompatible>= 10.8.0+incompatible, < 10.8.4+incompatible>= 10.9.0+incompatible, < 10.9.3+incompatible | 9.11.18+incompatible10.5.9+incompatible10.8.4+incompatible10.9.3+incompatible |
| GHSA-qj47-w9f2-qg44 Mattermost Does Not Sanitize the Team Invite ID |
Medium EPSS 0.22% |
>= 10.9.0, < 10.9.3 | 10.9.3 |
| GHSA-qj47-w9f2-qg44 Mattermost Does Not Sanitize the Team Invite ID |
Medium EPSS 0.22% |
>= 9.11.0, < 9.11.18 | 9.11.18 |
| GHSA-qj47-w9f2-qg44 Mattermost Does Not Sanitize the Team Invite ID |
Medium EPSS 0.22% |
>= 10.5.0, < 10.5.9 | 10.5.9 |
| GHSA-vqwh-5jhh-vc9p Mattermost Server SSRF Vulnerability via the Agents Plugin |
Low EPSS 0.19% |
>= 10.5.0+incompatible, < 10.5.10+incompatible | 10.5.10+incompatible |
| GHSA-vqwh-5jhh-vc9p Mattermost Server SSRF Vulnerability via the Agents Plugin |
Low EPSS 0.19% |
>= 10.5.0, < 10.5.10 | 10.5.10 |
| GHSA-gq3r-5833-5532 Mattermost Fails to Validate File Paths |
Medium EPSS 0.49% |
>= 9.11.0, < 9.11.18 | 9.11.18 |
| GHSA-gq3r-5833-5532 Mattermost Fails to Validate File Paths |
Medium EPSS 0.49% |
>= 10.5.0, < 10.5.9 | 10.5.9 |
| GHSA-gq3r-5833-5532 Mattermost Fails to Validate File Paths |
Medium EPSS 0.49% |
>= 10.9.0, < 10.9.2 | 10.9.2 |
| GHSA-gq3r-5833-5532 Mattermost Fails to Validate File Paths |
Medium EPSS 0.49% |
>= 9.11.0+incompatible, < 9.11.18+incompatible>= 10.5.0+incompatible, < 10.5.9+incompatible>= 10.8.0+incompatible, < 10.8.4+incompatible>= 10.9.0+incompatible, < 10.9.2+incompatible | 9.11.18+incompatible10.5.9+incompatible10.8.4+incompatible10.9.2+incompatible |
| GHSA-gq3r-5833-5532 Mattermost Fails to Validate File Paths |
Medium EPSS 0.49% |
>= 10.8.0, < 10.8.4 | 10.8.4 |
| GHSA-4fwj-8595-wp25 Mattermost has Insufficiently Protected Credentials |
Low EPSS 0.22% |
>= 9.11.0, < 9.11.17 | 9.11.17 |
| GHSA-4fwj-8595-wp25 Mattermost has Insufficiently Protected Credentials |
Low EPSS 0.22% |
>= 10.5.0, < 10.5.8 | 10.5.8 |
| GHSA-4fwj-8595-wp25 Mattermost has Insufficiently Protected Credentials |
Low EPSS 0.22% |
>= 9.11.0+incompatible, < 9.11.17+incompatible>= 10.5.0+incompatible, < 10.5.8+incompatible | 9.11.17+incompatible10.5.8+incompatible |
| GHSA-wvw2-3jh4-4c39 Mattermost Path Traversal vulnerability |
Medium EPSS 0.45% |
>= 9.11.0+incompatible, < 9.11.17+incompatible>= 10.5.0+incompatible, < 10.5.8+incompatible>= 10.7.0+incompatible, < 10.7.4+incompatible>= 10.8.0+incompatible, < 10.8.2+incompatible | 9.11.17+incompatible10.5.8+incompatible10.7.4+incompatible10.8.2+incompatible |
| GHSA-wvw2-3jh4-4c39 Mattermost Path Traversal vulnerability |
Medium EPSS 0.45% |
>= 9.11.0, < 9.11.17 | 9.11.17 |
| GHSA-wvw2-3jh4-4c39 Mattermost Path Traversal vulnerability |
Medium EPSS 0.45% |
>= 10.8.0, < 10.8.2 | 10.8.2 |
| GHSA-wvw2-3jh4-4c39 Mattermost Path Traversal vulnerability |
Medium EPSS 0.45% |
>= 10.7.0, < 10.7.4 | 10.7.4 |
| GHSA-wvw2-3jh4-4c39 Mattermost Path Traversal vulnerability |
Medium EPSS 0.45% |
>= 10.5.0, < 10.5.8 | 10.5.8 |
| GHSA-7h34-9chr-58qh Mattermost Missing Authentication for Critical Function |
Medium EPSS 0.37% |
>= 9.11.0, < 9.11.17 | 9.11.17 |
| GHSA-7h34-9chr-58qh Mattermost Missing Authentication for Critical Function |
Medium EPSS 0.37% |
>= 9.11.0+incompatible, < 9.11.17+incompatible>= 10.5.0+incompatible, < 10.5.7+incompatible>= 10.7.0+incompatible, < 10.7.4+incompatible>= 10.8.0+incompatible, < 10.8.2+incompatible | 9.11.17+incompatible10.5.7+incompatible10.7.4+incompatible10.8.2+incompatible |
| GHSA-7h34-9chr-58qh Mattermost Missing Authentication for Critical Function |
Medium EPSS 0.37% |
>= 10.5.0, < 10.5.7 | 10.5.7 |
| GHSA-7h34-9chr-58qh Mattermost Missing Authentication for Critical Function |
Medium EPSS 0.37% |
>= 10.8.0, < 10.8.2 | 10.8.2 |
| GHSA-7h34-9chr-58qh Mattermost Missing Authentication for Critical Function |
Medium EPSS 0.37% |
>= 10.7.0, < 10.7.4 | 10.7.4 |
| GHSA-wgvp-jj4w-88hf Mattermost Incorrect Authorization vulnerability |
Medium EPSS 0.20% |
< 0.0.0-20250513065225-4ae5d647fb88 | 0.0.0-20250513065225-4ae5d647fb88 |
| GHSA-wgvp-jj4w-88hf Mattermost Incorrect Authorization vulnerability |
Medium EPSS 0.20% |
< 0.0.0-20250513065225-4ae5d647fb88>= 9.11.0+incompatible, < 9.11.16+incompatible>= 10.5.0+incompatible, < 10.5.6+incompatible>= 10.6.0+incompatible, < 10.6.6+incompatible>= 10.7.0+incompatible, < 10.7.3+incompatible>= 10.8.0+incompatible, < 10.8.1+incompatible | 0.0.0-20250513065225-4ae5d647fb889.11.16+incompatible10.5.6+incompatible10.6.6+incompatible10.7.3+incompatible10.8.1+incompatible |
| GHSA-v8fr-vxmw-6mf6 Mattermost Incorrect Authorization vulnerability |
Medium EPSS 0.22% |
< 0.0.0-20250513065225-4ae5d647fb88 | 0.0.0-20250513065225-4ae5d647fb88 |
| GHSA-v8fr-vxmw-6mf6 Mattermost Incorrect Authorization vulnerability |
Medium EPSS 0.22% |
< 0.0.0-20250513065225-4ae5d647fb88>= 9.11.0+incompatible, < 9.11.16+incompatible>= 10.5.0+incompatible, < 10.5.6+incompatible>= 10.6.0+incompatible, < 10.6.6+incompatible>= 10.7.0+incompatible, < 10.7.3+incompatible>= 10.8.0+incompatible, < 10.8.1+incompatible | 0.0.0-20250513065225-4ae5d647fb889.11.16+incompatible10.5.6+incompatible10.6.6+incompatible10.7.3+incompatible10.8.1+incompatible |
| GHSA-4578-6gjh-f2jm Mattermost allows an unauthorized Guest user access to Playbook |
Medium EPSS 0.29% |
< 0.0.0-20250520060012-d0380305ef7a>= 9.11.0+incompatible, < 9.11.16+incompatible>= 10.5.0+incompatible, < 10.5.6+incompatible>= 10.6.0+incompatible, < 10.6.6+incompatible>= 10.7.0+incompatible, < 10.7.3+incompatible>= 10.8.0+incompatible, < 10.8.1+incompatible | 0.0.0-20250520060012-d0380305ef7a9.11.16+incompatible10.5.6+incompatible10.6.6+incompatible10.7.3+incompatible10.8.1+incompatible |
| GHSA-4578-6gjh-f2jm Mattermost allows an unauthorized Guest user access to Playbook |
Medium EPSS 0.29% |
< 0.0.0-20250520060012-d0380305ef7a | 0.0.0-20250520060012-d0380305ef7a |
| GHSA-qwwm-c582-82rx Mattermost allows unauthorized channel member management through playbook runs |
Medium EPSS 0.25% |
< 0.0.0-20250520060012-d0380305ef7a | 0.0.0-20250520060012-d0380305ef7a |
| GHSA-qwwm-c582-82rx Mattermost allows unauthorized channel member management through playbook runs |
Medium EPSS 0.25% |
< 0.0.0-20250520060012-d0380305ef7a>= 9.11.0+incompatible, < 9.11.16+incompatible>= 10.5.0+incompatible, < 10.5.6+incompatible>= 10.6.0+incompatible, < 10.6.6+incompatible>= 10.7.0+incompatible, < 10.7.3+incompatible>= 10.8.0+incompatible, < 10.8.1+incompatible | 0.0.0-20250520060012-d0380305ef7a9.11.16+incompatible10.5.6+incompatible10.6.6+incompatible10.7.3+incompatible10.8.1+incompatible |
| GHSA-qh58-9v3j-wcjc Mattermost allows authenticated users to write files to arbitrary locations |
Critical EPSS 1.02% |
< 0.0.0-20250519205859-65aec10162f6 | 0.0.0-20250519205859-65aec10162f6 |
| GHSA-qh58-9v3j-wcjc Mattermost allows authenticated users to write files to arbitrary locations |
Critical EPSS 1.02% |
< 0.0.0-20250519205859-65aec10162f6>= 9.11.0+incompatible, < 9.11.16+incompatible>= 10.5.0+incompatible, < 10.5.6+incompatible>= 10.6.0+incompatible, < 10.6.6+incompatible>= 10.7.0+incompatible, < 10.7.3+incompatible>= 10.8.0+incompatible, < 10.8.1+incompatible | 0.0.0-20250519205859-65aec10162f69.11.16+incompatible10.5.6+incompatible10.6.6+incompatible10.7.3+incompatible10.8.1+incompatible |
| GHSA-4r67-4x4p-fprg Mattermost allows authenticated administrator to execute LDAP search filter injection |
Medium EPSS 0.28% |
>= 10.6.0, < 10.6.4 | 10.6.4 |
| GHSA-4r67-4x4p-fprg Mattermost allows authenticated administrator to execute LDAP search filter injection |
Medium EPSS 0.28% |
>= 10.5.0, < 10.5.5 | 10.5.5 |
| GHSA-4r67-4x4p-fprg Mattermost allows authenticated administrator to execute LDAP search filter injection |
Medium EPSS 0.28% |
>= 9.11.0+incompatible, < 9.11.14+incompatible>= 10.5.0+incompatible, < 10.5.5+incompatible>= 10.6.0+incompatible, < 10.6.4+incompatible>= 10.7.0+incompatible, < 10.7.2+incompatible | 9.11.14+incompatible10.5.5+incompatible10.6.4+incompatible10.7.2+incompatible |
| GHSA-4r67-4x4p-fprg Mattermost allows authenticated administrator to execute LDAP search filter injection |
Medium EPSS 0.28% |
>= 9.11.0, < 9.11.14 | 9.11.14 |
| GHSA-4r67-4x4p-fprg Mattermost allows authenticated administrator to execute LDAP search filter injection |
Medium EPSS 0.28% |
>= 10.7.0, < 10.7.2 | 10.7.2 |
| GHSA-jwhw-xf5v-qgxc Mattermost allows guest users to view information about public teams they are not members of |
Medium EPSS 0.22% |
>= 9.11.0, < 9.11.14 | 9.11.14 |
| GHSA-jwhw-xf5v-qgxc Mattermost allows guest users to view information about public teams they are not members of |
Medium EPSS 0.22% |
>= 10.5.0, < 10.5.5 | 10.5.5 |
| GHSA-jwhw-xf5v-qgxc Mattermost allows guest users to view information about public teams they are not members of |
Medium EPSS 0.22% |
>= 9.11.0+incompatible, < 9.11.14+incompatible>= 10.5.0+incompatible, < 10.5.5+incompatible | 9.11.14+incompatible10.5.5+incompatible |
| GO-2025-3728 Mattermost fails to properly enforce access control restrictions for System Manager roles |
Medium EPSS 0.23% |
>= 9.0.0-rc1+incompatible, < 9.11.13+incompatible>= 10.0.0-rc1+incompatible, < 10.5.4+incompatible>= 10.6.0-rc1+incompatible, < 10.7.1+incompatible | 9.11.13+incompatible10.5.4+incompatible10.7.1+incompatible |
| GO-2025-3731 Mattermost fails to properly invalidate personal access tokens upon user deactivation |
Medium EPSS 0.23% |
>= 9.0.0-rc1+incompatible, < 9.11.13+incompatible>= 10.0.0-rc1+incompatible, < 10.5.4+incompatible>= 10.6.0-rc1+incompatible, < 10.6.3+incompatible>= 10.7.0-rc1+incompatible, < 10.7.1+incompatible | 9.11.13+incompatible10.5.4+incompatible10.6.3+incompatible10.7.1+incompatible |
