23 matches found
Missing Authorization
Overview Affected versions of this package are vulnerable to Missing Authorization due to insufficient restriction of the groupconstrained channel flag in the channel patch API. An attacker can remove all participants from a group or direct message conversation by enabling the groupconstrained fl...
Missing Authorization
Overview Affected versions of this package are vulnerable to Missing Authorization due to insufficient restriction of the groupconstrained channel flag in the channel patch API. An attacker can remove all participants from a group or direct message conversation by enabling the groupconstrained fl...
Missing Authorization
Overview Affected versions of this package are vulnerable to Missing Authorization due to insufficient restriction of the groupconstrained channel flag in the channel patch API. An attacker can remove all participants from a group or direct message conversation by enabling the groupconstrained fl...
Missing Authorization
Overview github.com/mattermost/mattermost/server/v8/channels/api4 is a platform for secure collaboration across the entire software development lifecycle Affected versions of this package are vulnerable to Missing Authorization due to insufficient restriction of the groupconstrained channel flag ...
Missing Authorization
Overview Affected versions of this package are vulnerable to Missing Authorization due to insufficient restriction of the groupconstrained channel flag in the channel patch API. An attacker can remove all participants from a group or direct message conversation by enabling the groupconstrained fl...
Missing Authorization
Overview Affected versions of this package are vulnerable to Missing Authorization due to insufficient restriction of the groupconstrained channel flag in the channel patch API. An attacker can remove all participants from a group or direct message conversation by enabling the groupconstrained fl...
CVE-2026-10085 Ordinary group/direct message member can enable group_constrained and remove all channel participants
Mattermost versions 11.7.x = 11.7.2, 11.6.x = 11.6.4, 10.11.x = 10.11.19 fail to restrict the groupconstrained channel flag to public and private channels that support group synchronization, which allows an ordinary group or direct message member to remove all participants from the conversation v...
CVE-2026-10085 Ordinary group/direct message member can enable group_constrained and remove all channel participants
Mattermost versions 11.7.x = 11.7.2, 11.6.x = 11.6.4, 10.11.x = 10.11.19 fail to restrict the groupconstrained channel flag to public and private channels that support group synchronization, which allows an ordinary group or direct message member to remove all participants from the conversation v...
PT-2026-57653
Mattermost versions 11.7.x = 11.7.2, 11.6.x = 11.6.4, 10.11.x = 10.11.19 fail to restrict the group constrained channel flag to public and private channels that support group synchronization, which allows an ordinary group or direct message member to remove all participants from the conversation...
CVE-2026-10085: Missing Authorization
Mattermost versions 11.7.x = 11.7.2, 11.6.x = 11.6.4, 10.11.x = 10.11.19 fail to restrict the groupconstrained channel flag to public and private channels that support group synchronization, which allows an ordinary group or direct message member to remove all participants from the conversation v...
CVE-2026-11860 Insecure Deserialisation via Plaintext HTTP leading to Remote Code Execution in Quick.CMS
Quick.CMS deserializes user-controlled data received over plaintext HTTP without ensuring integrity or authenticity. This allows attackers to tamper with serialized payloads in transit and inject malicious objects. Because deserialization is performed without proper validation or class...
EUVD-2018-13770
Malware in sbrugna...
Unspecified Vulnerability in Mattermost Server (CNVD-2020-41170)
Mattermost Server is the United States Mattermost company's set of open source messaging platform. A security vulnerability exists in Mattermost Server versions prior to 5.1. An attacker non-channel member can exploit the vulnerability to modify the channel using the Channel PATCH API...
CVE-2018-21255
An issue was discovered in Mattermost Server before 5.1. Non-members of a channel could use the Channel PATCH API to modify that channel...
Code injection
An issue was discovered in Mattermost Server before 5.1. Non-members of a channel could use the Channel PATCH API to modify that channel...
CVE-2018-21255
An issue was discovered in Mattermost Server before 5.1. Non-members of a channel could use the Channel PATCH API to modify that channel...
CVE-2018-21255
An issue was discovered in Mattermost Server before 5.1. Non-members of a channel could use the Channel PATCH API to modify that channel...
CVE-2018-21255: Incorrect Permission Assignment for Critical Resource
An issue was discovered in Mattermost Server before 5.1. Non-members of a channel could use the Channel PATCH API to modify that channel...
PT-2020-8898
Name of the Vulnerable Software and Affected Versions Mattermost Server versions prior to 5.1 Description An issue was discovered where non-members of a channel could use the "Channel PATCH API" to modify that channel. Recommendations For versions prior to 5.1, update to version 5.1 or later to...
openSUSE Security Update : openssl-1_0_0 (openSUSE-2019-985)
This update for openssl-100 fixes the following issues : Security issues fixed : - CVE-2018-0734: Fixed timing vulnerability in DSA signature generation bsc1113652. - CVE-2018-5407: Added elliptic curve scalar multiplication timing attack defenses that fixes 'PortSmash' bsc1113534. Non-security...