github.com/mattermost/mattermost-server/v5 (Go)
Advisories
212
Latest version
—
License
—
OpenSSF Scorecard
—
How to fix
Upgrading to 7.1.6 or later clears every advisory below that has a fix.
Upgrade commands
go
go get github.com/mattermost/mattermost-server/v5@v7.1.6 && go mod tidyKnown vulnerabilities
| Advisory | Severity | Affected | Fixed in |
|---|---|---|---|
| GHSA-xmfh-3ccg-c9fx Mattermost has an Incorrect Authorization issue |
Low EPSS 0.32% |
all versions | No fix yet |
| GHSA-6hxm-w4hv-vgvw Mattermost doesn't require role-management authorization when setting the scheme_admin flag on group syncable link and patch endpoints |
High EPSS 0.31% |
all versions | No fix yet |
| GHSA-9p44-r552-4wp9 Mattermost doesn't sanitize the Remote Cluster API response on PATCH operations |
Medium EPSS 0.26% |
all versions | No fix yet |
| GHSA-8qq9-cqj8-82w4 Mattermost doesn't sanitize FileInfo.Name received from federated peers during shared channel file sync |
High EPSS 0.30% |
all versions | No fix yet |
| GHSA-m2w9-h2mm-79qr Mattermost doesn't require system-level permission when patching protected default system roles |
High EPSS 0.26% |
all versions | No fix yet |
| GHSA-c28q-m4gf-vg4q Mattermost doesn't enforce PermissionInviteUser when setting AllowOpenInvite or AllowedDomains during team creation |
Medium EPSS 0.15% |
all versions | No fix yet |
| GHSA-3vmp-whvv-5v9v Mattermost doesn't validate that a username returned during bot registration belongs to a bot account |
Medium EPSS 0.19% |
all versions | No fix yet |
| GHSA-rp4v-qc77-phm4 Mattermost doesn't restrict role_updated websocket event broadcasts to members of the affected team or channel |
Medium EPSS 0.18% |
all versions | No fix yet |
| GHSA-5gmf-x7hg-97wf Mattermost doesn't filter nil elements from outgoing webhook attachment payloads before processing |
Medium EPSS 0.28% |
all versions | No fix yet |
| GHSA-w9m8-p4cc-4qj9 Mattermost doesn't properly validate msgpack-encoded WebSocket frames before memory allocation |
High EPSS 0.34% |
all versions | No fix yet |
| GO-2026-5173 Mattermost has an Incorrect Authorization issue |
Medium EPSS 0.15% |
all versions | No fix yet |
| GHSA-9p64-jpc7-m2rp Mattermost doesn't sanitize sensitive configuration fields before including them in support packet generation |
High EPSS 0.30% |
all versions | No fix yet |
| GHSA-wvgv-4fc3-2rcp Mattermost doesn't prevent disclosure of created user password |
Medium EPSS 0.23% |
all versions | No fix yet |
| GO-2026-5494 Mattermost doesn't check public/private permissions |
Medium EPSS 0.17% |
all versions | No fix yet |
| GHSA-xvcx-mgpc-5xh3 Mattermost doesn't validate the X-Requested-With header on the burn-on-read reveal endpoint |
Medium EPSS 0.11% |
all versions | No fix yet |
| GHSA-vqp5-2mrp-qqxg Mattermost doesn't validate the Host header when constructing response URLs for custom slash command |
Medium EPSS 0.14% |
all versions | No fix yet |
| GHSA-8r89-8w26-cq32 Mattermost doesn't verify channel membership when processing AI-assisted message rewrites |
Medium EPSS 0.21% |
all versions | No fix yet |
| GO-2026-5404 Mattermost doesn't check if {{team_id}} was being changed when updating playbooks |
Medium EPSS 0.14% |
all versions | No fix yet |
| GHSA-wvcv-9xpm-7mqc Mattermost doesn't enforce slash command trigger-word uniqueness during command updates |
Medium EPSS 0.15% |
all versions | No fix yet |
| GHSA-cjm8-jxpw-g43m Mattermost doesn't validate 7zip archive structure before processing |
Medium EPSS 0.24% |
all versions | No fix yet |
| GHSA-jp3f-x449-4q75 Mattermost doesn't enforce client identity binding during the OAuth authorization code redemption flow |
Low EPSS 0.12% |
all versions | No fix yet |
