GO-2024-3093 Mattermost doesn't redact remote users' original email addresses in github.com/mattermost/mattermost-server

Mattermost doesn't redact remote users' original email addresses in github.com/mattermost/mattermost-server...

Unauthorized Session Creation And Password Reset

github.com/mattermost/mattermost-server is vulnerable to Unauthorized Session Creation And Password Reset. The vulnerability is due to a lack of proper validation for remote/synthetic users due to a shared channel configuration. This allows attackers to create munged email addresses using shared...

Mattermost Server 9.10.x < 9.10.1 / 9.5.x < 9.5.8 (MMSA-2024-00352)

The version of Mattermost Server installed on the remote host is 9.5.x prior to 9.5.8 or 9.10.0 prior to 9.10.1. It is, therefore, affected by a vulnerability as referenced in the MMSA-2024-00352 advisory. - Mattermost versions 9.5.x = 9.5.7, 9.10.x = 9.10.0 fail to properly enforce permissions...

Mattermost Server 9.5.x < 9.5.8 / 9.8.x < 9.8.3 / 9.9.x < 9.9.2 / 9.10.x < 9.10.1 Multiple Vulnerabilities (MMSA-2024-00353/MMSA-2024-00357)

The version of Mattermost Server installed on the remote host is prior to 9.10.1, 9.5.8, 9.8.3, or 9.9.2. It is, therefore, affected by multiple vulnerabilities as referenced in the MMSA-2024-00353 and MMSA-2024-00357 advisories. - Mattermost versions 9.9.x = 9.9.1, 9.5.x = 9.5.7, 9.10.x = 9.10.0...

Improper Access Control

github.com/mattermost/mattermost-server is vulnerable to Improper Access Control. The vulnerability is caused due to a failure to restrict which roles can promote a user as system admin which allows a System Role with edit access to the permissions section of system console to update their role...

Improper Access Control

github.com/mattermost/mattermost-server is vulnerable to Improper Access Control. The vulnerability is caused due to a failure to enforce proper access controls which allows any authenticated user, including guests, to mark any channel inside any team as read for any user...

Improper Access Control

github.com/mattermost/mattermost-server is vulnerable to Improper Access Control. The vulnerability is caused due to a failure to properly enforce permissions which allows a user with systems manager role with read-only access to teams to perform write operations on teams...

Improper Access Control

github.com/mattermost/mattermost-server is vulnerable to Improper Access Control. The vulnerability is caused due to a failure to properly enforce permissions which allows a team admin user without "Add Team Members" permission to disable the invite URL...

Improper Access Control

github.com/mattermost/mattermost-server is vulnerable to Improper Access Control. The vulnerability is caused due to a failure to redact remote user's original email addresses stored in user props when email addresses are otherwise configured not to be visible in the local server...

GO-2022-0604 Cross-site Scripting in Mattermost in github.com/mattermost/mattermost-server

Cross-site Scripting in Mattermost in github.com/mattermost/mattermost-server...

GO-2022-0540 Mattermost users could access some sensitive information via API call in github.com/mattermost/mattermost-server

Mattermost users could access some sensitive information via API call in github.com/mattermost/mattermost-server...

Improper Access Control

github.com/mattermost/mattermost-server is vulnerable to Improper Access Control. The vulnerability is caused due to a failure to validate the source of sync messages and only allow the correct remote IDs. This allows a malicious remote user to set arbitrary RemoteId values for synced users and...

Incorrect Error Handling

github.com/mattermost/mattermost-server is vulnerable to Incorrect Error Handling. The vulnerability is caused due to a failure to properly safeguard an error handling. This allows an attacker to permanently delete local data by abusing dangerous error handling, when share channels were enabled...

Improper Access Control

github.com/mattermost/mattermost-server is vulnerable to Improper Access Control. The vulnerability is caused due to a failure to properly restrict channel creation. This allows a malicious remote user to create arbitrary channels, when shared channels were enabled...

Mattermost Server 9.0.x < 9.9.1 / 9.10.0 / 9.5.x < 9.5.7 (MMSA-2024-00356)

The version of Mattermost Server installed on the remote host is prior to 9.5.7 or 9.9.1 / 9.10.0. It is, therefore, affected by a vulnerability as referenced in the MMSA-2024-00356 advisory. - Mattermost versions 9.9.x = 9.9.0, 9.5.x = 9.5.6 fail to properly validate synced reactions, when share...

Improper Access Control

github.com/mattermost/mattermost-server is vulnerable to Improper Access Control. The vulnerability is caused due to a failure to properly validate that the channel that comes from the sync message is a shared channel, when shared channels are enabled. This allows a malicious remote user to add...

Improper Access Control

github.com/mattermost/mattermost-server is vulnerable to Improper Access Control. The vulnerability is caused due to a failure to properly validate synced reactions, when shared channels are enabled. This allows a malicious remote attacker to create arbitrary reactions on arbitrary posts...

Improper Access Control

github.com/mattermost/mattermost-server is vulnerable to Improper Access Control. The vulnerability is due to the failure to disallow unsolicited invites when shared channels are enabled, This allowing an attacker to send an invite with the ID of an existing local channel, causing that local...

GO-2024-3024 Mattermost allows a user on a remote to set their remote username prop to an arbitrary string in github.com/mattermost/mattermost-server

Mattermost allows a user on a remote to set their remote username prop to an arbitrary string in github.com/mattermost/mattermost-server...

GO-2024-3025 Mattermost failed to disallow the modification of local users when syncing users in shared channels in github.com/mattermost/mattermost-server

Mattermost failed to disallow the modification of local users when syncing users in shared channels in github.com/mattermost/mattermost-server...