CVE-2023-47369

The leakage of channel access token in besttrainingmember Line 13.6.1 allows remote attackers to send malicious notifications...

CVE-2023-47367

The leakage of channel access token in platinum clinic Line 13.6.1 allows remote attackers to send malicious notifications to victims...

CVE-2023-47370

The leakage of channel access token in bluetrick Line 13.6.1 allows remote attackers to send malicious notifications to victims...

CVE-2023-47363

The leakage of channel access token in F.B.P members Line 13.6.1 allows remote attackers to send malicious notifications to victims...

CVE-2023-47373

The leakage of channel access token in DRAGON FAMILY Line 13.6.1 allows remote attackers to send malicious notifications to victims...

CVE-2023-31822

An issue found in Entetsu Store v.13.4.1 allows a remote attacker to gain access to sensitive information via the channel access token in the miniapp Entetsu Store function...

CVE-2023-39039

An information leak in Camp Style Project Line v13.6.1 allows attackers to obtain the channel access token and send crafted messages...

CVE-2023-39050

An information leak in Daiky-value.Fukueten v13.6.1 allows attackers to obtain the channel access token and send crafted messages...

CVE-2023-47364

The leakage of channel access token in nagaoka taxi Line 13.6.1 allows remote attackers to send malicious notifications to victims...

CVE-2023-47372

The leakage of channel access token in UPDATESALON C-LOUNGE Line 13.6.1 allows remote attackers to send malicious notifications to victims...

CVE-2023-43988

An issue in nature fitness saijo mini-app on Line v13.6.1 allows attackers to send crafted malicious notifications via leakage of the channel access token...

CVE-2018-19783

Kentix MultiSensor-LAN 5.63.00 devices and previous allow Authentication Bypass via an Alternate Path or Channel...

CVE-2025-32945

The vulnerability allows an existing user to add playlists to a different user’s channel using the PeerTube REST API. The vulnerable code sets the owner of the new playlist to be the user who performed the request, and then sets the associated channel to the channel ID supplied by the request,...

GHSA-MJ2P-V2C2-VH4V Mattermost Incorrect Authorization vulnerability

Mattermost versions 10.5.x = 10.5.1, 10.4.x = 10.4.3, 9.11.x = 9.11.9 fail to properly enforce the 'Allow users to view/update archived channels' System Console setting, which allows authenticated users to view members and member information of archived channels even when this setting is disabled...

CVE-2025-2564

Summary: CVE-2025-2564 affects Mattermost Server versions 10.5.x <= 10.5.1, 10.4.x <= 10.4.3, and 9.11.x

GHSA-H4RR-F37J-4HH7 Mattermost Incorrect Authorization vulnerability

Mattermost versions 10.5.x = 10.5.1, 10.4.x = 10.4.3, 9.11.x = 9.11.9 fail to check the "Allow Users to View Archived Channels" configuration when fetching channel metadata of a post from archived channels, which allows authenticated users to access such information when a channel is archived...

CVE-2025-27571

Mattermost versions 10.5.x = 10.5.1, 10.4.x = 10.4.3, 9.11.x = 9.11.9 fail to check the "Allow Users to View Archived Channels" configuration when fetching channel metadata of a post from archived channels, which allows authenticated users to access such information when a channel is archived...

BIT-MATTERMOST-2025-27715

Mattermost versions 9.11.x = 9.11.8 fail to prompt for explicit approval before adding a team admin to a private channel, which team admins to joining private channels via crafted permalink links without explicit consent from them...

GO-2025-3555 Mattermost fail to prompt for explicit approval before adding a team admin to a private channel in github.com/mattermost/mattermost-server

Mattermost fail to prompt for explicit approval before adding a team admin to a private channel in github.com/mattermost/mattermost-server...

Mattermost fail to prompt for explicit approval before adding a team admin to a private channel

Mattermost versions 9.11.x = 9.11.8 fail to prompt for explicit approval before adding a team admin to a private channel, which team admins to joining private channels via crafted permalink links without explicit consent from them...