PYSEC-2026-3598 Open WebUI: /api/v1/channels/{id}/members exposes full user model including sensitive credentials

Summary The channel members endpoint serializes and returns full user models for channel participants, including settings objects. A normal user in a DM can retrieve admin-only sensitive configuration such as webhook URLs and tool server key material settings.ui.toolServers.key, which is not...

EUVD-2018-13769

Malware in sbrugna...

CVE-2019-20844

An issue was discovered in Mattermost Server before 5.18.0, 5.17.2, 5.16.4, 5.15.4, and 5.9.7. An attacker can spoof a direct-message channel by changing the type of a channel...

CVE-2018-21254: Incorrect Permission Assignment for Critical Resource

An issue was discovered in Mattermost Server before 5.1. An attacker can bypass intended access control for direct-message channel creation via the Message slash command...