| GHSA-hqpj-f3jh-29vx Mattermost doesn't validate that the RefreshedToken differs from the original invite token during remote cluster invite confirmation |
Medium EPSS 0.14% |
all versions | No fix yet |
| GHSA-v549-xx3c-6pc8 Mattermost doesn't check the create_post channel permission during post edit operations |
Medium EPSS 0.15% |
all versions | No fix yet |
| GHSA-jx93-pf6x-874r Mattermost doesn't escape some variables that could contain malicious content during error page composition |
Medium EPSS 0.14% |
all versions | No fix yet |
| GHSA-8h9w-w78c-vvr3 Mattermost does not verify remote cluster channel access when processing shared channel membership removals |
Medium EPSS 0.15% |
all versions | No fix yet |
| GHSA-mh4x-rmrx-3hp4 Mattermost has session spoofing due to lack of single-use consumption of guest magic link tokens enforcement |
Medium EPSS 0.15% |
all versions | No fix yet |
| GO-2026-5495 Mattermost doesn't validate CSRF tokens on an authentication endpoint |
High EPSS 0.13% |
all versions | No fix yet |
| GO-2026-5512 Mattermost allows authenticated guest users to enumerate user IDs outside their allowed visibility scope |
Medium EPSS 0.24% |
all versions | No fix yet |
| GO-2026-5663 Mattermost doesn't validate decompressed archive entry sizes during file extraction |
Medium EPSS 0.36% |
all versions | No fix yet |
| GO-2026-5092 Mattermost allows system administrators to read arbitrary host files via malicious AdvancedLoggingJSON configuration |
Medium EPSS 0.44% |
all versions | No fix yet |
| GO-2026-5067 Mattermost allows attackers to manipulate administrator terminals via crafted messages containing ANSI and OSC escape sequences |
High EPSS 0.28% |
all versions | No fix yet |
| GO-2026-5393 Mattermost has an Incorrect Authorization issue |
Medium EPSS 0.14% |
all versions | No fix yet |
| GO-2026-5629 Mattermost doesn't properly validate CSRF tokens |
Medium EPSS 0.12% |
all versions | No fix yet |
| GHSA-fg35-5rf6-qg3g Mattermost allows attackers to take over arbitrary user accounts via overly permissive substring matching flaw |
Medium EPSS 0.18% |
all versions | No fix yet |
| GO-2026-5245 Mattermost: Authenticated DoS through failure to prevent rendering of external SVGs on link embeds |
High EPSS 0.36% |
all versions | No fix yet |
| GHSA-gqv7-j2j8-qmwq Mattermost fails to canonicalize IPv4-mapped IPv6 addresses before reserved IP validation |
Medium EPSS 0.17% |
all versions | No fix yet |
| GHSA-cwfj-642j-gfh4 Mattermost fails to properly enforce read permissions in search API endpoints |
Medium EPSS 0.17% |
all versions | No fix yet |
| GHSA-rv67-7w2g-7976 Mattermost fails to validate user's authentication method when processing account auth type switch |
Low EPSS 0.15% |
all versions | No fix yet |
| GHSA-5mr9-crcg-8wh2 Mattermost fails to use consistent error responses when handling the /mute command |
Medium EPSS 0.19% |
all versions | No fix yet |
| GHSA-xpvf-6qcc-9jqc Mattermost fails to validate team-specific upload_file permissions |
Medium EPSS 0.23% |
all versions | No fix yet |
| GHSA-3rhr-jr63-hwq5 Mattermost fails to preserve the redacted state of burn-on-read posts during deletion |
Medium EPSS 0.23% |
all versions | No fix yet |
| GHSA-fx49-m253-27jj Mattermost fails to filter invite IDs based on user permissions |
Medium EPSS 0.17% |
all versions | No fix yet |
| GHSA-679f-wmrg-qf57 Mattermost allows a removed team member to enumerate all public channels within a private team |
Medium EPSS 0.17% |
all versions | No fix yet |
| GHSA-ph22-fw5m-w2q9 Mattermost allows attackers to spoof permalink embeds |
Medium EPSS 0.11% |
all versions | No fix yet |
| GHSA-34g8-9fpp-46ch Mattermost fails to limit the size of responses from integration action endpoints |
