1652 matches found
GO-2026-4521 Mattermost fails to properly validate team membership when processing channel mentions in github.com/mattermost/mattermost-server
Mattermost fails to properly validate team membership when processing channel mentions in github.com/mattermost/mattermost-server. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing...
GO-2026-4524 Mattermost fails to sanitize sensitive data in WebSocket messages in github.com/mattermost/mattermost-server
Mattermost fails to sanitize sensitive data in WebSocket messages in github.com/mattermost/mattermost-server. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing false-positive reports fro...
GO-2026-4496 Mattermost doesn't validate user permissions when creating Jira issues from Mattermost posts in github.com/mattermost/mattermost-server
Mattermost doesn't validate user permissions when creating Jira issues from Mattermost posts in github.com/mattermost/mattermost-server...
GO-2026-4520 Mattermost fails to properly validate login method restrictions in github.com/mattermost/mattermost-server
Mattermost fails to properly validate login method restrictions in github.com/mattermost/mattermost-server. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing false-positive reports from...
Mattermost Server 10.11.x <= 10.11.9 / 11.0.x <= 11.2.x Improper Access Control (MMSA-2025-00549)
The version of Mattermost Server installed on the remote host is affected by a vulnerability as referenced in the MMSA-2025-00549 advisory. - Mattermost versions 10.11.x = 10.11.9 and 11.0.x = 11.2.x fail to properly enforce access control checks in the common teams API. This allows the API to...
GO-2026-4462 Mattermost Server server restarts may provide attackers with API access in github.com/mattermost/mattermost-server
Mattermost Server server restarts may provide attackers with API access in github.com/mattermost/mattermost-server. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing false-positive repor...
GO-2026-4467 Mattermost Server has Improper Authorization for Integration Requests in github.com/mattermost/mattermost-server
Mattermost Server has Improper Authorization for Integration Requests in github.com/mattermost/mattermost-server. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing false-positive reports...
GO-2026-4464 Mattermost Server has X.509 Improper Certificate Validation in github.com/mattermost/mattermost-server
Mattermost Server has X.509 Improper Certificate Validation in github.com/mattermost/mattermost-server...
GO-2026-4476 Mattermost Server password reset email requests can be sent to attacker-provided email addresses in github.com/mattermost/mattermost-server
Mattermost Server password reset email requests can be sent to attacker-provided email addresses in github.com/mattermost/mattermost-server...
GO-2026-4459 Mattermost Server vulnerable to XSS through channel headers in github.com/mattermost/mattermost-server
Mattermost Server vulnerable to XSS through channel headers in github.com/mattermost/mattermost-server. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing false-positive reports from...
GO-2026-4478 Mattermost Server SAML implementation does not require encryption or signature verification as default in github.com/mattermost/mattermost-server
Mattermost Server SAML implementation does not require encryption or signature verification as default in github.com/mattermost/mattermost-server. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this ...
GO-2026-4477 Mattermost Server vulnerable to user account takeover when Single Sign-On OAuth2 is used in github.com/mattermost/mattermost-server
Mattermost Server vulnerable to user account takeover when Single Sign-On OAuth2 is used in github.com/mattermost/mattermost-server. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing...
GO-2026-4487 Mattermost Server allows an attacker to specify a full pathname of a log file in github.com/mattermost/mattermost-server
Mattermost Server allows an attacker to specify a full pathname of a log file in github.com/mattermost/mattermost-server. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing false-positive...
GO-2026-4463 Mattermost Server uses weak hashing for OAuth, email verification tokens and invitations in github.com/mattermost/mattermost-server
Mattermost Server uses weak hashing for OAuth, email verification tokens and invitations in github.com/mattermost/mattermost-server. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing...
GO-2026-4460 Mattermost Server does not restrict SAML certificate path for System Administrators in github.com/mattermost/mattermost-server
Mattermost Server does not restrict SAML certificate path for System Administrators in github.com/mattermost/mattermost-server...
Information Exposure
Overview Affected versions of this package are vulnerable to Information Exposure via the WebSocket component. An attacker can obtain sensitive information, including password hashes and MFA secrets, by triggering profile nickname updates or email verification events. Remediation Upgrade...
Incorrect Implementation of Authentication Algorithm
Overview github.com/mattermost/mattermost/server/channels/app is a private-cloud Slack alternative Affected versions of this package are vulnerable to Incorrect Implementation of Authentication Algorithm via the userID authentication. An attacker can gain unauthorized access by leveraging...
SUSE CVE-2017-18892
An issue was discovered in Mattermost Server before 4.2.0, 4.1.1, and 4.0.5. E-mail templates can have a field in which HTML content is not neutralized...
GO-2026-4317 Mattermost Server does not neutralize HTML content in an Email template field in github.com/mattermost/mattermost-server
Mattermost Server does not neutralize HTML content in an Email template field in github.com/mattermost/mattermost-server...