CVE-2018-21255

An issue was discovered in Mattermost Server before 5.1. Non-members of a channel could use the Channel PATCH API to modify that channel...

CVE-2018-21255

The CVE-2018-21255 issue affects Mattermost Server prior to 5.1, where non-members of a channel could use the Channel PATCH API to modify that channel. The connected documents corroborate this vulnerability across multiple sources (Red Hat, CNVD, OSV, NVD, CVE lists) without providing concrete ex...

CVE-2018-21254

Mattermost Server before 5.1 contains a vulnerability where an attacker can bypass access control for direct-message channel creation via the Message slash command. Affected component: Mattermost Server (pre-5.1). Root cause and exact underlying mechanism are not detailed in the provided document...

CVE-2018-21254

An issue was discovered in Mattermost Server before 5.1. An attacker can bypass intended access control for direct-message channel creation via the Message slash command...

CVE-2018-21260

CVE-2018-21260 affects Mattermost Server versions before 4.8.1, 4.7.4, and 4.6.3. The issue arises from WebSocket events being accidentally sent during certain user-management operations, leading to potential user-privacy disclosure. The available documents confirm the vulnerable component (Matte...

CVE-2018-21260

An issue was discovered in Mattermost Server before 4.8.1, 4.7.4, and 4.6.3. WebSocket events were accidentally sent during certain user-management operations, violating user privacy...

CVE-2018-21251

CVE-2018-21251 affects Mattermost Server versions before 5.2 and 5.1.1. The issue allows an authorization bypass when the channel name differs between request parameters and the body. The provided documents do not specify a root cause beyond this mismatch, nor any CVE remediation (patch version o...

CVE-2018-21251

An issue was discovered in Mattermost Server before 5.2 and 5.1.1. Authorization could be bypassed if the channel name were not the same in the params and the body...

CVE-2018-21249

Mattermost Server prior to version 5.3.0 is affected by a timing mishandling issue. Affected product: Mattermost Server (versions before 5.3.0). Root cause: timing mishandling in the server. Reported impact is limited in the provided materials, with CVSS indicating low to medium severity (base sc...

CVE-2018-21249

An issue was discovered in Mattermost Server before 5.3.0. It mishandles timing...

CVE-2017-18875

Mattermost Server before 4.3.0, 4.2.1, and 4.1.2 is vulnerable when local storage for files is used. A System Admin can create arbitrary files due to the underlying issue. Connected sources (SUSE SU-2025 and related advisories) confirm the affected versions and the same impact, but the provided d...

CVE-2017-18870

Mattermost Server before 4.5.0, 4.4.5, and 4.3.4 has a flaw in webhook access control under EnableOnlyAdminIntegrations. Root cause: mishandled webhook access control. Impact: as described in CNVD-2020-35445, an attacker could spoof requests to edit other users’ webhooks. No specific exploit deta...

CVE-2017-18870

An issue was discovered in Mattermost Server before 4.5.0, 4.4.5, and 4.3.4. It mishandled webhook access control in the EnableOnlyAdminIntegrations case...

CVE-2018-21259

An issue was discovered in Mattermost Server before 4.10.1, 4.9.4, and 4.8.2. It allows attackers to cause a denial of service application hang via a malformed link in a channel...

CVE-2018-21259

Summary (CVE-2018-21259) : Mattermost Server prior to 4.10.1, 4.9.4, and 4.8.2 is affected. A malformed link in a channel can cause a denial of service (application hang). The connected documents confirm the affected versions and the impact but do not provide a published fix version or remediatio...

CVE-2019-20889

Mattermost Server is vulnerable to a permissions handling flaw in user-access token creation in versions prior to 5.7, 5.6.3, 5.5.2, and 4.10.5. Root cause: improper handling of permissions when creating user-access tokens. The provided documents do not include exploitation details or remediation...

CVE-2019-20889

An issue was discovered in Mattermost Server before 5.7, 5.6.3, 5.5.2, and 4.10.5. It mishandles permissions for user-access token creation...

CVE-2018-21248

Mattermost Server prior to 5.4.0 is affected by an issue that mishandles possession of superfluous authentication credentials. The CVSS-3.1 base score is 7.5 (HIGH) with NETWORK attack vector, no privileges required, and HIGH impact on confidentiality (I: HIGH, C: HIGH) per the advisory. Root cau...

CVE-2018-21248

An issue was discovered in Mattermost Server before 5.4.0. It mishandles possession of superfluous authentication credentials...

CVE-2019-20888

Mattermost Server contains a denial-of-service vulnerability (memory consumption) impacting versions before 5.7, 5.6.3, 5.5.2, and 4.10.5. The issue can be triggered by processing inputs from outgoing webhooks or slash command integrations. Red Hat and CNVD entries corroborate the affected versio...