Medium EPSS 0.17% |
all versions | No fix yet |
| GHSA-44mv-jq72-gj49 Mattermost fails to bound memory allocation when processing PSD image files |
Medium EPSS 0.22% |
all versions | No fix yet |
| GHSA-2v3w-6g35-5f9v Mattermost fails to properly validate User-Agent header tokens |
Medium EPSS 0.30% |
all versions | No fix yet |
| GHSA-xv2p-wchj-qjhp Mattermost fails to bound memory allocation when processing DOC files |
Medium EPSS 0.28% |
all versions | No fix yet |
| GHSA-m5rv-56xx-hfc6 Mattermost fails to properly handle very long passwords |
High EPSS 0.28% |
all versions | No fix yet |
| GHSA-cgjg-p2m2-qm4p Mattermost fails to enforce invite permissions when updating team settings |
Low EPSS 0.18% |
all versions | No fix yet |
| GHSA-57cc-2pf4-mhmx Mattermost fails to properly validate team membership when processing channel mentions |
Medium EPSS 0.19% |
all versions | No fix yet |
| GHSA-pp9j-pf5c-659x Mattermost fails to sanitize sensitive data in WebSocket messages |
Medium EPSS 0.24% |
all versions | No fix yet |
| GHSA-3c9r-7f29-qp32 Mattermost fails to properly validate login method restrictions |
Medium EPSS 0.20% |
all versions | No fix yet |
| GHSA-vww6-79rv-3j4x Mattermost doesn't verify that post actions invoking `/share-issue-publicly` were created by the Jira plugin |
Medium EPSS 0.18% |
all versions | No fix yet |
| GHSA-fmqf-pmcm-8cx9 Mattermost doesn't validate user channel membership when attaching Mattermost posts as comments to Jira issues |
Medium EPSS 0.19% |
all versions | No fix yet |
| GO-2026-4275 Mattermost with Jira plugin enabled has Incorrect Implementation of Authentication Algorithm |
High EPSS 0.26% |
all versions | No fix yet |
| GHSA-x3r8-2hmh-89f5 Mattermost has an Invite Token Replay Vulnerability via Channel Membership Manipulation |
Low EPSS 0.20% |
all versions | No fix yet |
| GO-2025-4248 Mattermost has missing redirect URL validation |
Medium EPSS 0.15% |
all versions | No fix yet |
| GO-2025-4247 Mattermost GitHub Plugin Bot Identity Validation Bypass Allows Arbitrary GitHub Reaction Injection |
Low EPSS 0.18% |
all versions | No fix yet |
| GO-2025-4178 Mattermost fails to validate user permissions in Boards |
Medium EPSS 0.22% |
all versions | No fix yet |
| GO-2025-4172 Mattermost fails to validate user permissions when deleting comments in Boards |
Medium EPSS 0.18% |
all versions | No fix yet |
| GHSA-mp6x-97xj-9x62 Mattermost fails to to verify the token used during code exchange |
Critical EPSS 0.45% |
all versions | No fix yet |
| GHSA-4g87-9x45-cx2h Mattermost fails to sanitize team email addresses |
Medium EPSS 0.23% |
all versions | No fix yet |
| GHSA-3x39-62h4-f8j6 Mattermost fails to properly validate OAuth state tokens during OpenID Connect authentication |
Critical EPSS 0.37% |
all versions | No fix yet |
| GHSA-9hh7-6558-qfp2 Mattermost allows other users to determine when users had read channels via channel member objects |
Low EPSS 0.18% |
all versions | No fix yet |
| GHSA-mqp8-pgg5-7x7m Mattermost allows system administrators to access password hashes and MFA secrets |
Medium EPSS 0.30% |
all versions | No fix yet |
| GHSA-ff85-qw3h-g9vp Mattermost allows an attacker to edit arbitrary posts via a crafted MSTeams plugin OAuth redirect URL |
Medium EPSS 0.20% |
all versions | No fix yet |
| GHSA-xpg8-8xpv-948p Mattermost does not enforce MFA on WebSocket connections |
High EPSS 0.32% |
all versions | No fix yet |
| GHSA-x3hx-ch7p-8xgg Mattermost allows regular users to access archived channel content and files |
Medium EPSS 0.18% |
all versions | No fix yet |
| GHSA-j6gg-r5jc-47cm Mattermost fails to properly restrict access to archived channel search API |
Medium EPSS 0.21% |
