CVE-2019-20886

An issue was discovered in Mattermost Server before 5.8.0. The first user is sometimes inadvertently a system admin...

CVE-2018-21263

An issue was discovered in Mattermost Server before 4.7.0, 4.6.2, and 4.5.2. An attacker could authenticate to a different user's account via a crafted SAML response...

CVE-2018-21263

Mattermost Server vulnerability CVE-2018-21263 affects versions prior to 4.7.0, 4.6.2, and 4.5.2. A crafted SAML response could allow an attacker to authenticate to another user’s account. Root cause details are not further provided in the documents. Impact is limited to authentication against a ...

CVE-2018-21258

An issue was discovered in Mattermost Server before 5.1. It allows attackers to cause a denial of service via the invitepeople slash command...

CVE-2018-21258

Mattermost Server vulnerability CVE-2018-21258: pre-5.1 builds are vulnerable to a denial-of-service via the invite_people slash command. Exploitation details are not provided in the documents. Affected product is Mattermost Server prior to version 5.1; remediation is to upgrade to 5.1 or later.

CVE-2018-21253

An issue was discovered in Mattermost Server before 5.1, 5.0.2, and 4.10.2. An attacker could use the invitepeople slash command to invite a non-permitted user...

CVE-2018-21253

Mattermost Server vulnerable before versions 5.1, 5.0.2, and 4.10.2. An attacker could abuse the invite_people slash command to invite a non-permitted user. The issue is documented across multiple sources (e.g., NVD, Red Hat, CNVD) with the core impact limited to inviting unauthorized users; no e...

CVE-2019-20890

Mattermost Server prior to 5.7 contains a vulnerability that allows bypassing email address discovery restrictions. This is recorded as CVE-2019-20890 and appears across multiple sources (NVD, Red Hat, CNVD, CVE lists). The issue is described consistently as an issue in Mattermost Server before 5...

CVE-2019-20890

An issue was discovered in Mattermost Server before 5.7. It allows a bypass of e-mail address discovery restrictions...

CVE-2019-20884

An issue was discovered in Mattermost Server before 5.8.0. It allows attackers to partially attach a file to more than one post...

CVE-2019-20884

Mattermost Server prior to 5.8.0 has a vulnerability that allows attackers to partially attach a file to more than one post. The connected documents confirm the issue and the affected version range, but no concrete root-cause, exploit details, or mitigation steps are provided in the texts. Remedi...

CVE-2019-20887

An issue was discovered in Mattermost Server before 5.7.1, 5.6.4, 5.5.3, and 4.10.6. It does not honor flags API permissions when deciding whether a user can receive intra-team posts...

CVE-2019-20887

Mattermost Server versions affected: before 5.7.1, 5.6.4, 5.5.3, and 4.10.6. The issue is that flags API permissions are not honored when deciding whether a user can receive intra‑team posts. Root cause and exact impact are not deeply elaborated in the provided documents beyond this behavior, but...

CVE-2019-20885

An issue was discovered in Mattermost Server before 5.8.0. It does not always generate a robots.txt file...

CVE-2019-20885

Mattermost Server prior to 5.8.0 may not consistently generate a robots.txt file. Affected product is Mattermost Server; the issue is that robots.txt generation is not guaranteed, but the exact root cause, affected versions beyond 5.8.0, potential impact, exploitation details, and remediations ar...

CVE-2019-20883

An issue was discovered in Mattermost Server before 5.8.0, when Town Square is set to Read-Only. Users can pin or unpin a post...

CVE-2019-20883

Mattermost Server vulnerable prior to version 5.8.0 when Town Square is set to Read-Only. An attacker could pin or unpin a post, as described in CVE-2019-20883. The issue affects Mattermost Server

CVE-2019-20882

Mattermost Server before 5.8.0 does not honor the domain requirement when processing a join request for an open/public team. Root cause: domain validation in the join flow is insufficient, enabling potential unauthorized joining of public teams (exploit described in CNVD/DOCs). Affected version r...

CVE-2019-20882

An issue was discovered in Mattermost Server before 5.8.0. It does not honor the domain requirement when processing a join request for an open team...

CVE-2019-20881

CVE-2019-20881 affects Mattermost Server prior to 5.8.0, where brute-force handling of MFA is mishandled. Root cause is improper handling of MFA brute-force attempts, allowing continued attempts that could weaken MFA effectiveness. Affects Mattermost Server versions before 5.8.0; CVSS base scores...