| GO-2025-3729 Mattermost fails to clear Google OAuth credentials |
Medium EPSS 0.21% |
>= 9.0.0-rc1+incompatible, < 9.11.13+incompatible>= 10.0.0-rc1+incompatible, < 10.5.4+incompatible>= 10.6.0-rc1+incompatible, < 10.6.3+incompatible>= 10.7.0-rc1+incompatible, < 10.7.1+incompatible | 9.11.13+incompatible10.5.4+incompatible10.6.3+incompatible10.7.1+incompatible |
| GO-2025-3730 Mattermost fails to properly enforce access controls for guest users |
Low EPSS 0.25% |
>= 9.0.0-rc1+incompatible, < 9.11.13+incompatible>= 10.0.0-rc1+incompatible, < 10.5.4+incompatible>= 10.6.0-rc1+incompatible, < 10.7.1+incompatible | 9.11.13+incompatible10.5.4+incompatible10.7.1+incompatible |
| GO-2025-3724 Mattermost improperly allows team administrators to modify team invites |
Low EPSS 0.33% |
>= 9.0.0-rc1+incompatible, < 9.11.13+incompatible>= 10.5.0-rc1+incompatible, < 10.5.4+incompatible>= 10.6.0-rc1+incompatible, < 10.6.3+incompatible>= 10.7.0-rc1+incompatible, < 10.7.1+incompatible | 9.11.13+incompatible10.5.4+incompatible10.6.3+incompatible10.7.1+incompatible |
| GO-2025-3694 Mattermost Fails to Check User Access to `ExperimentalSettings` |
Low EPSS 0.34% |
>= 9.11.0+incompatible, < 9.11.12+incompatible>= 10.5.0+incompatible, < 10.5.3+incompatible | 9.11.12+incompatible10.5.3+incompatible |
| GO-2025-3691 Mattermost Fails to Verify User's Permissions When Accessing Groups |
Medium EPSS 0.31% |
>= 9.11.0+incompatible, < 9.11.12+incompatible>= 10.5.0+incompatible, < 10.5.3+incompatible | 9.11.12+incompatible10.5.3+incompatible |
| GO-2025-3693 Mattermost Fails to Validate Team Invite Permissions |
Medium EPSS 0.26% |
>= 9.11.0+incompatible, < 9.11.12+incompatible>= 10.4.0+incompatible, < 10.4.5+incompatible>= 10.5.0+incompatible, < 10.5.3+incompatible>= 10.6.0+incompatible, < 10.6.2+incompatible | 9.11.12+incompatible10.4.5+incompatible10.5.3+incompatible10.6.2+incompatible |
| GO-2025-3692 Mattermost Fails to Lockout LDAP Users After Repeated Login Failures |
Medium EPSS 0.35% |
>= 9.11.0+incompatible, < 9.11.12+incompatible>= 10.4.0+incompatible, < 10.4.5+incompatible>= 10.5.0+incompatible, < 10.5.3+incompatible>= 10.6.0+incompatible, < 10.6.2+incompatible | 9.11.12+incompatible10.4.5+incompatible10.5.3+incompatible10.6.2+incompatible |
| GO-2025-3644 Mattermost Playbooks fails to properly validate permissions |
Medium EPSS 0.28% |
>= 10.4.0+incompatible | No fix yet |
| GO-2025-3644 Mattermost Playbooks fails to properly validate permissions |
Medium EPSS 0.28% |
>= 10.5.0+incompatible | No fix yet |
| GO-2025-3644 Mattermost Playbooks fails to properly validate permissions |
Medium EPSS 0.28% |
>= 9.11.0+incompatible | No fix yet |
| GO-2025-3642 Mattermost Playbooks fails to properly validate the props used by the RetrospectivePost custom post type |
High EPSS 0.50% |
>= 9.11.0+incompatible | No fix yet |
| GO-2025-3642 Mattermost Playbooks fails to properly validate the props used by the RetrospectivePost custom post type |
High EPSS 0.50% |
>= 10.5.0+incompatible | No fix yet |
| GO-2025-3642 Mattermost Playbooks fails to properly validate the props used by the RetrospectivePost custom post type |
High EPSS 0.50% |
>= 10.4.0+incompatible | No fix yet |
| GO-2025-3643 Mattermost Playbooks fails to validate the uniqueness and quantity of task actions |
High EPSS 0.40% |
>= 10.4.0+incompatible | No fix yet |
| GO-2025-3643 Mattermost Playbooks fails to validate the uniqueness and quantity of task actions |
High EPSS 0.40% |
>= 9.11.0+incompatible | No fix yet |
| GO-2025-3643 Mattermost Playbooks fails to validate the uniqueness and quantity of task actions |
High EPSS 0.40% |
>= 10.5.0+incompatible | No fix yet |
| GO-2025-3623 Mattermost Incorrect Authorization vulnerability |
Medium EPSS 0.29% |
>= 9.11.0+incompatible, < 9.11.10+incompatible>= 10.4.0+incompatible, < 10.4.4+incompatible>= 10.5.0+incompatible, < 10.5.2+incompatible | 9.11.10+incompatible10.4.4+incompatible10.5.2+incompatible |
| GO-2025-3622 Mattermost doesn't restrict domains LLM can request to contact upstream |
Medium EPSS 0.29% |
>= 9.11.0+incompatible, < 9.11.10+incompatible>= 10.4.0+incompatible, < 10.4.3+incompatible>= 10.5.0+incompatible, < 10.5.1+incompatible | 9.11.10+incompatible10.4.3+incompatible10.5.1+incompatible |
| GO-2025-3618 Mattermost vulnerable to Observable Timing Discrepancy |
Medium EPSS 0.34% |
>= 10.5.0+incompatible, < 10.5.2+incompatible | 10.5.2+incompatible |
| GO-2025-3619 Mattermost Incorrect Authorization vulnerability |
Medium EPSS 0.27% |
>= 9.11.0+incompatible, < 9.11.10+incompatible>= 10.4.0+incompatible, < 10.4.4+incompatible>= 10.5.0+incompatible, < 10.5.2+incompatible | 9.11.10+incompatible10.4.4+incompatible10.5.2+incompatible |
| GO-2025-3620 Mattermost Missing Authentication for Critical Function |
Low EPSS 0.24% |
>= 9.11.0+incompatible, < 9.11.10+incompatible>= 10.5.0+incompatible, < 10.5.2+incompatible | 9.11.10+incompatible10.5.2+incompatible |
| GO-2025-3621 Mattermost Incorrect Authorization vulnerability |
Medium EPSS 0.23% |
>= 9.11.0+incompatible, < 9.11.10+incompatible>= 10.4.0+incompatible, < 10.4.4+incompatible>= 10.5.0+incompatible, < 10.5.2+incompatible | 9.11.10+incompatible10.4.4+incompatible10.5.2+incompatible |
| GO-2025-3610 Mattermost vulnerable to Incorrect Implementation of Authentication Algorithm |
Medium EPSS 0.23% |
>= 9.11.0+incompatible, < 9.11.10+incompatible>= 10.5.0+incompatible, < 10.5.2+incompatible | 9.11.10+incompatible10.5.2+incompatible |
| GO-2025-3611 Mattermost Incorrect Authorization vulnerability |
Medium EPSS 0.26% |
>= 9.11.0+incompatible, < 9.11.10+incompatible>= 10.5.0+incompatible, < 10.5.2+incompatible | 9.11.10+incompatible10.5.2+incompatible |
| GHSA-322v-vh2g-qvpv Mattermost Fails to Restrict Certain Operations on System Admins |
Medium EPSS 0.25% |
>= 10.4.0, < 10.4.4 | 10.4.4 |
| GHSA-322v-vh2g-qvpv Mattermost Fails to Restrict Certain Operations on System Admins |
Medium EPSS 0.25% |
>= 9.11.0, < 9.11.10 | 9.11.10 |
| GHSA-322v-vh2g-qvpv Mattermost Fails to Restrict Certain Operations on System Admins |
Medium EPSS 0.25% |
>= 9.11.0+incompatible, < 9.11.10+incompatible>= 10.4.0+incompatible, < 10.4.4+incompatible>= 10.5.0+incompatible, < 10.5.2+incompatible | 9.11.10+incompatible10.4.4+incompatible10.5.2+incompatible |
| GHSA-322v-vh2g-qvpv Mattermost Fails to Restrict Certain Operations on System Admins |
Medium EPSS 0.25% |
>= 10.5.0, < 10.5.2 | 10.5.2 |
| GO-2025-3604 Mattermost Fails to Enforce Proper Access Controls on `/api/v4/audits` Endpoint |
Low EPSS 0.29% |
>= 9.11.0+incompatible, < 9.11.9+incompatible | 9.11.9+incompatible |
| GO-2025-3549 Mattermost Fails to Enforce Certain Search APIs |
Medium EPSS 0.32% |
>= 9.11.0+incompatible, < 9.11.9+incompatible>= 10.3.0+incompatible, < 10.3.4+incompatible>= 10.4.0+incompatible, < 10.4.3+incompatible>= 10.5.0+incompatible, < 10.5.1+incompatible | 9.11.9+incompatible10.3.4+incompatible10.4.3+incompatible10.5.1+incompatible |
| GHSA-h5v9-xw2g-7hrq Mattermost allows members with permission to convert public channels to private and convert private to public |
Medium EPSS 0.21% |
>= 9.11.0+incompatible, < 9.11.9+incompatible>= 10.3.0+incompatible, < 10.3.4+incompatible>= 10.4.0+incompatible, < 10.4.3+incompatible | 9.11.9+incompatible10.3.4+incompatible10.4.3+incompatible |
| GHSA-h5v9-xw2g-7hrq Mattermost allows members with permission to convert public channels to private and convert private to public |
Medium EPSS 0.21% |
< 9.11.9 | 9.11.9 |
| GO-2025-3555 Mattermost fail to prompt for explicit approval before adding a team admin to a private channel |
Low EPSS 0.22% |
>= 9.11.0+incompatible, < 9.11.9+incompatible | 9.11.9+incompatible |
| GO-2025-3550 Mattermost Fails to Restrict Command Execution in Archived Channels |
High EPSS 0.38% |
>= 9.11.0+incompatible, < 9.11.9+incompatible>= 10.3.0+incompatible, < 10.3.4+incompatible>= 10.4.0+incompatible, < 10.4.3+incompatible>= 10.5.0+incompatible, < 10.5.1+incompatible | 9.11.9+incompatible10.3.4+incompatible10.4.3+incompatible10.5.1+incompatible |
| GO-2025-3551 Mattermost Fails to Enforce MFA on Plugin Endpoints |
High EPSS 0.34% |
>= 9.11.0+incompatible, < 9.11.9+incompatible>= 10.3.0+incompatible, < 10.3.4+incompatible>= 10.4.0+incompatible, < 10.4.3+incompatible>= 10.5.0+incompatible, < 10.5.1+incompatible | 9.11.9+incompatible10.3.4+incompatible10.4.3+incompatible10.5.1+incompatible |
| GO-2025-3552 Mattermost Fails to Restrict Bookmark Creation and Updates in Archived Channels |
Medium EPSS 0.24% |
>= 9.11.0+incompatible, < 9.11.9+incompatible>= 10.3.0+incompatible, < 10.3.4+incompatible>= 10.4.0+incompatible, < 10.4.3+incompatible>= 10.5.0+incompatible, < 10.5.1+incompatible | 9.11.9+incompatible10.3.4+incompatible10.4.3+incompatible10.5.1+incompatible |
| GHSA-fqrq-xmxj-v47x Mattermost Fails to Properly Perform Viewer Role Authorization |
Medium EPSS 0.25% |
>= 9.11.0+incompatible, < 9.11.9+incompatible | 9.11.9+incompatible |
| GHSA-fqrq-xmxj-v47x Mattermost Fails to Properly Perform Viewer Role Authorization |
Medium EPSS 0.25% |
>= 9.11.0, < 9.11.9 | 9.11.9 |
| GO-2025-3480 Mattermost allows reading arbitrary files related to importing boards |
High EPSS 24.22% |
>= 9.11.0-rc1+incompatible, < 9.11.8+incompatible>= 10.2.0-rc1+incompatible, < 10.2.3+incompatible>= 10.3.0-rc1+incompatible, < 10.3.3+incompatible>= 10.4.0-rc1+incompatible, < 10.4.2+incompatible | 9.11.8+incompatible10.2.3+incompatible10.3.3+incompatible10.4.2+incompatible |
| GO-2025-3481 Mattermost fails to restrict channel export of archived channels |