< 5.3.2-0.20250815165020-c8d66301415d | 5.3.2-0.20250815165020-c8d66301415d |
| GHSA-j6gg-r5jc-47cm Mattermost fails to properly restrict access to archived channel search API |
Medium EPSS 0.21% |
all versions | No fix yet |
| GHSA-mqcj-8c2g-h97q Mattermost Incorrect Authorization vulnerability |
Medium EPSS 0.20% |
< 5.3.2-0.20250905150616-ba86dfc5876b | 5.3.2-0.20250905150616-ba86dfc5876b |
| GHSA-mqcj-8c2g-h97q Mattermost Incorrect Authorization vulnerability |
Medium EPSS 0.20% |
all versions | No fix yet |
| GHSA-r6qj-894f-5hr2 Mattermost has a Missing Authorization vulnerability |
High EPSS 0.34% |
all versions | No fix yet |
| GHSA-6q7m-p8cc-998r Mattermost has a Missing Authorization vulnerability |
High EPSS 0.42% |
all versions | No fix yet |
| GHSA-xr3w-rmvj-f6m7 Mattermost has an Observable Timing Discrepancy vulnerability |
Low EPSS 0.27% |
all versions | No fix yet |
| GHSA-3q4q-wqm6-hvf3 Mattermost has a Missing Authorization vulnerability |
Medium EPSS 0.30% |
all versions | No fix yet |
| GHSA-424h-xj87-m937 Mattermost has an Incorrect Authorization vulnerability |
Medium EPSS 0.33% |
all versions | No fix yet |
| GHSA-f72g-52v7-mg3p Mattermost boards plugin fails to restrict download access to files |
Medium EPSS 0.27% |
all versions | No fix yet |
| GHSA-qx3f-6vq3-8j8m Mattermost Path Traversal vulnerability |
High EPSS 0.64% |
all versions | No fix yet |
| GHSA-hm95-jx66-g2gh Mattermost Open Redirect vulnerability |
Medium EPSS 0.17% |
all versions | No fix yet |
| GHSA-69j8-prx2-vx98 Mattermost Open Redirect vulnerability |
Medium EPSS 0.18% |
all versions | No fix yet |
| GHSA-9p92-x77w-9fw2 Mattermost makes Use of Weak Hash |
Medium EPSS 0.15% |
all versions | No fix yet |
| GHSA-3vcm-c42p-3hhf Mattermost Missing Authorization vulnerability |
Medium EPSS 0.26% |
all versions | No fix yet |
| GHSA-h469-4fcf-p23h Mattermost has Potential Server Crash due to Unvalidated Import Data |
Medium EPSS 0.32% |
<= 5.39.3 | No fix yet |
| GHSA-h469-4fcf-p23h Mattermost has Potential Server Crash due to Unvalidated Import Data |
Medium EPSS 0.32% |
all versions | No fix yet |
| GHSA-pj6f-rc94-gw53 Mattermost Fails to Sanitize File Names |
Medium EPSS 0.77% |
all versions | No fix yet |
| GHSA-x67c-v8jr-p29r Mattermost Fails to Sanitize Path Traversal Sequences |
Medium EPSS 0.41% |
all versions | No fix yet |
| GHSA-x67c-v8jr-p29r Mattermost Fails to Sanitize Path Traversal Sequences |
Medium EPSS 0.41% |
<= 5.39.5 | No fix yet |
| GHSA-4276-cm8c-788h Mattermost Fails to Properly Validate Team Role Modification |
Low EPSS 0.20% |
all versions | No fix yet |
| GHSA-4276-cm8c-788h Mattermost Fails to Properly Validate Team Role Modification |
Low EPSS 0.20% |
<= 5.39.3 | No fix yet |
| GHSA-pwvr-grqg-7vp2 Mattermost Lack of Access Control Validation |
Medium EPSS 0.20% |
all versions | No fix yet |
| GHSA-q453-638c-h4mr Mattermost Fails to Validate Remote Cluster Upload Sessions |
Medium EPSS 0.30% |
all versions | No fix yet |
| GHSA-q453-638c-h4mr Mattermost Fails to Validate Remote Cluster Upload Sessions |
Medium EPSS 0.30% |
<= 5.39.3 | No fix yet |
| GHSA-qj47-w9f2-qg44 Mattermost Does Not Sanitize the Team Invite ID |
Medium EPSS 0.22% |
all versions | No fix yet |
| GHSA-qj47-w9f2-qg44 Mattermost Does Not Sanitize the Team Invite ID |
Medium EPSS 0.22% |
<= 5.39.3 | No fix yet |
| GHSA-vqwh-5jhh-vc9p Mattermost Server SSRF Vulnerability via the Agents Plugin |
Low EPSS 0.19% |
all versions | No fix yet |
| GHSA-gq3r-5833-5532 Mattermost Fails to Validate File Paths |
Medium EPSS 0.49% |
all versions | No fix yet |
| GHSA-gq3r-5833-5532 Mattermost Fails to Validate File Paths |
Medium EPSS 0.49% |
<= 5.11.1 | No fix yet |
| GHSA-4fwj-8595-wp25 Mattermost has Insufficiently Protected Credentials |
