Mattermost Server 9.11.x < 9.11.8 / 10.2.x < 10.2.3 / 10.3.x < 10.3.3 / 10.4.x < 10.4.2 (MMSA-2025-00430)

The version of Mattermost Server installed on the remote host is prior to 9.11.8, 10.2.3, 10.3.3, or 10.4.2. It is, therefore, affected by a vulnerability as referenced in the MMSA-2025-00430 advisory. - Mattermost versions 10.4.x = 10.4.1, 9.11.x = 9.11.7, 10.3.x = 10.3.2, 10.2.x = 10.2.2 fail t...

Information Disclosure

github.com/mattermost/mattermost-server is vulnerable to Information Disclosure. The vulnerability is due to failing to filter out DMs from the deleted channels endpoint, allowing an attacker to infer user IDs and other metadata from deleted DMs if they were manually marked as deleted in the...

SUSE CVE-2024-28053

Resource Exhaustion in Mattermost Server versions 8.1.x before 8.1.10 fails to limit the size of the payload that can be read and parsed allowing an attacker to send a very large email payload and crash the server...

Mattermost Server 9.11.x < 9.11.6 / 10.0.x < 10.0.4 / 10.1.x < 10.1.4 / 10.2.x < 10.2.1 DoS (MMSA-2025-00425)

The version of Mattermost Server installed on the remote host is 9.11.x prior to 9.11.6, 10.0.x prior to 10.0.4, 10.1.x prior to 10.1.4, or 10.2.x prior to 10.2.1. It is, therefore, affected by a denial of service vulnerability due to a failure to properly validate post props which allows a...

Mattermost Server 9.11.x < 9.11.6 / 10.0.x < 10.0.4 / 10.1.x < 10.1.4 / 10.2.x < 10.2.1 DoS (MMSA-2024-00402)

The version of Mattermost Server installed on the remote host is 9.11.x prior to 9.11.6, 10.0.x prior to 10.0.4, 10.1.x prior to 10.1.4, or 10.2.x prior to 10.2.0. It is, therefore, affected by a denial of service vulnerability due to a failure to properly validate the style of proto supplied to ...

Mattermost Server 10.0.x < 10.3 (MMSA-2024-00400)

The version of Mattermost Server installed on the remote host is prior to 10.3. It is, therefore, affected by a improper access control vulnerability as referenced in the MMSA-2024-00400 advisory due to a failure to accurately reflect missing settings, which allows confusion for admins regarding ...

Mattermost Server 9.11.x < 9.11.6 (MMSA-2024-00378)

The version of Mattermost Server installed on the remote host is prior to 9.11.6. It is, therefore, affected by a improper access control vulnerability as referenced in the MMSA-2024-00378 advisory. Mattermost versions 9.11.x prior to 9.11.5 fail to enforce invite permissions, which allows team...

Mattermost Server 9.11.x < 9.11.6 / 10.0.x < 10.0.4 / 10.1.x < 10.1.4 / 10.2.x < 10.2.1 DoS (MMSA-2025-00426)

The version of Mattermost Server installed on the remote host is 9.11.x prior to 9.11.6, 10.0.x prior to 10.0.4, 10.1.x prior to 10.1.4, or 10.2.x prior to 10.2.1. It is, therefore, affected by a denial of service vulnerability due to a failure to properly validate post props which allows a...

Mattermost Server 9.11.x < 9.11.6 / 10.0.x < 10.0.4 / 10.1.x < 10.1.4 / 10.2.0 DoS (MMSA-2024-00396)

The version of Mattermost Server installed on the remote host is 9.11.x prior to 9.11.6, 10.0.x prior to 10.0.4, 10.1.x prior to 10.1.4, or 10.2.x 10.0.x prior to 10.2.1. It is, therefore, affected by a denial of service vulnerability due to a failure to properly validate post types. A remote...

GO-2025-3392 Mattermost fails to properly validate post props in github.com/mattermost/mattermost-server

Mattermost fails to properly validate post props in github.com/mattermost/mattermost-server...

Denial Of Service (DoS)

github.com/mattermost/mattermost-server is vulnerable to Denial-of-service DoS vulnerability. The vulnerability is due to improper validation of post types, allowing attackers to exploit a specific post type customplnotification and its props to deny service to users with the sysconsolereadplugin...

GO-2025-3380 Mattermost has Improper Check for Unusual or Exceptional Conditions in github.com/mattermost/mattermost-server

Mattermost has Improper Check for Unusual or Exceptional Conditions in github.com/mattermost/mattermost-server. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing false-positive reports...

Brute-force Attack

github.com/mattermost/mattermost-server is vulnerable to Brute-force Attack. The vulnerability is due to improper synchronization when checking and updating failed login attempts, allowing attackers to bypass the "Max failed attempts" restriction by sending multiple login requests simultaneously...

Mattermost Server 9.5.x < 9.5.13, 9.11.x < 9.11.5, 10.0.x < 10.0.3, 10.1.x < 10.1.3, 10.2.0 (MMSA-2024-00388, MMSA-2024-00392)

The version of Mattermost Server installed on the remote host is prior to 9.5.13, 9.11.5, 10.0.3, 10.1.3 or 10.2.0. It is, therefore, affected by the vulnerabilities as referenced in the MMSA-2024-00388 and MMSA-2024-00392 advisories: - Mattermost fails to prevent concurrently checking and updati...

GO-2024-3338 Mattermost Race Condition vulnerability in github.com/mattermost/mattermost-server

Mattermost Race Condition vulnerability in github.com/mattermost/mattermost-server...

GO-2024-3334 Mattermost Server Resource Exhaustion in github.com/mattermost/mattermost-server

Mattermost Server Resource Exhaustion in github.com/mattermost/mattermost-server...

Mattermost Server 9.5.x < 9.5.12, 9.11.x < 9.11.4, 10.0.x < 10.0.2, 10.1.x < 10.1.2, 10.2.0 (MMSA-2024-00386)

The version of Mattermost Server installed on the remote host is prior to 9.5.12, 9.11.4, 10.0.2, 10.1.2 or 10.2.0. It is, therefore, affected by a vulnerability as referenced in the MMSA-2024-00386 advisory. - Mattermost versions 10.0.x = 10.0.1, 10.1.x = 10.1.1, 9.11.x = 9.11.3, 9.5.x = 9.5.11...

BIT-MATTERMOST-2024-21848

Improper Access Control in Mattermost Server versions 8.1.x before 8.1.11 allows an attacker that is in a channel with an active call to keep participating in the call even if they are removed from the channel...

BIT-MATTERMOST-2024-28053

Resource Exhaustion in Mattermost Server versions 8.1.x before 8.1.10 fails to limit the size of the payload that can be read and parsed allowing an attacker to send a very large email payload and crash the server...

BIT-MATTERMOST-2024-29221

Improper Access Control in Mattermost Server versions 9.5.x before 9.5.2, 9.4.x before 9.4.4, 9.3.x before 9.3.3, 8.1.x before 8.1.11 lacked proper access control in the /api/v4/users/me/teams endpoint allowing a team admin to get the invite ID of their team, thus allowing them to invite users,...