GHSA-3GPX-P63P-PR5R Mattermost Fails to Enforce Certain Search APIs

Mattermost versions 10.4.x = 10.4.2, 10.3.x = 10.3.3, 9.11.x = 9.11.8 fail to enforce MFA on certain search APIs, which allows authenticated attackers to bypass MFA protections via user search, channel search, or team search queries...

Mattermost Fails to Restrict Bookmark Creation and Updates in Archived Channels

Mattermost versions 10.4.x = 10.4.2, 10.3.x = 10.3.3, 9.11.x = 9.11.8, 10.5.x = 10.5.0 fail to restrict bookmark creation and updates in archived channels, which allows authenticated users created or update bookmarked in archived channels...

CVE-2025-27933 Unauthorized Private-to-Public Channel Conversion

Mattermost versions 10.4.x = 10.4.2, 10.3.x = 10.3.3, 9.11.x = 9.11.8 fail to fail to enforce channel conversion restrictions, which allows members with permission to convert public channels to private ones to also convert private ones to public...

Mattermost Fails to Properly Perform Viewer Role Authorization

Mattermost versions 9.11.x = 9.11.8 fail to properly perform authorization of the Viewer role which allows an attacker with the Viewer role configured with No Access to Reporting to still view team and site statistics...

GO-2025-3480 Mattermost allows reading arbitrary files related to importing boards in github.com/mattermost/mattermost-server

Mattermost allows reading arbitrary files related to importing boards in github.com/mattermost/mattermost-server...

GHSA-Q8P2-2HWC-JW64 vulnerabilities

Vulnerabilities for packages: mattermost, mattermost-fips...

GHSA-5FWX-P6XH-VJRH vulnerabilities

Vulnerabilities for packages: mattermost, mattermost-fips...

Mattermost allows reading arbitrary files related to importing boards

Mattermost versions 10.4.x = 10.4.1, 9.11.x = 9.11.7, 10.3.x = 10.3.2, 10.2.x = 10.2.2 fail to properly validate board blocks when importing boards which allows an attacker could read any arbitrary file on the system via importing and exporting a specially crafted import archive in Boards...

Mattermost allows reading arbitrary files

Mattermost versions 10.4.x = 10.4.1, 9.11.x = 9.11.7, 10.3.x = 10.3.2, 10.2.x = 10.2.2 fail to properly validate input when patching and duplicating a board, which allows a user to read any arbitrary file on the system via duplicating a specially crafted block in Boards...

GHSA-V469-7WP6-7CVP vulnerabilities

Vulnerabilities for packages: mattermost, mattermost-fips...

CVE-2025-20051 vulnerabilities

Vulnerabilities for packages: mattermost, mattermost-fips...

CVE-2025-25279 vulnerabilities

Vulnerabilities for packages: mattermost, mattermost-fips...

CVE-2025-24526 vulnerabilities

Vulnerabilities for packages: mattermost, mattermost-fips...

CVE-2025-1412 vulnerabilities

Vulnerabilities for packages: mattermost, mattermost-fips...

GO-2025-3379 Mattermost Improper Validation of Specified Type of Input vulnerability in github.com/mattermost/mattermost-server

Mattermost Improper Validation of Specified Type of Input vulnerability in github.com/mattermost/mattermost-server. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing false-positive repor...

GHSA-7RGP-4J56-FM79 vulnerabilities

Vulnerabilities for packages: mattermost, mattermost-fips...

Improper Access Control

github.com/mattermost/mattermost is vulnerable to Improper Access Control. The vulnerability is caused by an incorrect authorization in the /plugins/focalboard/api/v2/users endpoint. This can lead to an attacker who is a guest user and knows the ID of another user to get their information e.g...