Low EPSS 0.22% |
all versions | No fix yet |
| GHSA-wvw2-3jh4-4c39 Mattermost Path Traversal vulnerability |
Medium EPSS 0.45% |
all versions | No fix yet |
| GHSA-7h34-9chr-58qh Mattermost Missing Authentication for Critical Function |
Medium EPSS 0.37% |
all versions | No fix yet |
| GHSA-wgvp-jj4w-88hf Mattermost Incorrect Authorization vulnerability |
Medium EPSS 0.20% |
all versions | No fix yet |
| GHSA-v8fr-vxmw-6mf6 Mattermost Incorrect Authorization vulnerability |
Medium EPSS 0.22% |
all versions | No fix yet |
| GHSA-4578-6gjh-f2jm Mattermost allows an unauthorized Guest user access to Playbook |
Medium EPSS 0.29% |
all versions | No fix yet |
| GHSA-qwwm-c582-82rx Mattermost allows unauthorized channel member management through playbook runs |
Medium EPSS 0.25% |
all versions | No fix yet |
| GHSA-qh58-9v3j-wcjc Mattermost allows authenticated users to write files to arbitrary locations |
Critical EPSS 1.02% |
all versions | No fix yet |
| GHSA-4r67-4x4p-fprg Mattermost allows authenticated administrator to execute LDAP search filter injection |
Medium EPSS 0.28% |
all versions | No fix yet |
| GHSA-jwhw-xf5v-qgxc Mattermost allows guest users to view information about public teams they are not members of |
Medium EPSS 0.22% |
all versions | No fix yet |
| GO-2025-3728 Mattermost fails to properly enforce access control restrictions for System Manager roles |
Medium EPSS 0.23% |
all versions | No fix yet |
| GO-2025-3731 Mattermost fails to properly invalidate personal access tokens upon user deactivation |
Medium EPSS 0.23% |
all versions | No fix yet |
| GO-2025-3729 Mattermost fails to clear Google OAuth credentials |
Medium EPSS 0.21% |
all versions | No fix yet |
| GO-2025-3730 Mattermost fails to properly enforce access controls for guest users |
Low EPSS 0.25% |
all versions | No fix yet |
| GO-2025-3724 Mattermost improperly allows team administrators to modify team invites |
Low EPSS 0.33% |
all versions | No fix yet |
| GO-2025-3694 Mattermost Fails to Check User Access to `ExperimentalSettings` |
Low EPSS 0.34% |
all versions | No fix yet |
| GO-2025-3691 Mattermost Fails to Verify User's Permissions When Accessing Groups |
Medium EPSS 0.31% |
all versions | No fix yet |
| GO-2025-3693 Mattermost Fails to Validate Team Invite Permissions |
Medium EPSS 0.26% |
all versions | No fix yet |
| GO-2025-3692 Mattermost Fails to Lockout LDAP Users After Repeated Login Failures |
Medium EPSS 0.35% |
all versions | No fix yet |
| GO-2025-3644 Mattermost Playbooks fails to properly validate permissions |
Medium EPSS 0.28% |
all versions | No fix yet |
| GO-2025-3642 Mattermost Playbooks fails to properly validate the props used by the RetrospectivePost custom post type |
High EPSS 0.50% |
all versions | No fix yet |
| GO-2025-3643 Mattermost Playbooks fails to validate the uniqueness and quantity of task actions |
High EPSS 0.40% |
all versions | No fix yet |
| GO-2025-3623 Mattermost Incorrect Authorization vulnerability |
Medium EPSS 0.29% |
all versions | No fix yet |
| GO-2025-3622 Mattermost doesn't restrict domains LLM can request to contact upstream |
Medium EPSS 0.29% |
all versions | No fix yet |
| GO-2025-3618 Mattermost vulnerable to Observable Timing Discrepancy |
Medium EPSS 0.34% |
all versions | No fix yet |
| GO-2025-3619 Mattermost Incorrect Authorization vulnerability |
Medium EPSS 0.27% |
all versions | No fix yet |
| GO-2025-3620 Mattermost Missing Authentication for Critical Function |
Low EPSS 0.24% |
all versions | No fix yet |
| GO-2025-3621 Mattermost Incorrect Authorization vulnerability |
Medium EPSS 0.23% |
all versions | No fix yet |
| GO-2025-3610 Mattermost vulnerable to Incorrect Implementation of Authentication Algorithm |