Medium EPSS 0.29% |
>= 9.11.0-rc1+incompatible, < 9.11.8+incompatible>= 10.2.0-rc1+incompatible, < 10.2.3+incompatible>= 10.3.0-rc1+incompatible, < 10.3.3+incompatible>= 10.4.0-rc1+incompatible, < 10.4.2+incompatible | 9.11.8+incompatible10.2.3+incompatible10.3.3+incompatible10.4.2+incompatible |
| GO-2025-3483 Mattermost allows reading arbitrary files |
Medium EPSS 0.61% |
>= 9.11.0-rc1+incompatible, < 9.11.8+incompatible>= 10.2.0-rc1+incompatible, < 10.2.3+incompatible>= 10.3.0-rc1+incompatible, < 10.3.3+incompatible>= 10.4.0-rc1+incompatible, < 10.4.2+incompatible | 9.11.8+incompatible10.2.3+incompatible10.3.3+incompatible10.4.2+incompatible |
| GO-2025-3482 Mattermost fails to invalidate all active sessions when converting a user to a bot |
High EPSS 0.26% |
>= 9.11.0-rc1+incompatible, < 9.11.7+incompatible>= 10.4.0-rc1+incompatible, < 10.4.2+incompatible | 9.11.7+incompatible10.4.2+incompatible |
| GO-2025-3407 Mattermost webapp crash via a crafted post |
High EPSS 0.48% |
>= 9.11.0+incompatible, < 9.11.6+incompatible>= 10.0.0+incompatible, < 10.0.4+incompatible>= 10.1.0+incompatible, < 10.1.4+incompatible>= 10.2.0+incompatible, < 10.2.1+incompatible | 9.11.6+incompatible10.0.4+incompatible10.1.4+incompatible10.2.1+incompatible |
| GO-2025-3394 Mattermost fails to properly validate post props |
Medium EPSS 0.58% |
>= 9.11.0+incompatible, < 9.11.6+incompatible>= 10.0.0+incompatible, < 10.0.4+incompatible>= 10.1.0+incompatible, < 10.1.4+incompatible>= 10.2.0+incompatible, < 10.2.1+incompatible | 9.11.6+incompatible10.0.4+incompatible10.1.4+incompatible10.2.1+incompatible |
| GO-2025-3392 Mattermost fails to properly validate post props |
Medium EPSS 0.45% |
>= 9.11.0+incompatible, < 9.11.6+incompatible>= 10.0.0+incompatible, < 10.0.4+incompatible>= 10.1.0+incompatible, < 10.1.4+incompatible>= 10.2.0+incompatible, < 10.2.1+incompatible | 9.11.6+incompatible10.0.4+incompatible10.1.4+incompatible10.2.1+incompatible |
| GO-2025-3393 Mattermost Incorrect Type Conversion or Cast |
Medium EPSS 0.58% |
>= 9.11.0+incompatible, < 9.11.6+incompatible>= 10.0.0+incompatible, < 10.0.4+incompatible>= 10.1.0+incompatible, < 10.1.4+incompatible>= 10.2.0+incompatible, < 10.2.1+incompatible | 9.11.6+incompatible10.0.4+incompatible10.1.4+incompatible10.2.1+incompatible |
| GO-2025-3377 Mattermost Incorrect Authorization vulnerability |
Low EPSS 0.27% |
>= 9.11.0+incompatible | No fix yet |
| GO-2025-3380 Mattermost has Improper Check for Unusual or Exceptional Conditions |
Medium EPSS 0.32% |
< 10.3.0+incompatible | 10.3.0+incompatible |
| GO-2025-3379 Mattermost Improper Validation of Specified Type of Input vulnerability |
Medium EPSS 0.61% |
>= 10.0.0+incompatible, < 10.0.4+incompatible>= 10.1.0+incompatible, < 10.1.4+incompatible>= 10.2.0+incompatible, < 10.2.1+incompatible | 10.0.4+incompatible10.1.4+incompatible10.2.1+incompatible |
| GO-2024-3340 Mattermost Data Amplification vulnerability |
Medium EPSS 0.44% |
>= 9.5.0+incompatible, < 9.5.13+incompatible>= 9.11.0+incompatible, < 9.11.5+incompatible>= 10.0.0+incompatible, < 10.0.3+incompatible>= 10.1.0+incompatible, < 10.1.3+incompatible | 9.5.13+incompatible9.11.5+incompatible10.0.3+incompatible10.1.3+incompatible |
| GO-2024-3337 Mattermost Improper Validation of Specified Type of Input vulnerability |
Medium EPSS 0.63% |
>= 9.5.0+incompatible, < 9.5.13+incompatible>= 9.11.0+incompatible, < 9.11.5+incompatible>= 10.0.0+incompatible, < 10.0.3+incompatible>= 10.1.0+incompatible, < 10.1.3+incompatible | 9.5.13+incompatible9.11.5+incompatible10.0.3+incompatible10.1.3+incompatible |
| GO-2024-3338 Mattermost Race Condition vulnerability |
Medium EPSS 0.26% |
>= 9.5.0+incompatible, < 9.5.13+incompatible>= 9.11.0+incompatible, < 9.11.5+incompatible>= 10.0.0+incompatible, < 10.0.3+incompatible>= 10.1.0+incompatible, < 10.1.3+incompatible | 9.5.13+incompatible9.11.5+incompatible10.0.3+incompatible10.1.3+incompatible |
| GO-2024-3234 Mattermost Server vulnerable to application crash from attacker-generated large response |
High EPSS 0.46% |
all versions | No fix yet |
| GO-2024-3233 Mattermost Server Path Traversal vulnerability that leads to Cross-Site Request Forgery |
Medium EPSS 0.16% |
all versions | No fix yet |
| GO-2024-3235 Mattermost server allows authenticated user to delete arbitrary post |
Medium EPSS 0.28% |
all versions | No fix yet |
| GO-2024-3232 Mattermost Server allows user to get private channel names |
Medium EPSS 0.29% |
all versions | No fix yet |
| GO-2024-3227 Mattermost incorrectly issues two sessions when using desktop SSO |
Low EPSS 0.38% |
all versions | No fix yet |
| GO-2024-3164 Mattermost fails to strip `embeds` from `metadata` when broadcasting `posted` events |
Medium EPSS 0.58% |
all versions | No fix yet |
| GO-2024-3089 Mattermost allows guest user with read access to upload files to a channel |
Medium EPSS 0.28% |
>= 9.5.0+incompatible, < 9.5.8+incompatible>= 9.8.0+incompatible, < 9.8.3+incompatible>= 9.9.0+incompatible, < 9.9.2+incompatible>= 9.10.0+incompatible, < 9.10.1+incompatible | 9.5.8+incompatible9.8.3+incompatible9.9.2+incompatible9.10.1+incompatible |
| GO-2024-3091 Mattermost allows user with systems manager role with read-only access to teams to perform write operations on teams |
Medium EPSS 0.34% |
>= 9.5.0+incompatible, < 9.5.8+incompatible>= 9.8.0+incompatible, < 9.8.3+incompatible>= 9.9.0+incompatible, < 9.9.2+incompatible>= 9.10.0+incompatible, < 9.10.1+incompatible | 9.5.8+incompatible9.8.3+incompatible9.9.2+incompatible9.10.1+incompatible |
| GO-2024-3090 Mattermost allows team admin user without "Add Team Members" permission to disable invite URL |
Low EPSS 0.39% |
>= 9.5.0+incompatible, < 9.5.8+incompatible>= 9.10.0+incompatible, < 9.10.1+incompatible | 9.5.8+incompatible9.10.1+incompatible |
| GO-2024-3094 Mattermost doesn't restrict which roles can promote a user as system admin |
High EPSS 0.34% |
>= 9.5.0+incompatible, < 9.5.8+incompatible>= 9.8.0+incompatible, < 9.8.3+incompatible>= 9.9.0+incompatible, < 9.9.2+incompatible>= 9.10.0+incompatible, < 9.10.1+incompatible | 9.5.8+incompatible9.8.3+incompatible9.9.2+incompatible9.10.1+incompatible |
| GO-2024-3097 Mattermost Cross-Site Request Forgery vulnerability |
High EPSS 0.20% |
>= 9.5.0+incompatible, < 9.5.8+incompatible>= 9.8.0+incompatible, < 9.8.3+incompatible>= 9.9.0+incompatible, < 9.9.2+incompatible>= 9.10.0+incompatible, < 9.10.1+incompatible | 9.5.8+incompatible9.8.3+incompatible9.9.2+incompatible9.10.1+incompatible |
| GO-2024-3096 Mattermost allows remote/synthetic users to create sessions, reset passwords |
Medium EPSS 0.26% |
>= 9.5.0+incompatible, < 9.5.8+incompatible>= 9.8.0+incompatible, < 9.8.3+incompatible>= 9.9.0+incompatible, < 9.9.2+incompatible>= 9.10.0+incompatible, < 9.10.1+incompatible | 9.5.8+incompatible9.8.3+incompatible9.9.2+incompatible9.10.1+incompatible |
| GO-2024-3093 Mattermost doesn't redact remote users' original email addresses |
Low EPSS 0.22% |
>= 9.5.0+incompatible, < 9.5.8+incompatible>= 9.8.0+incompatible, < 9.8.3+incompatible>= 9.9.0+incompatible, < 9.9.2+incompatible>= 9.10.0+incompatible, < 9.10.1+incompatible | 9.5.8+incompatible9.8.3+incompatible9.9.2+incompatible9.10.1+incompatible |
| GO-2024-3022 Mattermost allows remote actor to set arbitrary RemoteId values for synced users |
Medium EPSS 0.18% |
>= 9.5.0+incompatible, < 9.5.7+incompatible>= 9.9.0+incompatible, < 9.9.1+incompatible | 9.5.7+incompatible9.9.1+incompatible |
| GO-2024-3031 Mattermost allows a remote actor to make an arbitrary local channel read-only |
Medium EPSS 0.28% |
>= 9.5.0+incompatible, < 9.5.7+incompatible>= 9.7.0+incompatible, < 9.7.6+incompatible>= 9.8.0+incompatible, < 9.8.2+incompatible>= 9.9.0+incompatible, < 9.9.1+incompatible | 9.5.7+incompatible9.7.6+incompatible9.8.2+incompatible9.9.1+incompatible |
| GO-2024-3023 Mattermost allows remote actor to create/update/delete posts in arbitrary channels |
High EPSS 0.36% |
>= 9.5.0+incompatible, < 9.5.7+incompatible>= 9.7.0+incompatible, < 9.7.6+incompatible>= 9.8.0+incompatible, < 9.8.2+incompatible>= 9.9.0+incompatible, < 9.9.1+incompatible | 9.5.7+incompatible9.7.6+incompatible9.8.2+incompatible9.9.1+incompatible |
| GO-2024-3024 Mattermost allows a user on a remote to set their remote username prop to an arbitrary string |
Medium EPSS 0.34% |
>= 9.5.0+incompatible, < 9.5.7+incompatible>= 9.7.0+incompatible, < 9.7.6+incompatible>= 9.8.0+incompatible, < 9.8.2+incompatible>= 9.9.0+incompatible, < 9.9.1+incompatible | 9.5.7+incompatible9.7.6+incompatible9.8.2+incompatible9.9.1+incompatible |
| GHSA-vvpg-55p7-5h8w Mattermost did not properly restrict channel creation |
Medium EPSS 0.28% |
>= 9.5.0+incompatible, < 9.5.7+incompatible>= 9.9.0+incompatible, < 9.9.1+incompatible | 9.5.7+incompatible9.9.1+incompatible |
| GHSA-vvpg-55p7-5h8w Mattermost did not properly restrict channel creation |
Medium EPSS 0.28% |
>= 9.5.0, < 9.5.7 | 9.5.7 |
| GHSA-vvpg-55p7-5h8w Mattermost did not properly restrict channel creation |
Medium EPSS 0.28% |
>= 9.9.0, < 9.9.1 | 9.9.1 |
| GO-2024-3020 Mattermost allows a remote actor to permanently delete local data by abusing dangerous error handling |
High EPSS 0.46% |
>= 9.5.0+incompatible, < 9.5.7+incompatible>= 9.7.0+incompatible, < 9.7.6+incompatible>= 9.8.0+incompatible, < 9.8.2+incompatible>= 9.9.0+incompatible, < 9.9.1+incompatible | 9.5.7+incompatible9.7.6+incompatible9.8.2+incompatible9.9.1+incompatible |
| GO-2024-3092 Mattermost allows unsolicited invites to expose access to local channels |
Critical EPSS 0.36% |
