SUSE CVE-2016-11084

An issue was discovered in Mattermost Server before 2.1.0. It allows XSS via CSRF...

SUSE CVE-2017-18872

An issue was discovered in Mattermost Server before 4.4.3 and 4.3.3. Attackers could reconfigure an OAuth app in some cases where Mattermost is an OAuth 2.0 service provider...

GO-2025-4036 Mattermost has an Observable Timing Discrepancy vulnerability in github.com/mattermost/mattermost-server

Mattermost has an Observable Timing Discrepancy vulnerability in github.com/mattermost/mattermost-server...

GO-2025-4057 Mattermost Server exposes sensitive information via its System Console UI in github.com/mattermost/mattermost-server

Mattermost Server exposes sensitive information via its System Console UI in github.com/mattermost/mattermost-server...

GO-2025-4066 Mattermost Server allows XSS via CSRF in github.com/mattermost/mattermost-server

Mattermost Server allows XSS via CSRF in github.com/mattermost/mattermost-server...

GO-2025-4035 Mattermost has a Missing Authorization vulnerability in github.com/mattermost/mattermost-server

Mattermost has a Missing Authorization vulnerability in github.com/mattermost/mattermost-server. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing false-positive reports from vulnerabili...

GO-2025-4050 Mattermost Server is vulnerable to XSS through customizable theme color-code values in github.com/mattermost/mattermost-server

Mattermost Server is vulnerable to XSS through customizable theme color-code values in github.com/mattermost/mattermost-server...

GO-2025-4058 Mattermost Server is vulnerable to XSS through lack of link relationship attributes `noreferrer` and `noopener` in github.com/mattermost/mattermost-server

Mattermost Server is vulnerable to XSS through lack of link relationship attributes noreferrer and noopener in github.com/mattermost/mattermost-server...

GO-2025-4045 Mattermost Server vulnerable to Cross-site Scripting through file preview feature in github.com/mattermost/mattermost-server

Mattermost Server vulnerable to Cross-site Scripting through file preview feature in github.com/mattermost/mattermost-server...

GO-2025-4053 Mattermost Server allows XSS via redirect URL in github.com/mattermost/mattermost-server

Mattermost Server allows XSS via redirect URL in github.com/mattermost/mattermost-server...

GO-2025-4056 Mattermost Server is vulnerable to XSS via a Legal or Support setting in github.com/mattermost/mattermost-server

Mattermost Server is vulnerable to XSS via a Legal or Support setting in github.com/mattermost/mattermost-server...

GO-2025-4075 Mattermost Server's OAuth 2.0 service is vulnerable to attack through Missing Authorization in github.com/mattermost/mattermost-server

Mattermost Server's OAuth 2.0 service is vulnerable to attack through Missing Authorization in github.com/mattermost/mattermost-server...

GO-2025-4060 Mattermost Server allows System Admin to modify LDAP account names and email addresses in github.com/mattermost/mattermost-server

Mattermost Server allows System Admin to modify LDAP account names and email addresses in github.com/mattermost/mattermost-server...

GO-2025-4059 Mattermost Server: Insufficient Password-Reset Link Invalidation in github.com/mattermost/mattermost-server

Mattermost Server: Insufficient Password-Reset Link Invalidation in github.com/mattermost/mattermost-server...

GO-2025-4062 Mattermost Server exposes information stored by a web browser in github.com/mattermost/mattermost-server

Mattermost Server exposes information stored by a web browser in github.com/mattermost/mattermost-server...

GO-2025-4031 Guest user can discover active public channels in github.com/mattermost/mattermost-server

Guest user can discover active public channels in github.com/mattermost/mattermost-server...

GO-2025-4061 Mattermost Server exposes sensitive information about team URLs via an API in github.com/mattermost/mattermost-server

Mattermost Server exposes sensitive information about team URLs via an API in github.com/mattermost/mattermost-server. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing false-positive...

GO-2025-4030 Mattermost has an Incorrect Authorization vulnerability in github.com/mattermost/mattermost-server

Mattermost has an Incorrect Authorization vulnerability in github.com/mattermost/mattermost-server...

GO-2025-4063 Mattermost Server exposes account details to any Team Administrator in github.com/mattermost/mattermost-server

Mattermost Server exposes account details to any Team Administrator in github.com/mattermost/mattermost-server...

GO-2025-4054 Mattermost Server does not check if cookies are used over SSL in github.com/mattermost/mattermost-server

Mattermost Server does not check if cookies are used over SSL in github.com/mattermost/mattermost-server...