Medium EPSS 0.23% |
all versions | No fix yet |
| GO-2025-3611 Mattermost Incorrect Authorization vulnerability |
Medium EPSS 0.26% |
all versions | No fix yet |
| GHSA-322v-vh2g-qvpv Mattermost Fails to Restrict Certain Operations on System Admins |
Medium EPSS 0.25% |
all versions | No fix yet |
| GO-2025-3604 Mattermost Fails to Enforce Proper Access Controls on `/api/v4/audits` Endpoint |
Low EPSS 0.29% |
all versions | No fix yet |
| GO-2025-3549 Mattermost Fails to Enforce Certain Search APIs |
Medium EPSS 0.32% |
all versions | No fix yet |
| GHSA-h5v9-xw2g-7hrq Mattermost allows members with permission to convert public channels to private and convert private to public |
Medium EPSS 0.21% |
all versions | No fix yet |
| GO-2025-3555 Mattermost fail to prompt for explicit approval before adding a team admin to a private channel |
Low EPSS 0.22% |
all versions | No fix yet |
| GO-2025-3550 Mattermost Fails to Restrict Command Execution in Archived Channels |
High EPSS 0.38% |
all versions | No fix yet |
| GO-2025-3551 Mattermost Fails to Enforce MFA on Plugin Endpoints |
High EPSS 0.34% |
all versions | No fix yet |
| GO-2025-3552 Mattermost Fails to Restrict Bookmark Creation and Updates in Archived Channels |
Medium EPSS 0.24% |
all versions | No fix yet |
| GHSA-fqrq-xmxj-v47x Mattermost Fails to Properly Perform Viewer Role Authorization |
Medium EPSS 0.25% |
all versions | No fix yet |
| GO-2025-3480 Mattermost allows reading arbitrary files related to importing boards |
High EPSS 24.22% |
all versions | No fix yet |
| GO-2025-3481 Mattermost fails to restrict channel export of archived channels |
Medium EPSS 0.29% |
all versions | No fix yet |
| GO-2025-3483 Mattermost allows reading arbitrary files |
Medium EPSS 0.61% |
all versions | No fix yet |
| GO-2025-3482 Mattermost fails to invalidate all active sessions when converting a user to a bot |
High EPSS 0.26% |
all versions | No fix yet |
| GO-2025-3407 Mattermost webapp crash via a crafted post |
High EPSS 0.48% |
all versions | No fix yet |
| GO-2025-3394 Mattermost fails to properly validate post props |
Medium EPSS 0.58% |
all versions | No fix yet |
| GO-2025-3392 Mattermost fails to properly validate post props |
Medium EPSS 0.45% |
all versions | No fix yet |
| GO-2025-3393 Mattermost Incorrect Type Conversion or Cast |
Medium EPSS 0.58% |
all versions | No fix yet |
| GO-2025-3377 Mattermost Incorrect Authorization vulnerability |
Low EPSS 0.27% |
all versions | No fix yet |
| GO-2025-3380 Mattermost has Improper Check for Unusual or Exceptional Conditions |
Medium EPSS 0.32% |
all versions | No fix yet |
| GO-2025-3379 Mattermost Improper Validation of Specified Type of Input vulnerability |
Medium EPSS 0.61% |
all versions | No fix yet |
| GO-2024-3340 Mattermost Data Amplification vulnerability |
Medium EPSS 0.44% |
all versions | No fix yet |
| GO-2024-3337 Mattermost Improper Validation of Specified Type of Input vulnerability |
Medium EPSS 0.63% |
all versions | No fix yet |
| GO-2024-3338 Mattermost Race Condition vulnerability |
Medium EPSS 0.26% |
all versions | No fix yet |
| GO-2024-3234 Mattermost Server vulnerable to application crash from attacker-generated large response |
High EPSS 0.46% |
all versions | No fix yet |
| GO-2024-3233 Mattermost Server Path Traversal vulnerability that leads to Cross-Site Request Forgery |
Medium EPSS 0.16% |
all versions | No fix yet |
| GO-2024-3235 Mattermost server allows authenticated user to delete arbitrary post |
Medium EPSS 0.28% |
all versions | No fix yet |
| GO-2024-3232 Mattermost Server allows user to get private channel names |
Medium EPSS 0.29% |
all versions | No fix yet |
| GO-2024-3227 Mattermost incorrectly issues two sessions when using desktop SSO |