>= 9.5.0+incompatible, < 9.5.7+incompatible>= 9.7.0+incompatible, < 9.7.6+incompatible>= 9.8.0+incompatible, < 9.8.1+incompatible>= 9.9.0+incompatible, < 9.9.1+incompatible | 9.5.7+incompatible9.7.6+incompatible9.8.1+incompatible9.9.1+incompatible |
| GO-2024-3028 Mattermost failed to properly validate that the channel that comes from the sync message is a shared channel |
Medium EPSS 0.34% |
>= 9.5.0+incompatible, < 9.5.7+incompatible>= 9.7.0+incompatible, < 9.7.6+incompatible>= 9.8.0+incompatible, < 9.8.2+incompatible>= 9.9.0+incompatible, < 9.9.1+incompatible | 9.5.7+incompatible9.7.6+incompatible9.8.2+incompatible9.9.1+incompatible |
| GO-2024-3025 Mattermost failed to disallow the modification of local users when syncing users in shared channels |
Medium EPSS 0.30% |
>= 9.5.0+incompatible, < 9.5.7+incompatible>= 9.7.0+incompatible, < 9.7.6+incompatible>= 9.8.0+incompatible, < 9.8.2+incompatible>= 9.9.0+incompatible, < 9.9.1+incompatible | 9.5.7+incompatible9.7.6+incompatible9.8.2+incompatible9.9.1+incompatible |
| GO-2024-3030 Mattermost failed to properly validate synced reactions |
Medium EPSS 0.28% |
>= 9.5.0+incompatible, < 9.5.7+incompatible>= 9.9.0+incompatible, < 9.9.1+incompatible | 9.5.7+incompatible9.9.1+incompatible |
| GHSA-5qx9-9ffj-5r8f Mattermost fails to fully validate role changes |
Low EPSS 0.50% |
>= 9.6.0-rc1, < 9.6.1 | 9.6.1 |
| GHSA-5qx9-9ffj-5r8f Mattermost fails to fully validate role changes |
Low EPSS 0.50% |
>= 8.1.0, < 8.1.12 | 8.1.12 |
| GHSA-5qx9-9ffj-5r8f Mattermost fails to fully validate role changes |
Low EPSS 0.50% |
>= 8.1.0+incompatible, < 8.1.12+incompatible>= 9.5.0+incompatible, < 9.5.3+incompatible>= 9.6.0-rc1+incompatible, < 9.6.1+incompatible | 8.1.12+incompatible9.5.3+incompatible9.6.1+incompatible |
| GHSA-5qx9-9ffj-5r8f Mattermost fails to fully validate role changes |
Low EPSS 0.50% |
>= 9.5.0, < 9.5.3 | 9.5.3 |
| GHSA-5fh7-7mw7-mmx5 Mattermost allows team admins to promote guests to team admins |
Low EPSS 0.50% |
>= 9.5.0, < 9.5.3 | 9.5.3 |
| GHSA-5fh7-7mw7-mmx5 Mattermost allows team admins to promote guests to team admins |
Low EPSS 0.50% |
>= 8.1.0, < 8.1.12 | 8.1.12 |
| GHSA-5fh7-7mw7-mmx5 Mattermost allows team admins to promote guests to team admins |
Low EPSS 0.50% |
>= 8.1.0+incompatible, < 8.1.12+incompatible>= 9.5.0+incompatible, < 9.5.3+incompatible | 8.1.12+incompatible9.5.3+incompatible |
| GHSA-wj37-mpq9-xrcm Mattermost fails to limit the number of active sessions |
Medium EPSS 0.61% |
>= 9.6.0-rc1, < 9.6.1 | 9.6.1 |
| GHSA-wj37-mpq9-xrcm Mattermost fails to limit the number of active sessions |
Medium EPSS 0.61% |
>= 9.5.0, < 9.5.3 | 9.5.3 |
| GHSA-wj37-mpq9-xrcm Mattermost fails to limit the number of active sessions |
Medium EPSS 0.61% |
>= 9.4.0, < 9.4.5 | 9.4.5 |
| GHSA-wj37-mpq9-xrcm Mattermost fails to limit the number of active sessions |
Medium EPSS 0.61% |
>= 8.1.0, < 8.1.12 | 8.1.12 |
| GHSA-wj37-mpq9-xrcm Mattermost fails to limit the number of active sessions |
Medium EPSS 0.61% |
>= 8.1.0+incompatible, < 8.1.12+incompatible>= 9.4.0+incompatible, < 9.4.5+incompatible>= 9.5.0+incompatible, < 9.5.3+incompatible>= 9.6.0-rc1+incompatible, < 9.6.1+incompatible | 8.1.12+incompatible9.4.5+incompatible9.5.3+incompatible9.6.1+incompatible |
| GHSA-8f99-g2pj-x8w3 Mattermost crashes web clients via a malformed custom status |
Medium EPSS 0.55% |
>= 9.5.0, < 9.5.3 | 9.5.3 |
| GHSA-8f99-g2pj-x8w3 Mattermost crashes web clients via a malformed custom status |
Medium EPSS 0.55% |
>= 8.1.0+incompatible, < 8.1.12+incompatible>= 9.4.0+incompatible, < 9.4.5+incompatible>= 9.5.0+incompatible, < 9.5.3+incompatible>= 9.6.0-rc1+incompatible, < 9.6.1+incompatible | 8.1.12+incompatible9.4.5+incompatible9.5.3+incompatible9.6.1+incompatible |
| GHSA-8f99-g2pj-x8w3 Mattermost crashes web clients via a malformed custom status |
Medium EPSS 0.55% |
>= 9.6.0-rc1, < 9.6.1 | 9.6.1 |
| GHSA-8f99-g2pj-x8w3 Mattermost crashes web clients via a malformed custom status |
Medium EPSS 0.55% |
>= 9.4.0, < 9.4.5 | 9.4.5 |
| GHSA-8f99-g2pj-x8w3 Mattermost crashes web clients via a malformed custom status |
Medium EPSS 0.55% |
>= 8.1.0, < 8.1.12 | 8.1.12 |
| GHSA-vx97-8q8q-qgq5 Mattermost's detailed error messages reveal the full file path |
Medium EPSS 0.45% |
>= 9.5.0, < 9.5.3 | 9.5.3 |
| GHSA-vx97-8q8q-qgq5 Mattermost's detailed error messages reveal the full file path |
Medium EPSS 0.45% |
>= 8.1.0+incompatible, < 8.1.12+incompatible>= 9.4.0+incompatible, < 9.4.5+incompatible>= 9.5.0+incompatible, < 9.5.3+incompatible>= 9.6.0-rc1+incompatible, < 9.6.1+incompatible | 8.1.12+incompatible9.4.5+incompatible9.5.3+incompatible9.6.1+incompatible |
| GHSA-vx97-8q8q-qgq5 Mattermost's detailed error messages reveal the full file path |
Medium EPSS 0.45% |
>= 9.6.0-rc1, < 9.6.1 | 9.6.1 |
| GHSA-vx97-8q8q-qgq5 Mattermost's detailed error messages reveal the full file path |
Medium EPSS 0.45% |
>= 9.4.0, < 9.4.5 | 9.4.5 |
| GHSA-vx97-8q8q-qgq5 Mattermost's detailed error messages reveal the full file path |
Medium EPSS 0.45% |
>= 8.1.0, < 8.1.12 | 8.1.12 |
| GHSA-p2wq-4ggp-45f3 Mattermost fails to limit the size of a request path |
Medium EPSS 0.54% |
>= 8.1.0+incompatible, < 8.1.12+incompatible>= 9.5.0+incompatible, < 9.5.3+incompatible>= 9.6.0-rc1+incompatible, < 9.6.1+incompatible | 8.1.12+incompatible9.5.3+incompatible9.6.1+incompatible |
| GHSA-p2wq-4ggp-45f3 Mattermost fails to limit the size of a request path |
Medium EPSS 0.54% |
>= 9.6.0-rc1, < 9.6.1 | 9.6.1 |
| GHSA-p2wq-4ggp-45f3 Mattermost fails to limit the size of a request path |
Medium EPSS 0.54% |
>= 9.5.0, < 9.5.3 | 9.5.3 |
| GHSA-p2wq-4ggp-45f3 Mattermost fails to limit the size of a request path |
Medium EPSS 0.54% |
>= 8.1.0, < 8.1.12 | 8.1.12 |
| GO-2024-2696 Mattermost fails to authenticate the source of certain types of post actions |
Medium EPSS 0.22% |
>= 9.3.0+incompatible, < 9.3.3+incompatible>= 9.4.0+incompatible, < 9.4.4+incompatible>= 9.5.0+incompatible, < 9.5.2+incompatible | 9.3.3+incompatible9.4.4+incompatible9.5.2+incompatible |
| GO-2024-2706 Mattermost Server Improper Access Control |
Low EPSS 0.33% |
>= 9.3.0+incompatible, < 9.3.3+incompatible>= 9.4.0+incompatible, < 9.4.4+incompatible>= 9.5.0+incompatible, < 9.5.2+incompatible | 9.3.3+incompatible9.4.4+incompatible9.5.2+incompatible |
| GO-2024-2695 Mattermost Server doesn't limit the number of user preferences |
Medium EPSS 0.56% |
>= 9.3.0+incompatible, < 9.3.3+incompatible>= 9.4.0+incompatible, < 9.4.4+incompatible>= 9.5.0+incompatible, < 9.5.2+incompatible | 9.3.3+incompatible9.4.4+incompatible9.5.2+incompatible |
| GO-2024-2707 Mattermost Server Improper Access Control |
Low EPSS 0.31% |
all versions | No fix yet |
| GHSA-qqc8-rv37-79q5 Mattermost Server Resource Exhaustion |
Medium EPSS 0.51% |
< 0.0.0-20240209181221-674f549daf0e | 0.0.0-20240209181221-674f549daf0e |
| GHSA-qqc8-rv37-79q5 Mattermost Server Resource Exhaustion |
Medium EPSS 0.51% |
< 0.0.0-20240209181221-674f549daf0e | 0.0.0-20240209181221-674f549daf0e |
| GO-2024-2594 Mattermost fails to limit the number of role names |
Medium EPSS 0.51% |
>= 9.2.0+incompatible, < 9.2.5+incompatible>= 9.3.0+incompatible, < 9.3.1+incompatible>= 9.4.0+incompatible, < 9.4.2+incompatible | 9.2.5+incompatible9.3.1+incompatible9.4.2+incompatible |
| GO-2024-2635 Mattermost incorrectly allows access individual posts |
Medium EPSS 0.37% |
>= 9.0.0+incompatible, < 9.4.0+incompatible | 9.4.0+incompatible |
| GO-2024-2588 Mattermost race condition |
Low EPSS 0.27% |
>= 9.0.0+incompatible, < 9.4.2+incompatible | 9.4.2+incompatible |
| GO-2024-2592 Mattermost allows attackers access to posts in channels they are not a member of |
Medium EPSS 0.36% |
>= 9.2.0+incompatible, < 9.2.5+incompatible>= 9.3.0+incompatible, < 9.3.1+incompatible | 9.2.5+incompatible9.3.1+incompatible |
| GO-2024-2593 Mattermost fails to check the "invite_guest" permission |
Medium EPSS 0.33% |
>= 9.2.0+incompatible, < 9.2.5+incompatible>= 9.3.0+incompatible, < 9.3.1+incompatible>= 9.4.0+incompatible, < 9.4.2+incompatible | 9.2.5+incompatible9.3.1+incompatible9.4.2+incompatible |
| GO-2024-2589 Mattermost denial of service through long emoji value |
Medium EPSS 0.68% |
>= 9.2.0+incompatible, < 9.2.5+incompatible>= 9.3.0+incompatible, < 9.3.1+incompatible | 9.2.5+incompatible9.3.1+incompatible |
| GO-2024-2590 Mattermost leaks details of AD/LDAP groups of a teams |
Medium EPSS 0.39% |
>= 9.2.0+incompatible, < 9.2.5+incompatible>= 9.3.0+incompatible, < 9.3.1+incompatible>= 9.4.0+incompatible, < 9.4.2+incompatible | 9.2.5+incompatible9.3.1+incompatible9.4.2+incompatible |
| GO-2024-2595 Mattermost fails to properly restrict the access of files attached to posts |
Medium EPSS 0.31% |
>= 9.0.0+incompatible, < 9.4.2+incompatible | 9.4.2+incompatible |
| GO-2024-2591 Mattermost post fetching without auditing in compliance export |
Medium EPSS 0.33% |
>= 9.2.0+incompatible, < 9.2.5+incompatible>= 9.3.0+incompatible, < 9.3.1+incompatible | 9.2.5+incompatible9.3.1+incompatible |
| GO-2024-2541 Mattermost vulnerable to denial of service via large number of emoji reactions |
Medium EPSS 0.52% |
>= 9.1.0+incompatible, < 9.1.5+incompatible>= 9.2.0+incompatible, < 9.2.4+incompatible | 9.1.5+incompatible9.2.4+incompatible |
| GO-2024-2566 Mattermost fails to check the required permissions |
Medium EPSS 0.31% |
>= 9.0.0+incompatible, < 9.3.0+incompatible | 9.3.0+incompatible |
| GO-2024-2444 Mattermost allows demoted guests to change group names |
Medium EPSS 0.32% |
all versions | No fix yet |
| GO-2024-2448 Mattermost notified all users in the channel when using WebSockets to respond individually |
Medium EPSS 0.46% |
< 8.1.7+incompatible | 8.1.7+incompatible |
