1648 matches found
Mattermost Server 9.11.x < 9.11.9 / 10.3.x < 10.3.4 / 10.4.x < 10.4.3 (MMSA-2025-00418)
The version of Mattermost Server installed on the remote host is prior to 9.11.9, 10.3.4, or 10.4.3. It is, therefore, affected by a vulnerability as referenced in the MMSA-2025-00418 advisory. - Mattermost versions 10.4.x = 10.4.2, 10.3.x = 10.3.3, 9.11.x = 9.11.8 fail to fail to enforce channel...
Mattermost Server 9.11.x < 9.11.9 / 10.3.x < 10.3.4 / 10.4.x < 10.4.3 (MMSA-2025-00421)
The version of Mattermost Server installed on the remote host is prior to 9.11.9, 10.3.4, or 10.4.3. It is, therefore, affected by a vulnerability as referenced in the MMSA-2025-00421 advisory. - Mattermost versions 10.4.x = 10.4.2, 10.3.x = 10.3.3, 9.11.x = 9.11.8 fail to restrict command...
Mattermost Server 9.11.x < 9.11.9 / 10.3.x < 10.3.4 / 10.4.x < 10.4.3 / 10.5 (MMSA-2025-00444)
The version of Mattermost Server installed on the remote host is prior to 9.11.9, 10.3.4, 10.4.3, or 10.5. It is, therefore, affected by a vulnerability as referenced in the MMSA-2025-00444 advisory. - Mattermost versions 10.4.x = 10.4.2, 10.3.x = 10.3.3, 9.11.x = 9.11.8, 10.5.x = 10.5.0 fail to...
Incorrect Authorization
Overview Affected versions of this package are vulnerable to Incorrect Authorization when an admin user adds itself to a private channel by clicking a permalink. Remediation Upgrade github.com/mattermost/mattermost/server/channels/api4 to version 9.11.9-rc1 or higher. References - GitHub Commit...
Incorrect Authorization
Overview Affected versions of this package are vulnerable to Incorrect Authorization due to improper enforcement of channel conversion restrictions. An attacker can exploit this flaw to change channel visibility settings without proper authorization by manipulating channel settings. Remediation...
Missing Authentication for Critical Function
Overview Affected versions of this package are vulnerable to Missing Authentication for Critical Function due to servePluginRequest failing to enforce multifactor authentication for plugins, even when MFA is meant to be enabled. Remediation Upgrade...
Unauthorized Channel Content Export
github.com/mattermost/mattermost-server is vulnerable to unauthorized channel content export. The vulnerability is due to improper access control due to failing to restrict channel export of archived channels when the "Allow users to view archived channels" setting is disabled...
Arbitrary File Read
github.com/mattermost/mattermost-server is vulnerable to Arbitrary File Read. The vulnerability is due to improper validation of board blocks when importing boards, which allows an attacker to perform a path traversal attack by importing and exporting a specially crafted import archive in Boards...
Session Fixation
github.com/mattermost/mattermost-server is vulnerable to Session Fixation. The vulnerability is due to improper session invalidation when converting a user to a bot, allows the user to retain their previous session and potentially escalate privileges based on the bot’s assigned permissions...
Mattermost Server 9.11.x < 9.11.8 / 10.2.x < 10.2.3 / 10.3.x < 10.3.3 / 10.4.x < 10.4.2 (MMSA-2025-00430)
The version of Mattermost Server installed on the remote host is prior to 9.11.8, 10.2.3, 10.3.3, or 10.4.2. It is, therefore, affected by a vulnerability as referenced in the MMSA-2025-00430 advisory. - Mattermost versions 10.4.x = 10.4.1, 9.11.x = 9.11.7, 10.3.x = 10.3.2, 10.2.x = 10.2.2 fail t...
Mattermost Server 9.11.x < 9.11.7 / 10.4.x < 10.4.2 (MMSA-2025-00414)
The version of Mattermost Server installed on the remote host is prior to 9.11.7 or 10.4.2. It is, therefore, affected by a vulnerability as referenced in the MMSA-2025-00414 advisory. - Mattermost versions 9.11.x = 9.11.6, 10.4.x = 10.4.1 fail to invalidate all active sessions when converting a...
Information Disclosure
github.com/mattermost/mattermost-server is vulnerable to Information Disclosure. The vulnerability is due to failing to filter out DMs from the deleted channels endpoint, allowing an attacker to infer user IDs and other metadata from deleted DMs if they were manually marked as deleted in the...
SUSE CVE-2024-28053
Resource Exhaustion in Mattermost Server versions 8.1.x before 8.1.10 fails to limit the size of the payload that can be read and parsed allowing an attacker to send a very large email payload and crash the server...
Mattermost Server 9.11.x < 9.11.6 / 10.0.x < 10.0.4 / 10.1.x < 10.1.4 / 10.2.x < 10.2.1 DoS (MMSA-2024-00402)
The version of Mattermost Server installed on the remote host is 9.11.x prior to 9.11.6, 10.0.x prior to 10.0.4, 10.1.x prior to 10.1.4, or 10.2.x prior to 10.2.0. It is, therefore, affected by a denial of service vulnerability due to a failure to properly validate the style of proto supplied to ...
Mattermost Server 9.11.x < 9.11.6 / 10.0.x < 10.0.4 / 10.1.x < 10.1.4 / 10.2.x < 10.2.1 DoS (MMSA-2025-00426)
The version of Mattermost Server installed on the remote host is 9.11.x prior to 9.11.6, 10.0.x prior to 10.0.4, 10.1.x prior to 10.1.4, or 10.2.x prior to 10.2.1. It is, therefore, affected by a denial of service vulnerability due to a failure to properly validate post props which allows a...
Mattermost Server 10.0.x < 10.3 (MMSA-2024-00400)
The version of Mattermost Server installed on the remote host is prior to 10.3. It is, therefore, affected by a improper access control vulnerability as referenced in the MMSA-2024-00400 advisory due to a failure to accurately reflect missing settings, which allows confusion for admins regarding ...
Mattermost Server 9.11.x < 9.11.6 / 10.0.x < 10.0.4 / 10.1.x < 10.1.4 / 10.2.x < 10.2.1 DoS (MMSA-2025-00425)
The version of Mattermost Server installed on the remote host is 9.11.x prior to 9.11.6, 10.0.x prior to 10.0.4, 10.1.x prior to 10.1.4, or 10.2.x prior to 10.2.1. It is, therefore, affected by a denial of service vulnerability due to a failure to properly validate post props which allows a...
Mattermost Server 9.11.x < 9.11.6 (MMSA-2024-00378)
The version of Mattermost Server installed on the remote host is prior to 9.11.6. It is, therefore, affected by a improper access control vulnerability as referenced in the MMSA-2024-00378 advisory. Mattermost versions 9.11.x prior to 9.11.5 fail to enforce invite permissions, which allows team...
Mattermost Server 9.11.x < 9.11.6 / 10.0.x < 10.0.4 / 10.1.x < 10.1.4 / 10.2.0 DoS (MMSA-2024-00396)
The version of Mattermost Server installed on the remote host is 9.11.x prior to 9.11.6, 10.0.x prior to 10.0.4, 10.1.x prior to 10.1.4, or 10.2.x 10.0.x prior to 10.2.1. It is, therefore, affected by a denial of service vulnerability due to a failure to properly validate post types. A remote...