Low EPSS 0.38% |
all versions | No fix yet |
| GO-2024-3164 Mattermost fails to strip `embeds` from `metadata` when broadcasting `posted` events |
Medium EPSS 0.58% |
all versions | No fix yet |
| GO-2024-3089 Mattermost allows guest user with read access to upload files to a channel |
Medium EPSS 0.28% |
all versions | No fix yet |
| GO-2024-3091 Mattermost allows user with systems manager role with read-only access to teams to perform write operations on teams |
Medium EPSS 0.34% |
all versions | No fix yet |
| GO-2024-3090 Mattermost allows team admin user without "Add Team Members" permission to disable invite URL |
Low EPSS 0.39% |
all versions | No fix yet |
| GO-2024-3094 Mattermost doesn't restrict which roles can promote a user as system admin |
High EPSS 0.34% |
all versions | No fix yet |
| GO-2024-3097 Mattermost Cross-Site Request Forgery vulnerability |
High EPSS 0.20% |
all versions | No fix yet |
| GO-2024-3096 Mattermost allows remote/synthetic users to create sessions, reset passwords |
Medium EPSS 0.26% |
all versions | No fix yet |
| GO-2024-3093 Mattermost doesn't redact remote users' original email addresses |
Low EPSS 0.22% |
all versions | No fix yet |
| GO-2024-3022 Mattermost allows remote actor to set arbitrary RemoteId values for synced users |
Medium EPSS 0.18% |
all versions | No fix yet |
| GO-2024-3031 Mattermost allows a remote actor to make an arbitrary local channel read-only |
Medium EPSS 0.28% |
all versions | No fix yet |
| GO-2024-3023 Mattermost allows remote actor to create/update/delete posts in arbitrary channels |
High EPSS 0.36% |
all versions | No fix yet |
| GO-2024-3024 Mattermost allows a user on a remote to set their remote username prop to an arbitrary string |
Medium EPSS 0.34% |
all versions | No fix yet |
| GHSA-vvpg-55p7-5h8w Mattermost did not properly restrict channel creation |
Medium EPSS 0.28% |
all versions | No fix yet |
| GHSA-vvpg-55p7-5h8w Mattermost did not properly restrict channel creation |
Medium EPSS 0.28% |
< 5.3.2-0.20240626164322-c758cecaf30c | 5.3.2-0.20240626164322-c758cecaf30c |
| GO-2024-3020 Mattermost allows a remote actor to permanently delete local data by abusing dangerous error handling |
High EPSS 0.46% |
all versions | No fix yet |
| GO-2024-3092 Mattermost allows unsolicited invites to expose access to local channels |
Critical EPSS 0.36% |
all versions | No fix yet |
| GO-2024-3028 Mattermost failed to properly validate that the channel that comes from the sync message is a shared channel |
Medium EPSS 0.34% |
all versions | No fix yet |
| GO-2024-3025 Mattermost failed to disallow the modification of local users when syncing users in shared channels |
Medium EPSS 0.30% |
all versions | No fix yet |
| GO-2024-3030 Mattermost failed to properly validate synced reactions |
Medium EPSS 0.28% |
all versions | No fix yet |
| GO-2024-2696 Mattermost fails to authenticate the source of certain types of post actions |
Medium EPSS 0.22% |
all versions | No fix yet |
| GO-2024-2706 Mattermost Server Improper Access Control |
Low EPSS 0.33% |
all versions | No fix yet |
| GO-2024-2695 Mattermost Server doesn't limit the number of user preferences |
Medium EPSS 0.56% |
all versions | No fix yet |
| GO-2024-2707 Mattermost Server Improper Access Control |
Low EPSS 0.31% |
all versions | No fix yet |
| GHSA-qqc8-rv37-79q5 Mattermost Server Resource Exhaustion |
Medium EPSS 0.51% |
all versions | No fix yet |
| GHSA-qqc8-rv37-79q5 Mattermost Server Resource Exhaustion |
Medium EPSS 0.51% |
< 0.0.0-20240209181221-674f549daf0e | 0.0.0-20240209181221-674f549daf0e |
| GO-2024-2594 Mattermost fails to limit the number of role names |
Medium EPSS 0.51% |
all versions | No fix yet |