| GO-2024-2450 Mattermost viewing archived public channels permissions vulnerability |
Medium EPSS 0.36% |
all versions | No fix yet |
| GO-2024-2446 Mattermost Cross-site Scripting vulnerability |
Medium EPSS 0.30% |
all versions | No fix yet |
| GHSA-r67m-mf7v-qp7j Mattermost password hash disclosure vulnerability |
Medium EPSS 0.51% |
< 5.3.2-0.20230825233148-f787fd63368a | 5.3.2-0.20230825233148-f787fd63368a |
| GHSA-3wq5-3f56-v5xc Mattermost vulnerable to information disclosure |
Medium EPSS 0.54% |
>= 7.7.0, < 7.7.2 | 7.7.2 |
| GHSA-3wq5-3f56-v5xc Mattermost vulnerable to information disclosure |
Medium EPSS 0.54% |
>= 1.4.1-0.20211025164829-f7a8147b825c, < 1.4.1-0.20230301145909-10be118d99a5 | 1.4.1-0.20230301145909-10be118d99a5 |
| GHSA-3wq5-3f56-v5xc Mattermost vulnerable to information disclosure |
Medium EPSS 0.54% |
>= 7.1.0, < 7.1.6 | 7.1.6 |
| GHSA-3wq5-3f56-v5xc Mattermost vulnerable to information disclosure |
Medium EPSS 0.54% |
>= 7.8.0, < 7.8.1 | 7.8.1 |
| GHSA-63f2-6959-2pxj Mattermost vulnerable to cross-site scripting (XSS) |
Medium EPSS 0.45% |
>= 7.1.0, < 7.1.6 | 7.1.6 |
| GHSA-63f2-6959-2pxj Mattermost vulnerable to cross-site scripting (XSS) |
Medium EPSS 0.45% |
>= 7.7.0, < 7.7.2 | 7.7.2 |
| GHSA-63f2-6959-2pxj Mattermost vulnerable to cross-site scripting (XSS) |
Medium EPSS 0.45% |
>= 7.8.0, < 7.8.1 | 7.8.1 |
| GHSA-8jhh-3jf2-pfwr Mattermost vulnerable to information disclosure |
Medium EPSS 0.55% |
>= 7.1.0, < 7.1.6 | 7.1.6 |
| GHSA-8jhh-3jf2-pfwr Mattermost vulnerable to information disclosure |
Medium EPSS 0.55% |
>= 3.3.0, < 7.1.6 | 7.1.6 |
| GHSA-8jhh-3jf2-pfwr Mattermost vulnerable to information disclosure |
Medium EPSS 0.55% |
>= 7.7.0, < 7.7.2 | 7.7.2 |
| GHSA-9hj7-v56g-rhf6 Mattermost fails to properly authentication inviter's permissions to private channel |
Medium EPSS 0.32% |
>= 7.7.0, < 7.7.2 | 7.7.2 |
| GHSA-9hj7-v56g-rhf6 Mattermost fails to properly authentication inviter's permissions to private channel |
Medium EPSS 0.32% |
>= 3.3.0, < 7.1.6 | 7.1.6 |
| GHSA-9hj7-v56g-rhf6 Mattermost fails to properly authentication inviter's permissions to private channel |
Medium EPSS 0.32% |
>= 7.1.0, < 7.1.6 | 7.1.6 |
| GHSA-v42f-hq78-8c5m Denial of service in Mattermost |
Medium EPSS 0.65% |
>= 7.2.0, < 7.2.1 | 7.2.1 |
| GHSA-v42f-hq78-8c5m Denial of service in Mattermost |
Medium EPSS 0.65% |
< 7.1.4 | 7.1.4 |
| GHSA-v42f-hq78-8c5m Denial of service in Mattermost |
Medium EPSS 0.65% |
>= 7.3.0, < 7.3.1 | 7.3.1 |
| GHSA-5jph-wrq7-v9hf Denial of service in Mattermost |
Medium EPSS 1.14% |
>= 7.2.0, < 7.2.1 | 7.2.1 |
| GHSA-5jph-wrq7-v9hf Denial of service in Mattermost |
Medium EPSS 1.14% |
>= 7.3.0, < 7.3.1 | 7.3.1 |
| GHSA-5jph-wrq7-v9hf Denial of service in Mattermost |
Medium EPSS 1.14% |
< 7.1.4 | 7.1.4 |
| GO-2022-0540 Mattermost users could access some sensitive information via API call |
Medium EPSS 0.83% |
all versions | No fix yet |
| GHSA-gwpf-95jc-63rv Uncontrolled Resource Consumption in Mattermost server |
Medium EPSS 0.94% |
>= 5.0.0, < 6.3.8 | 6.3.8 |
| GHSA-gwpf-95jc-63rv Uncontrolled Resource Consumption in Mattermost server |
Medium EPSS 0.94% |
>= 6.4.0, < 6.4.3 | 6.4.3 |
| GHSA-gwpf-95jc-63rv Uncontrolled Resource Consumption in Mattermost server |
Medium EPSS 0.94% |
>= 6.5.0, < 6.5.1 | 6.5.1 |
| GHSA-gwpf-95jc-63rv Uncontrolled Resource Consumption in Mattermost server |
Medium EPSS 0.94% |
>= 6.6.0, < 6.6.1 | 6.6.1 |
| GO-2023-1939 Mattermost Server Sensitive Data Exposure |
Medium EPSS 0.92% |
all versions | No fix yet |
| GHSA-5mh6-p63g-3mv5 Mattermost Server is vulnerable to a Denial of Service attack through `invite_people` command |
High EPSS 1.17% |
< 5.1.0 | 5.1.0 |
| GHSA-5mh6-p63g-3mv5 Mattermost Server is vulnerable to a Denial of Service attack through `invite_people` command |
High EPSS 1.17% |
all versions | No fix yet |
| GHSA-hxxj-8phw-74vw Mattermost Server server restarts may provide attackers with API access |
Critical EPSS 1.18% |
>= 3.7.0, < 3.7.5 | 3.7.5 |
| GHSA-m2ch-x2q7-2284 Mattermost Server allows an attacker to specify a full pathname of a log file |
High EPSS 1.39% |
< 3.7.4-0.20170404171331-0b5c0794fdcb | 3.7.4-0.20170404171331-0b5c0794fdcb |
| GHSA-m2ch-x2q7-2284 Mattermost Server allows an attacker to specify a full pathname of a log file |
High EPSS 1.39% |
all versions | No fix yet |
| GHSA-hxxj-8phw-74vw Mattermost Server server restarts may provide attackers with API access |
Critical EPSS 1.18% |
< 3.6.7-0.20170420152529-0968e4079e0a | 3.6.7-0.20170420152529-0968e4079e0a |
| GHSA-x33g-375j-jhf7 Mattermost Server has Improper Authorization for Integration Requests |
Medium EPSS 0.78% |
< 3.6.7-0.20170420152529-0968e4079e0a | 3.6.7-0.20170420152529-0968e4079e0a |
| GHSA-x33g-375j-jhf7 Mattermost Server has Improper Authorization for Integration Requests |
Medium EPSS 0.78% |
>= 3.7.0, < 3.7.5 | 3.7.5 |
| GHSA-jxc4-w54c-qv5r Mattermost Server uses weak hashing for OAuth, email verification tokens and invitations |
High EPSS 0.72% |
>= 3.8.0+incompatible, < 3.8.2+incompatible | 3.8.2+incompatible |
| GHSA-5ghq-28r7-qwfj Mattermost Server does not restrict SAML certificate path for System Administrators |
Medium EPSS 0.46% |
< 3.6.5+incompatible>= 3.7.0+incompatible, < 3.7.3+incompatible | 3.6.5+incompatible3.7.3+incompatible |
| GHSA-5ghq-28r7-qwfj Mattermost Server does not restrict SAML certificate path for System Administrators |
Medium EPSS 0.46% |
>= 3.7.0, < 3.7.3 | 3.7.3 |
| GHSA-5ghq-28r7-qwfj Mattermost Server does not restrict SAML certificate path for System Administrators |
Medium EPSS 0.46% |
< 3.6.5 | 3.6.5 |
| GHSA-jxc4-w54c-qv5r Mattermost Server uses weak hashing for OAuth, email verification tokens and invitations |
High EPSS 0.72% |
>= 3.8.0, < 3.8.2 | 3.8.2 |
| GHSA-x33g-375j-jhf7 Mattermost Server has Improper Authorization for Integration Requests |
Medium EPSS 0.78% |
>= 3.7.0+incompatible, < 3.7.5+incompatible>= 3.8.0+incompatible, < 3.8.2+incompatible | 3.7.5+incompatible3.8.2+incompatible |
| GHSA-x33g-375j-jhf7 Mattermost Server has Improper Authorization for Integration Requests |
Medium EPSS 0.78% |
>= 3.8.0, < 3.8.2 | 3.8.2 |
| GHSA-m462-mqw4-2c8m Mattermost Server has X.509 Improper Certificate Validation |
Critical EPSS 0.67% |
>= 3.7.0, < 3.7.5 | 3.7.5 |
| GHSA-m462-mqw4-2c8m Mattermost Server has X.509 Improper Certificate Validation |
Critical EPSS 0.67% |
< 3.6.7-rc1 | 3.6.7-rc1 |
| GHSA-hxxj-8phw-74vw Mattermost Server server restarts may provide attackers with API access |
Critical EPSS 1.18% |
>= 3.7.0+incompatible, < 3.7.5+incompatible>= 3.8.0+incompatible, < 3.8.2+incompatible | 3.7.5+incompatible3.8.2+incompatible |
| GHSA-hxxj-8phw-74vw Mattermost Server server restarts may provide attackers with API access |
Critical EPSS 1.18% |
>= 3.8.0, < 3.8.2 | 3.8.2 |
| GHSA-m462-mqw4-2c8m Mattermost Server has X.509 Improper Certificate Validation |
Critical EPSS 0.67% |
< 3.6.7-rc1+incompatible>= 3.7.0+incompatible, < 3.7.5+incompatible>= 3.8.0+incompatible, < 3.8.2+incompatible | 3.6.7-rc1+incompatible3.7.5+incompatible3.8.2+incompatible |
| GHSA-m462-mqw4-2c8m Mattermost Server has X.509 Improper Certificate Validation |
Critical EPSS 0.67% |
>= 3.8.0, < 3.8.2 | 3.8.2 |
| GHSA-jxc4-w54c-qv5r Mattermost Server uses weak hashing for OAuth, email verification tokens and invitations |
High EPSS 0.72% |
< 3.7.5-0.20170421192444-247cd1e51a8c | 3.7.5-0.20170421192444-247cd1e51a8c |
| GHSA-42x9-rr3c-gr59 Mattermost Server vulnerable to XSS through channel headers |
Medium EPSS 0.69% |
>= 3.10.0, < 3.10.2 | 3.10.2 |
| GHSA-fpcr-4rr5-hpcp Mattermost Server vulnerable to user account takeover when Single Sign-On OAuth2 is used |
High EPSS 0.79% |
< 3.9.2-0.20170714134023-b17fca0d5ee7 | 3.9.2-0.20170714134023-b17fca0d5ee7 |
| GHSA-42x9-rr3c-gr59 Mattermost Server vulnerable to XSS through channel headers |
Medium EPSS 0.69% |
< 3.9.2-0.20170714014920-312269ad0bd1 | 3.9.2-0.20170714014920-312269ad0bd1 |
| GHSA-fpcr-4rr5-hpcp Mattermost Server vulnerable to user account takeover when Single Sign-On OAuth2 is used |
High EPSS 0.79% |
>= 3.10.0, < 3.10.2 | 3.10.2 |
| GHSA-fpcr-4rr5-hpcp Mattermost Server vulnerable to user account takeover when Single Sign-On OAuth2 is used |
High EPSS 0.79% |
>= 3.10.0+incompatible, < 3.10.2+incompatible | 3.10.2+incompatible |
| GHSA-r6j5-fqx9-7qv9 Mattermost Server SAML implementation does not require encryption or signature verification as default |
High EPSS 0.66% |
< 3.8.1-0.20170504181128-4f074fed0d65 | 3.8.1-0.20170504181128-4f074fed0d65 |
| GHSA-r6j5-fqx9-7qv9 Mattermost Server SAML implementation does not require encryption or signature verification as default |
High EPSS 0.66% |
all versions | No fix yet |
| GHSA-g24c-fx4v-xg9w Mattermost Server has Insufficient Session Expiration when used as an OAuth 2.0 service provider |
Medium EPSS 0.78% |
< 3.9.2 | 3.9.2 |
| GHSA-g24c-fx4v-xg9w Mattermost Server has Insufficient Session Expiration when used as an OAuth 2.0 service provider |
Medium EPSS 0.78% |
>= 3.10.0, < 3.10.2 | 3.10.2 |
| GHSA-jwfv-5hwq-f97r Mattermost Server exposes team invite IDs through API endpoints |
Medium EPSS 0.93% |
< 3.10.3+incompatible>= 4.0.0+incompatible, < 4.0.4+incompatible>= 4.0.5-rc1+incompatible, < 4.1.0+incompatible | 3.10.3+incompatible4.0.4+incompatible4.1.0+incompatible |
| GHSA-g24c-fx4v-xg9w Mattermost Server has Insufficient Session Expiration when used as an OAuth 2.0 service provider |
Medium EPSS 0.78% |
< 3.9.2+incompatible>= 3.10.0+incompatible, < 3.10.2+incompatible | 3.9.2+incompatible3.10.2+incompatible |
| GHSA-c253-8hr4-r8v9 Mattermost Server exposes private team invite ID |
Medium EPSS 0.93% |
>= 4.0.0, < 4.0.4 | 4.0.4 |
| GHSA-jwfv-5hwq-f97r Mattermost Server exposes team invite IDs through API endpoints |
Medium EPSS 0.93% |
>= 4.0.5-rc1, < 4.1.0 | 4.1.0 |
| GHSA-c253-8hr4-r8v9 Mattermost Server exposes private team invite ID |
Medium EPSS 0.93% |
all versions | No fix yet |
| GHSA-42x9-rr3c-gr59 Mattermost Server vulnerable to XSS through channel headers |
Medium EPSS 0.69% |
>= 3.10.0+incompatible, < 3.10.2+incompatible | 3.10.2+incompatible |
| GHSA-jwfv-5hwq-f97r Mattermost Server exposes team invite IDs through API endpoints |
Medium EPSS 0.93% |
>= 4.0.0, < 4.0.4 | 4.0.4 |
| GHSA-jwfv-5hwq-f97r Mattermost Server exposes team invite IDs through API endpoints |
Medium EPSS 0.93% |
< 3.10.3 | 3.10.3 |
| GHSA-8pff-p3gx-w4jf Mattermost Server vulnerable to XSS via an uploaded file |
Medium EPSS 0.69% |
< 3.9.2+incompatible>= 3.10.0+incompatible, < 3.10.2+incompatible | 3.9.2+incompatible3.10.2+incompatible |
| GHSA-8pff-p3gx-w4jf Mattermost Server vulnerable to XSS via an uploaded file |
Medium EPSS 0.69% |
>= 3.10.0, < 3.10.2 | 3.10.2 |
| GHSA-8pff-p3gx-w4jf Mattermost Server vulnerable to XSS via an uploaded file |
Medium EPSS 0.69% |
< 3.9.2 | 3.9.2 |
| GHSA-8q4v-35v6-g8wr Mattermost Server is vulnerable CSV Injection |
Critical EPSS 1.30% |
< 3.10.3+incompatible>= 4.0.0+incompatible, < 4.0.3+incompatible | 3.10.3+incompatible4.0.3+incompatible |
| GHSA-8q4v-35v6-g8wr Mattermost Server is vulnerable CSV Injection |
Critical EPSS 1.30% |
>= 4.0.0, < 4.0.3 | 4.0.3 |
| GHSA-8q4v-35v6-g8wr Mattermost Server is vulnerable CSV Injection |
Critical EPSS 1.30% |
< 3.10.3 | 3.10.3 |
| GHSA-34cx-hvm4-vx7j Mattermost Server password reset email requests can be sent to attacker-provided email addresses |
Critical EPSS 1.18% |
< 3.9.1-rc1 | 3.9.1-rc1 |
| GHSA-c253-8hr4-r8v9 Mattermost Server exposes private team invite ID |
Medium EPSS 0.93% |
< 3.10.3 | 3.10.3 |
| GHSA-fcwg-45jh-5qhf Mattermost Server vulnerable to CSRF if CORS is enabled |
High EPSS 0.43% |
< 3.9.2 | 3.9.2 |
| GHSA-fcwg-45jh-5qhf Mattermost Server vulnerable to CSRF if CORS is enabled |
High EPSS 0.43% |
>= 3.10.0-rc1, < 3.10.2 | 3.10.2 |
| GHSA-fcwg-45jh-5qhf Mattermost Server vulnerable to CSRF if CORS is enabled |
High EPSS 0.43% |
< 3.9.2+incompatible>= 3.10.0+incompatible, < 3.10.2+incompatible | 3.9.2+incompatible3.10.2+incompatible |
| GHSA-34cx-hvm4-vx7j Mattermost Server password reset email requests can be sent to attacker-provided email addresses |
Critical EPSS 1.18% |
>= 3.10.0, < 3.10.1 | 3.10.1 |
| GHSA-34cx-hvm4-vx7j Mattermost Server password reset email requests can be sent to attacker-provided email addresses |
Critical EPSS 1.18% |
< 3.9.1-rc1+incompatible>= 3.10.0+incompatible, < 3.10.1+incompatible | 3.9.1-rc1+incompatible3.10.1+incompatible |
| GHSA-887v-xh2x-47cm Mattermost Server is vulnerable to XSS through display name field |
Medium EPSS 0.69% |
>= 4.2.0-rc1, < 4.2.0 | 4.2.0 |
| GHSA-h742-xx59-r9pq Mattermost Server exposes sensitive user status information via REST API version 4 endpoint |
Medium EPSS 0.93% |
< 4.0.5+incompatible>= 4.1.0+incompatible, < 4.1.1+incompatible>= 4.2.0-rc1+incompatible, < 4.2.0+incompatible | 4.0.5+incompatible4.1.1+incompatible4.2.0+incompatible |
| GHSA-v2vm-hq26-5jv6 Mattermost Server is vulnerable to SQL Injection when executing multiple POST requests |
Critical EPSS 1.11% |
>= 4.2.0-rc1, < 4.2.1 | 4.2.1 |
| GHSA-v2vm-hq26-5jv6 Mattermost Server is vulnerable to SQL Injection when executing multiple POST requests |
Critical EPSS 1.11% |
>= 4.3.0-rc1, < 4.3.0 | 4.3.0 |
| GHSA-f7c3-7vp3-44p6 Mattermost Server mishandles redirect denial action |
Medium EPSS 0.69% |
< 4.0.5 | 4.0.5 |
| GHSA-f7c3-7vp3-44p6 Mattermost Server mishandles redirect denial action |
Medium EPSS 0.69% |
>= 4.1.0, < 4.1.1 | 4.1.1 |
| GHSA-f7c3-7vp3-44p6 Mattermost Server mishandles redirect denial action |
Medium EPSS 0.69% |
>= 4.2.0-rc1, < 4.2.0 | 4.2.0 |
| GHSA-f7c3-7vp3-44p6 Mattermost Server mishandles redirect denial action |
Medium EPSS 0.69% |
< 4.0.5+incompatible>= 4.1.0+incompatible, < 4.1.1+incompatible>= 4.2.0-rc1+incompatible, < 4.2.0+incompatible | 4.0.5+incompatible4.1.1+incompatible4.2.0+incompatible |
| GHSA-v2vm-hq26-5jv6 Mattermost Server is vulnerable to SQL Injection when executing multiple POST requests |
Critical EPSS 1.11% |
< 4.1.2+incompatible>= 4.2.0-rc1+incompatible, < 4.2.1+incompatible>= 4.3.0-rc1+incompatible, < 4.3.0+incompatible | 4.1.2+incompatible4.2.1+incompatible4.3.0+incompatible |
| GHSA-vrh2-rprg-rgc6 Mattermost Server does not safeguard against phishing via error page links |
Medium EPSS 0.69% |
< 4.0.5 | 4.0.5 |
| GHSA-vrh2-rprg-rgc6 Mattermost Server does not safeguard against phishing via error page links |
Medium EPSS 0.69% |
>= 4.1.0, < 4.1.1 | 4.1.1 |
| GHSA-vrh2-rprg-rgc6 Mattermost Server does not safeguard against phishing via error page links |
Medium EPSS 0.69% |
>= 4.2.0-rc1, < 4.2.0 | 4.2.0 |
| GHSA-m497-hq5x-6jcv Mattermost Server allows attackers to create buttons that can launch API requests |
Medium EPSS 0.78% |
< 4.1.2 | 4.1.2 |
| GHSA-vrh2-rprg-rgc6 Mattermost Server does not safeguard against phishing via error page links |
Medium EPSS 0.69% |
< 4.0.5+incompatible>= 4.1.0+incompatible, < 4.1.1+incompatible>= 4.2.0-rc1+incompatible, < 4.2.0+incompatible | 4.0.5+incompatible4.1.1+incompatible4.2.0+incompatible |
| GHSA-m497-hq5x-6jcv Mattermost Server allows attackers to create buttons that can launch API requests |
Medium EPSS 0.78% |
>= 4.2.0-rc1, < 4.2.1 | 4.2.1 |
| GHSA-m497-hq5x-6jcv Mattermost Server allows attackers to create buttons that can launch API requests |
Medium EPSS 0.78% |
>= 4.3.0-rc1, < 4.3.0 | 4.3.0 |
| GHSA-gg42-mwr6-p82c Mattermost Server has intermittent Authorization bypass for resource-owners |
High EPSS 0.83% |
< 4.0.5 | 4.0.5 |
| GHSA-gg42-mwr6-p82c Mattermost Server has intermittent Authorization bypass for resource-owners |
High EPSS 0.83% |
>= 4.1.0, < 4.1.1 | 4.1.1 |
| GHSA-gg42-mwr6-p82c Mattermost Server has intermittent Authorization bypass for resource-owners |
High EPSS 0.83% |
>= 4.2.0-rc1, < 4.2.0 | 4.2.0 |
| GHSA-gg42-mwr6-p82c Mattermost Server has intermittent Authorization bypass for resource-owners |
High EPSS 0.83% |
< 4.0.5+incompatible>= 4.1.0+incompatible, < 4.1.1+incompatible>= 4.2.0-rc1+incompatible, < 4.2.0+incompatible | 4.0.5+incompatible4.1.1+incompatible4.2.0+incompatible |
| GHSA-wj5w-qghh-gvqp Mattermost Server does not neutralize HTML content in an Email template field |
Medium EPSS 0.69% |
< 4.0.5 | 4.0.5 |
| GHSA-wj5w-qghh-gvqp Mattermost Server does not neutralize HTML content in an Email template field |
Medium EPSS 0.69% |
>= 4.1.0, < 4.1.1 | 4.1.1 |
| GHSA-wj5w-qghh-gvqp Mattermost Server does not neutralize HTML content in an Email template field |
Medium EPSS 0.69% |
>= 4.2.0-rc1, < 4.2.0 | 4.2.0 |
| GHSA-wj5w-qghh-gvqp Mattermost Server does not neutralize HTML content in an Email template field |
Medium EPSS 0.69% |
< 4.0.5+incompatible>= 4.1.0+incompatible, < 4.1.1+incompatible>= 4.2.0-rc1+incompatible, < 4.2.0+incompatible | 4.0.5+incompatible4.1.1+incompatible4.2.0+incompatible |
| GHSA-9589-mq83-f749 Mattermost Server is vulnerable to DoS through maliciously crafted posts |
Medium EPSS 1.11% |
< 4.0.5+incompatible>= 4.1.0+incompatible, < 4.1.1+incompatible>= 4.2.0-rc1+incompatible, < 4.2.0+incompatible | 4.0.5+incompatible4.1.1+incompatible4.2.0+incompatible |
| GHSA-9589-mq83-f749 Mattermost Server is vulnerable to DoS through maliciously crafted posts |
Medium EPSS 1.11% |
>= 4.2.0-rc1, < 4.2.0 | 4.2.0 |
| GHSA-9589-mq83-f749 Mattermost Server is vulnerable to DoS through maliciously crafted posts |
Medium EPSS 1.11% |
>= 4.1.0, < 4.1.1 | 4.1.1 |
| GHSA-9589-mq83-f749 Mattermost Server is vulnerable to DoS through maliciously crafted posts |
Medium EPSS 1.11% |
< 4.0.5 | 4.0.5 |
| GHSA-887v-xh2x-47cm Mattermost Server is vulnerable to XSS through display name field |
Medium EPSS 0.69% |
< 4.0.5+incompatible>= 4.1.0+incompatible, < 4.1.1+incompatible>= 4.2.0-rc1+incompatible, < 4.2.0+incompatible | 4.0.5+incompatible4.1.1+incompatible4.2.0+incompatible |
| GHSA-887v-xh2x-47cm Mattermost Server is vulnerable to XSS through display name field |
Medium EPSS 0.69% |
>= 4.1.0, < 4.1.1 | 4.1.1 |
| GHSA-887v-xh2x-47cm Mattermost Server is vulnerable to XSS through display name field |
Medium EPSS 0.69% |
< 4.0.5 | 4.0.5 |
| GHSA-m497-hq5x-6jcv Mattermost Server allows attackers to create buttons that can launch API requests |
Medium EPSS 0.78% |
< 4.1.2+incompatible>= 4.2.0-rc1+incompatible, < 4.2.1+incompatible>= 4.3.0-rc1+incompatible, < 4.3.0+incompatible | 4.1.2+incompatible4.2.1+incompatible4.3.0+incompatible |
| GHSA-v2vm-hq26-5jv6 Mattermost Server is vulnerable to SQL Injection when executing multiple POST requests |
Critical EPSS 1.11% |
< 4.1.2 | 4.1.2 |
| GHSA-63wg-qmrv-7q66 Mattermost Server allows attackers to log sensitive information via DEBUG REST API logging endpoint |
Medium EPSS 0.78% |
< 4.0.5+incompatible>= 4.1.0+incompatible, < 4.1.1+incompatible>= 4.2.0-rc1+incompatible, < 4.2.0+incompatible | 4.0.5+incompatible4.1.1+incompatible4.2.0+incompatible |
| GHSA-63wg-qmrv-7q66 Mattermost Server allows attackers to log sensitive information via DEBUG REST API logging endpoint |
Medium EPSS 0.78% |
>= 4.2.0-rc1, < 4.2.0 | 4.2.0 |
| GHSA-63wg-qmrv-7q66 Mattermost Server allows attackers to log sensitive information via DEBUG REST API logging endpoint |
Medium EPSS 0.78% |
< 4.0.5 | 4.0.5 |