| GO-2024-2635 Mattermost incorrectly allows access individual posts |
Medium EPSS 0.37% |
all versions | No fix yet |
| GO-2024-2588 Mattermost race condition |
Low EPSS 0.27% |
all versions | No fix yet |
| GO-2024-2592 Mattermost allows attackers access to posts in channels they are not a member of |
Medium EPSS 0.36% |
all versions | No fix yet |
| GO-2024-2593 Mattermost fails to check the "invite_guest" permission |
Medium EPSS 0.33% |
all versions | No fix yet |
| GO-2024-2589 Mattermost denial of service through long emoji value |
Medium EPSS 0.68% |
all versions | No fix yet |
| GO-2024-2590 Mattermost leaks details of AD/LDAP groups of a teams |
Medium EPSS 0.39% |
all versions | No fix yet |
| GO-2024-2595 Mattermost fails to properly restrict the access of files attached to posts |
Medium EPSS 0.31% |
all versions | No fix yet |
| GO-2024-2591 Mattermost post fetching without auditing in compliance export |
Medium EPSS 0.33% |
all versions | No fix yet |
| GO-2024-2541 Mattermost vulnerable to denial of service via large number of emoji reactions |
Medium EPSS 0.52% |
all versions | No fix yet |
| GO-2024-2566 Mattermost fails to check the required permissions |
Medium EPSS 0.31% |
all versions | No fix yet |
| GO-2024-2444 Mattermost allows demoted guests to change group names |
Medium EPSS 0.32% |
all versions | No fix yet |
| GO-2024-2448 Mattermost notified all users in the channel when using WebSockets to respond individually |
Medium EPSS 0.46% |
all versions | No fix yet |
| GO-2024-2450 Mattermost viewing archived public channels permissions vulnerability |
Medium EPSS 0.36% |
all versions | No fix yet |
| GO-2024-2446 Mattermost Cross-site Scripting vulnerability |
Medium EPSS 0.30% |
all versions | No fix yet |
| GHSA-r67m-mf7v-qp7j Mattermost password hash disclosure vulnerability |
Medium EPSS 0.51% |
< 5.3.2-0.20230825233148-f787fd63368a | 5.3.2-0.20230825233148-f787fd63368a |
| GHSA-63f2-6959-2pxj Mattermost vulnerable to cross-site scripting (XSS) |
Medium EPSS 0.45% |
>= 5.0.0, < 7.1.6 | 7.1.6 |
| GHSA-8jhh-3jf2-pfwr Mattermost vulnerable to information disclosure |
Medium EPSS 0.55% |
>= 5.0.0, < 7.1.6 | 7.1.6 |
| GHSA-9hj7-v56g-rhf6 Mattermost fails to properly authentication inviter's permissions to private channel |
Medium EPSS 0.32% |
>= 5.0.0, < 7.1.6 | 7.1.6 |
| GO-2022-0540 Mattermost users could access some sensitive information via API call |
Medium EPSS 0.83% |
all versions | No fix yet |
| GO-2023-1939 Mattermost Server Sensitive Data Exposure |
Medium EPSS 0.92% |
< 5.20.0 | 5.20.0 |
| GO-2023-1939 Mattermost Server Sensitive Data Exposure |
Medium EPSS 0.92% |
< 5.20.0 | 5.20.0 |
| GHSA-5mh6-p63g-3mv5 Mattermost Server is vulnerable to a Denial of Service attack through `invite_people` command |
High EPSS 1.17% |
< 5.1.0 | 5.1.0 |
| GO-2022-0599 Improper Control of a Resource Through its Lifetime in Mattermost |
Medium EPSS 0.84% |
all versions | No fix yet |
| GO-2022-0576 Insecure plugin handling in Mattermost |
High EPSS 0.68% |
all versions | No fix yet |
| GO-2022-0595 Resource exhaustion in Mattermost |
Medium EPSS 0.92% |
all versions | No fix yet |
| GO-2022-0616 Improper Privilege Management in Mattermost |
Medium EPSS 0.65% |
< 5.37.9 | 5.37.9 |
| GO-2022-0616 Improper Privilege Management in Mattermost |
Medium EPSS 0.65% |
< 5.37.9 | 5.37.9 |
| GO-2022-0604 Cross-site Scripting in Mattermost |
Medium EPSS 0.63% |
< 5.39.0 | 5.39.0 |
| GO-2022-0604 Cross-site Scripting in Mattermost |
Medium EPSS 0.63% |
< 5.39.0 | 5.39.0 |
MergeHarbor checks every repository's dependencies against this database, ranks what matters by exploitability and reachability, routes it to the owning team and opens the fix pull request.
Check your repos with MergeHarbor