| GHSA-63wg-qmrv-7q66 Mattermost Server allows attackers to log sensitive information via DEBUG REST API logging endpoint |
Medium EPSS 0.78% |
>= 4.1.0, < 4.1.1 | 4.1.1 |
| GHSA-h742-xx59-r9pq Mattermost Server exposes sensitive user status information via REST API version 4 endpoint |
Medium EPSS 0.93% |
< 4.0.5 | 4.0.5 |
| GHSA-h742-xx59-r9pq Mattermost Server exposes sensitive user status information via REST API version 4 endpoint |
Medium EPSS 0.93% |
>= 4.1.0, < 4.1.1 | 4.1.1 |
| GHSA-h742-xx59-r9pq Mattermost Server exposes sensitive user status information via REST API version 4 endpoint |
Medium EPSS 0.93% |
>= 4.2.0-rc1, < 4.2.0 | 4.2.0 |
| GHSA-g78f-6xq7-rrhq Mattermost Server allows attackers to gain privileges by accessing unintended API endpoints with users' credentials |
Critical EPSS 1.18% |
>= 4.2.0-rc1, < 4.2.1 | 4.2.1 |
| GHSA-g78f-6xq7-rrhq Mattermost Server allows attackers to gain privileges by accessing unintended API endpoints with users' credentials |
Critical EPSS 1.18% |
< 4.1.2 | 4.1.2 |
| GHSA-g78f-6xq7-rrhq Mattermost Server allows attackers to gain privileges by accessing unintended API endpoints with users' credentials |
Critical EPSS 1.18% |
>= 4.3.0-rc1, < 4.3.0 | 4.3.0 |
| GHSA-g78f-6xq7-rrhq Mattermost Server allows attackers to gain privileges by accessing unintended API endpoints with users' credentials |
Critical EPSS 1.18% |
< 4.1.2+incompatible>= 4.2.0-rc1+incompatible, < 4.2.1+incompatible>= 4.3.0-rc1+incompatible, < 4.3.0+incompatible | 4.1.2+incompatible4.2.1+incompatible4.3.0+incompatible |
| GHSA-876j-jfqf-m7j7 Mattermost Server exposes OAuth personal access tokens to attackers |
Critical EPSS 0.81% |
< 4.1.2+incompatible>= 4.2.0-rc1+incompatible, < 4.2.1+incompatible>= 4.3.0-rc1+incompatible, < 4.3.0+incompatible | 4.1.2+incompatible4.2.1+incompatible4.3.0+incompatible |
| GHSA-876j-jfqf-m7j7 Mattermost Server exposes OAuth personal access tokens to attackers |
Critical EPSS 0.81% |
>= 4.3.0-rc1, < 4.3.0 | 4.3.0 |
| GHSA-876j-jfqf-m7j7 Mattermost Server exposes OAuth personal access tokens to attackers |
Critical EPSS 0.81% |
>= 4.2.0-rc1, < 4.2.1 | 4.2.1 |
| GHSA-876j-jfqf-m7j7 Mattermost Server exposes OAuth personal access tokens to attackers |
Critical EPSS 0.81% |
< 4.1.2 | 4.1.2 |
| GHSA-jp57-4x34-5v94 Mattermost Server is vulnerable to webhook and slash command manipulation |
Medium EPSS 0.67% |
< 4.1.2 | 4.1.2 |
| GHSA-jp57-4x34-5v94 Mattermost Server is vulnerable to webhook and slash command manipulation |
Medium EPSS 0.67% |
>= 4.2.0-rc1, < 4.2.1 | 4.2.1 |
| GHSA-jp57-4x34-5v94 Mattermost Server is vulnerable to webhook and slash command manipulation |
Medium EPSS 0.67% |
>= 4.3.0-rc1, < 4.3.0 | 4.3.0 |
| GHSA-jp57-4x34-5v94 Mattermost Server is vulnerable to webhook and slash command manipulation |
Medium EPSS 0.67% |
< 4.1.2+incompatible>= 4.2.0-rc1+incompatible, < 4.2.1+incompatible>= 4.3.0-rc1+incompatible, < 4.3.0+incompatible | 4.1.2+incompatible4.2.1+incompatible4.3.0+incompatible |
| GHSA-wvjg-33p9-938h Mattermost Server does not properly restrict use of slash commands |
High EPSS 0.95% |
< 4.1.2+incompatible>= 4.2.0-rc1+incompatible, < 4.2.1+incompatible>= 4.3.0-rc1+incompatible, < 4.3.0+incompatible | 4.1.2+incompatible4.2.1+incompatible4.3.0+incompatible |
| GHSA-wvjg-33p9-938h Mattermost Server does not properly restrict use of slash commands |
High EPSS 0.95% |
>= 4.3.0-rc1, < 4.3.0 | 4.3.0 |
| GHSA-wvjg-33p9-938h Mattermost Server does not properly restrict use of slash commands |
High EPSS 0.95% |
>= 4.2.0-rc1, < 4.2.1 | 4.2.1 |
| GHSA-wvjg-33p9-938h Mattermost Server does not properly restrict use of slash commands |
High EPSS 0.95% |
< 4.1.2 | 4.1.2 |
| GHSA-498j-wxww-j897 Mattermost Server is vulnerable to XSS through author_link field in Slack attachments |
Medium EPSS 0.69% |
< 4.1.2 | 4.1.2 |
| GHSA-w8cc-3h7q-jhc3 Mattermost Server has low entropy for authorization data as an OAuth 2.0 Service Provider |
Medium EPSS 1.13% |
>= 4.3.0-rc1, < 4.3.0 | 4.3.0 |
| GHSA-w8cc-3h7q-jhc3 Mattermost Server has low entropy for authorization data as an OAuth 2.0 Service Provider |
Medium EPSS 1.13% |
>= 4.2.0-rc1, < 4.2.1 | 4.2.1 |
| GHSA-w8cc-3h7q-jhc3 Mattermost Server has low entropy for authorization data as an OAuth 2.0 Service Provider |
Medium EPSS 1.13% |
< 4.1.2 | 4.1.2 |
| GHSA-498j-wxww-j897 Mattermost Server is vulnerable to XSS through author_link field in Slack attachments |
Medium EPSS 0.69% |
>= 4.2.0, < 4.2.1 | 4.2.1 |
| GHSA-498j-wxww-j897 Mattermost Server is vulnerable to XSS through author_link field in Slack attachments |
Medium EPSS 0.69% |
< 4.1.2+incompatible>= 4.2.0+incompatible, < 4.2.1+incompatible>= 4.3.0-rc1+incompatible, < 4.3.0+incompatible | 4.1.2+incompatible4.2.1+incompatible4.3.0+incompatible |
| GHSA-9x8x-w6g5-hx4w Mattermost Server is vulnerable to XSS attacks against an OAuth 2.0 allow/deny page |
Medium EPSS 0.69% |
>= 4.2.0, < 4.2.1 | 4.2.1 |
| GHSA-9x8x-w6g5-hx4w Mattermost Server is vulnerable to XSS attacks against an OAuth 2.0 allow/deny page |
Medium EPSS 0.69% |
< 4.1.2+incompatible>= 4.2.0+incompatible, < 4.2.1+incompatible>= 4.3.0-rc1+incompatible, < 4.3.0+incompatible | 4.1.2+incompatible4.2.1+incompatible4.3.0+incompatible |
| GHSA-9x8x-w6g5-hx4w Mattermost Server is vulnerable to XSS attacks against an OAuth 2.0 allow/deny page |
Medium EPSS 0.69% |
>= 4.3.0-rc1, < 4.3.0 | 4.3.0 |
| GHSA-hjqh-j6rj-gh8q Mattermost Server is vulnerable to Path Traversal when files are stored locally |
Medium EPSS 0.87% |
>= 4.3.0-rc1+incompatible, < 4.3.0+incompatible | 4.3.0+incompatible |
| GHSA-hjqh-j6rj-gh8q Mattermost Server is vulnerable to Path Traversal when files are stored locally |
Medium EPSS 0.87% |
>= 4.3.0-rc1, < 4.3.0 | 4.3.0 |
| GHSA-hjqh-j6rj-gh8q Mattermost Server is vulnerable to Path Traversal when files are stored locally |
Medium EPSS 0.87% |
>= 4.2.0-rc1.0.20171004154238-fadd9514f6e7, < 4.2.1-0.20171004194140-6d3cb2ce07fc | 4.2.1-0.20171004194140-6d3cb2ce07fc |
| GHSA-35c4-5qfp-wxj6 Mattermost Server exposes team creator's e-mail address to other members |
Medium EPSS 0.93% |
< 4.1.2 | 4.1.2 |
| GHSA-9x8x-w6g5-hx4w Mattermost Server is vulnerable to XSS attacks against an OAuth 2.0 allow/deny page |
Medium EPSS 0.69% |
< 4.1.2 | 4.1.2 |
| GHSA-x6mw-hf2j-vqpc Mattermost Server is vulnerable to channel invisibility DoS via misformatted post |
Medium EPSS 1.11% |
< 4.1.2-0.20171013141717-ee57a5829ab1+incompatible>= 4.2.0+incompatible, < 4.2.1-0.20171013140502-b3e4b0ac9168+incompatible>= 4.3.0-rc1+incompatible, < 4.3.0+incompatible | 4.1.2-0.20171013141717-ee57a5829ab1+incompatible4.2.1-0.20171013140502-b3e4b0ac9168+incompatible4.3.0+incompatible |
| GHSA-x6mw-hf2j-vqpc Mattermost Server is vulnerable to channel invisibility DoS via misformatted post |
Medium EPSS 1.11% |
>= 4.3.0-rc1, < 4.3.0 | 4.3.0 |
| GHSA-x6mw-hf2j-vqpc Mattermost Server is vulnerable to channel invisibility DoS via misformatted post |
Medium EPSS 1.11% |
>= 4.2.0, < 4.2.1-0.20171013140502-b3e4b0ac9168 | 4.2.1-0.20171013140502-b3e4b0ac9168 |
| GHSA-x6mw-hf2j-vqpc Mattermost Server is vulnerable to channel invisibility DoS via misformatted post |
Medium EPSS 1.11% |
< 4.1.2-0.20171013141717-ee57a5829ab1 | 4.1.2-0.20171013141717-ee57a5829ab1 |
| GHSA-35c4-5qfp-wxj6 Mattermost Server exposes team creator's e-mail address to other members |
Medium EPSS 0.93% |
>= 4.2.0-rc1, < 4.2.1 | 4.2.1 |
| GHSA-35c4-5qfp-wxj6 Mattermost Server exposes team creator's e-mail address to other members |
Medium EPSS 0.93% |
>= 4.3.0-rc1, < 4.3.0 | 4.3.0 |
| GHSA-35c4-5qfp-wxj6 Mattermost Server exposes team creator's e-mail address to other members |
Medium EPSS 0.93% |
< 4.1.2+incompatible>= 4.2.0-rc1+incompatible, < 4.2.1+incompatible>= 4.3.0-rc1+incompatible, < 4.3.0+incompatible | 4.1.2+incompatible4.2.1+incompatible4.3.0+incompatible |
| GHSA-hjqh-j6rj-gh8q Mattermost Server is vulnerable to Path Traversal when files are stored locally |
Medium EPSS 0.87% |
< 4.1.2-0.20171004201910-6be8113eb60c | 4.1.2-0.20171004201910-6be8113eb60c |
| GHSA-9rr5-q43r-ccv4 Mattermost Server does not prevent System Admin from arbitrary file creation |
Medium EPSS 0.73% |
< 4.1.2-0.20171004201910-6be8113eb60c | 4.1.2-0.20171004201910-6be8113eb60c |
| GHSA-h564-6gc2-fcc6 Mattermost Server allows users with a session ID to revoke another users' session |
Medium EPSS 0.78% |
>= 4.3.0-rc1+incompatible, < 4.3.0+incompatible | 4.3.0+incompatible |
| GHSA-h564-6gc2-fcc6 Mattermost Server allows users with a session ID to revoke another users' session |
Medium EPSS 0.78% |
>= 4.3.0-rc1, < 4.3.0 | 4.3.0 |
| GHSA-9rr5-q43r-ccv4 Mattermost Server does not prevent System Admin from arbitrary file creation |
Medium EPSS 0.73% |
>= 4.2.0-rc1.0.20171004154238-fadd9514f6e7, < 4.2.1-0.20171004194140-6d3cb2ce07fc | 4.2.1-0.20171004194140-6d3cb2ce07fc |
| GHSA-9rr5-q43r-ccv4 Mattermost Server does not prevent System Admin from arbitrary file creation |
Medium EPSS 0.73% |
>= 4.3.0-rc1, < 4.3.0 | 4.3.0 |
| GHSA-9rr5-q43r-ccv4 Mattermost Server does not prevent System Admin from arbitrary file creation |
Medium EPSS 0.73% |
>= 4.3.0-rc1+incompatible, < 4.3.0+incompatible | 4.3.0+incompatible |
| GHSA-h564-6gc2-fcc6 Mattermost Server allows users with a session ID to revoke another users' session |
Medium EPSS 0.78% |
>= 4.2.0-rc1, < 4.2.1-0.20171004192657-8fbbd688ea24 | 4.2.1-0.20171004192657-8fbbd688ea24 |
| GHSA-h564-6gc2-fcc6 Mattermost Server allows users with a session ID to revoke another users' session |
Medium EPSS 0.78% |
< 4.1.2-0.20171004201910-6be8113eb60c | 4.1.2-0.20171004201910-6be8113eb60c |
| GHSA-w8cc-3h7q-jhc3 Mattermost Server has low entropy for authorization data as an OAuth 2.0 Service Provider |
Medium EPSS 1.13% |
< 4.1.2+incompatible>= 4.2.0-rc1+incompatible, < 4.2.1+incompatible>= 4.3.0-rc1+incompatible, < 4.3.0+incompatible | 4.1.2+incompatible4.2.1+incompatible4.3.0+incompatible |
| GHSA-498j-wxww-j897 Mattermost Server is vulnerable to XSS through author_link field in Slack attachments |
Medium EPSS 0.69% |
>= 4.3.0-rc1, < 4.3.0 | 4.3.0 |
| GHSA-g3f3-p9rc-775p Mattermost Server exposes account details to any Team Administrator |
Medium EPSS 0.66% |
< 3.0.0+incompatible | 3.0.0+incompatible |
| GHSA-g3f3-p9rc-775p Mattermost Server exposes account details to any Team Administrator |
Medium EPSS 0.66% |
< 3.0.0 | 3.0.0 |
| GHSA-hgrp-fgm8-56g8 Mattermost Server's OAuth 2.0 service is vulnerable to attack through Missing Authorization |
Medium EPSS 0.57% |
>= 4.4.0-rc1, < 4.4.3 | 4.4.3 |
| GHSA-vw57-55f8-c73q Mattermost Server allows XSS via CSRF |
Medium EPSS 0.34% |
< 2.1.0+incompatible | 2.1.0+incompatible |
| GHSA-vw57-55f8-c73q Mattermost Server allows XSS via CSRF |
Medium EPSS 0.34% |
< 2.1.0 | 2.1.0 |
| GHSA-hgrp-fgm8-56g8 Mattermost Server's OAuth 2.0 service is vulnerable to attack through Missing Authorization |
Medium EPSS 0.57% |
< 4.3.3 | 4.3.3 |
| GHSA-2j9c-76pp-xc5q Mattermost Server allows XSS via redirect URL |
Medium EPSS 0.69% |
< 3.0.0+incompatible | 3.0.0+incompatible |
| GHSA-m78r-2x6w-qqjp Mattermost Server is vulnerable to XSS through crafted links |
Medium EPSS 0.69% |
< 2.2.0 | 2.2.0 |
| GHSA-m78r-2x6w-qqjp Mattermost Server is vulnerable to XSS through crafted links |
Medium EPSS 0.69% |
< 2.2.0+incompatible | 2.2.0+incompatible |
| GHSA-hgrp-fgm8-56g8 Mattermost Server's OAuth 2.0 service is vulnerable to attack through Missing Authorization |
Medium EPSS 0.57% |
< 4.3.3+incompatible>= 4.4.0-rc1+incompatible, < 4.4.3+incompatible | 4.3.3+incompatible4.4.3+incompatible |
| GHSA-mj8v-773w-5qhj Mattermost Server allows System Admin to modify LDAP account names and email addresses |
Low EPSS 0.63% |
< 3.0.0 | 3.0.0 |
| GHSA-rm24-25xm-9454 Mattermost Server: Files may be rendered inline instead of downloaded, allowing script execution |
Medium EPSS 0.69% |
< 2.2.0+incompatible | 2.2.0+incompatible |
| GHSA-rm24-25xm-9454 Mattermost Server: Files may be rendered inline instead of downloaded, allowing script execution |
Medium EPSS 0.69% |
< 2.2.0 | 2.2.0 |
| GHSA-2j9c-76pp-xc5q Mattermost Server allows XSS via redirect URL |
Medium EPSS 0.69% |
< 3.0.0 | 3.0.0 |
| GHSA-8qg8-c7mw-6fj7 Mattermost Server is vulnerable to Directory Traversal by System Admins |
Medium EPSS 1.24% |
< 4.1.2-0.20171004201910-6be8113eb60 | 4.1.2-0.20171004201910-6be8113eb60 |
| GHSA-5q37-9874-qxcw Mattermost Server exposes information stored by a web browser |
Medium EPSS 0.75% |
< 2.2.0 | 2.2.0 |
| GHSA-5q37-9874-qxcw Mattermost Server exposes information stored by a web browser |
Medium EPSS 0.75% |
< 2.2.0+incompatible | 2.2.0+incompatible |
| GHSA-8qg8-c7mw-6fj7 Mattermost Server is vulnerable to Directory Traversal by System Admins |
Medium EPSS 1.24% |
>= 4.2.0-rc1, < 4.2.1-0.20171004194140-6d3cb2ce07fc | 4.2.1-0.20171004194140-6d3cb2ce07fc |
| GHSA-jc6w-8r7f-vmp5 Mattermost Server vulnerable to Denial of Service through `@` character prefix inserted into JavaScript field names |
High EPSS 1.12% |
< 4.2.2 | 4.2.2 |
| GHSA-jc6w-8r7f-vmp5 Mattermost Server vulnerable to Denial of Service through `@` character prefix inserted into JavaScript field names |
High EPSS 1.12% |
>= 4.3.0-rc1, < 4.3.4 | 4.3.4 |
| GHSA-mj8v-773w-5qhj Mattermost Server allows System Admin to modify LDAP account names and email addresses |
Low EPSS 0.63% |
< 3.0.0+incompatible | 3.0.0+incompatible |
| GHSA-jc6w-8r7f-vmp5 Mattermost Server vulnerable to Denial of Service through `@` character prefix inserted into JavaScript field names |
High EPSS 1.12% |
>= 4.4.0-rc1, < 4.4.5 | 4.4.5 |
| GHSA-jc6w-8r7f-vmp5 Mattermost Server vulnerable to Denial of Service through `@` character prefix inserted into JavaScript field names |
High EPSS 1.12% |
>= 4.5.0-rc1, < 4.5.0 | 4.5.0 |
| GHSA-jc6w-8r7f-vmp5 Mattermost Server vulnerable to Denial of Service through `@` character prefix inserted into JavaScript field names |
High EPSS 1.12% |
< 4.2.2+incompatible>= 4.3.0-rc1+incompatible, < 4.3.4+incompatible>= 4.4.0-rc1+incompatible, < 4.4.5+incompatible>= 4.5.0-rc1+incompatible, < 4.5.0+incompatible | 4.2.2+incompatible4.3.4+incompatible4.4.5+incompatible4.5.0+incompatible |
| GHSA-8qg8-c7mw-6fj7 Mattermost Server is vulnerable to Directory Traversal by System Admins |
Medium EPSS 1.24% |
>= 4.3.0-rc1, < 4.3.0 | 4.3.0 |
| GHSA-8qg8-c7mw-6fj7 Mattermost Server is vulnerable to Directory Traversal by System Admins |
Medium EPSS 1.24% |
>= 4.2.0-rc1+incompatible, < 4.2.0+incompatible>= 4.3.0-rc1+incompatible, < 4.3.0+incompatible | 4.2.0+incompatible4.3.0+incompatible |
| GHSA-379p-37xc-q963 Mattermost Server does not check if cookies are used over SSL |
High EPSS 0.88% |
< 3.0.0 | 3.0.0 |
| GHSA-379p-37xc-q963 Mattermost Server does not check if cookies are used over SSL |
High EPSS 0.88% |
< 3.0.0+incompatible | 3.0.0+incompatible |
| GHSA-j26g-95ph-2mwv Mattermost Server: Insufficient Password-Reset Link Invalidation |
High EPSS 1.18% |
< 3.0.0 | 3.0.0 |
| GHSA-j26g-95ph-2mwv Mattermost Server: Insufficient Password-Reset Link Invalidation |
High EPSS 1.18% |
< 3.0.0+incompatible | 3.0.0+incompatible |
| GHSA-43m6-wvc8-2m7j Mattermost Server's Session ID and Session Token are potentially compromised |
Medium EPSS 0.73% |
< 3.0.2 | 3.0.2 |
| GHSA-43m6-wvc8-2m7j Mattermost Server's Session ID and Session Token are potentially compromised |
Medium EPSS 0.73% |
< 3.0.2+incompatible | 3.0.2+incompatible |
| GHSA-7vmw-6c7h-rrrv Mattermost Server is vulnerable to Code Injection through its LDAP fields |
Medium EPSS 0.93% |
< 3.2.0 | 3.2.0 |
| GHSA-7vmw-6c7h-rrrv Mattermost Server is vulnerable to Code Injection through its LDAP fields |
Medium EPSS 0.93% |
< 3.2.0+incompatible | 3.2.0+incompatible |
| GHSA-9jrx-fgrm-96qh Mattermost Server is vulnerable to XSS via a Legal or Support setting |
Medium EPSS 0.69% |
< 3.0.0 | 3.0.0 |
| GHSA-9jrx-fgrm-96qh Mattermost Server is vulnerable to XSS via a Legal or Support setting |
Medium EPSS 0.69% |
< 3.0.0+incompatible | 3.0.0+incompatible |
| GHSA-9w4v-9c99-hv7r Mattermost Server exposes sensitive information via its System Console UI |
Medium EPSS 0.94% |
< 3.0.0 | 3.0.0 |
| GHSA-h3qg-w9j5-wh3m Mattermost Server is vulnerable to XSS through lack of link relationship attributes `noreferrer` and `noopener` |
Medium EPSS 0.69% |
< 3.1.0+incompatible | 3.1.0+incompatible |
| GHSA-h3qg-w9j5-wh3m Mattermost Server is vulnerable to XSS through lack of link relationship attributes `noreferrer` and `noopener` |
Medium EPSS 0.69% |
< 3.1.0 | 3.1.0 |
| GHSA-9w4v-9c99-hv7r Mattermost Server exposes sensitive information via its System Console UI |
Medium EPSS 0.94% |
< 3.0.0+incompatible | 3.0.0+incompatible |
| GHSA-ffcc-qr2v-3qmv Mattermost Server is vulnerable to Uncontrolled Resource Consumption |
Medium EPSS 1.11% |
< 3.2.0+incompatible | 3.2.0+incompatible |
| GHSA-ffcc-qr2v-3qmv Mattermost Server is vulnerable to Uncontrolled Resource Consumption |
Medium EPSS 1.11% |
< 3.2.0 | 3.2.0 |
| GHSA-r93j-3mmp-px57 Mattermost Server: initial_load API exposes unnecessary information |
High EPSS 1.15% |
all versions | No fix yet |
| GHSA-r93j-3mmp-px57 Mattermost Server: initial_load API exposes unnecessary information |
High EPSS 1.15% |
< 3.1.1 | 3.1.1 |
| GHSA-qrf6-h5fc-7m96 Mattermost Server does not enforce rate limits on password change attempts |
High EPSS 0.90% |
< 3.2.0+incompatible | 3.2.0+incompatible |
| GHSA-qrf6-h5fc-7m96 Mattermost Server does not enforce rate limits on password change attempts |
High EPSS 0.90% |
< 3.2.0 | 3.2.0 |
| GHSA-q3g9-hgrx-hwhx Mattermost Server exposes sensitive information about team URLs via an API |
Medium EPSS 0.93% |
all versions | No fix yet |
| GHSA-q3g9-hgrx-hwhx Mattermost Server exposes sensitive information about team URLs via an API |
Medium EPSS 0.93% |
< 2.0.1-0.20160310160916-26ad6d2c7696 | 2.0.1-0.20160310160916-26ad6d2c7696 |
| GHSA-h8qw-xqm9-q66j Mattermost Server is vulnerable to XSS through customizable theme color-code values |
Medium EPSS 0.56% |
< 3.1.0 | 3.1.0 |
| GHSA-h8qw-xqm9-q66j Mattermost Server is vulnerable to XSS through customizable theme color-code values |
Medium EPSS 0.56% |
< 3.1.0+incompatible | 3.1.0+incompatible |
| GHSA-cffj-7w5c-jqjh Mattermost Server vulnerable to Cross-site Scripting through file preview feature |
Medium EPSS 0.69% |
< 3.5.1 | 3.5.1 |
| GHSA-cffj-7w5c-jqjh Mattermost Server vulnerable to Cross-site Scripting through file preview feature |
Medium EPSS 0.69% |
< 3.5.1+incompatible | 3.5.1+incompatible |
| GO-2022-0599 Improper Control of a Resource Through its Lifetime in Mattermost |
Medium EPSS 0.84% |
all versions | No fix yet |
| GO-2022-0576 Insecure plugin handling in Mattermost |
High EPSS 0.68% |
all versions | No fix yet |
| GO-2022-0595 Resource exhaustion in Mattermost |
Medium EPSS 0.92% |
all versions | No fix yet |
| GO-2022-0616 Improper Privilege Management in Mattermost |
Medium EPSS 0.65% |
all versions | No fix yet |
| GO-2022-0604 Cross-site Scripting in Mattermost |
Medium EPSS 0.63% |
all versions | No fix yet |
MergeHarbor checks every repository's dependencies against this database, ranks what matters by exploitability and reachability, routes it to the owning team and opens the fix pull request.
Check your repos with MergeHarbor