Mattermost Server 9.5.x < 9.5.9 (MMSA-2024-00358)

The version of Mattermost Server installed on the remote host is prior to 9.5.9. It is, therefore, affected by a vulnerability as referenced in the MMSA-2024-00358 advisory. - Mattermost versions 9.5.x = 9.5.8 fail to properly authorize access to archived channels when viewing archived channels i...

Mattermost Server 9.5.x < 9.5.8 / 9.8.x < 9.8.3 / 9.9.x < 9.9.2 / 9.10.x < 9.10.1 (MMSA-2024-00374)

The version of Mattermost Server installed on the remote host is prior to 9.5.8, 9.8.3, 9.9.2, or 9.10.1. It is, therefore, affected by a vulnerability as referenced in the MMSA-2024-00374 advisory. - Mattermost versions 9.9.x = 9.9.1, 9.5.x = 9.5.7, 9.10.x = 9.10.0 and 9.8.x = 9.8.2 fail to...

Mattermost Server 9.5.x < 9.5.8 / 9.10.x < 9.10.1 (MMSA-2024-00359)

The version of Mattermost Server installed on the remote host is prior to 9.5.8 or 9.10.1. It is, therefore, affected by a vulnerability as referenced in the MMSA-2024-00359 advisory. - Mattermost versions 9.5.x = 9.5.7 and 9.10.x = 9.10.0 fail to time limit and size limit the CA path file in the...

Mattermost Server 9.5.x < 9.5.9 / 9.9.x < 9.9.2 / 9.10.x < 9.10.2 / 9.11.x < 9.11.1 (MMSA-2024-00351)

The version of Mattermost Server installed on the remote host is prior to 9.5.9, 9.9.2, 9.10.2, or 9.11.1. It is, therefore, affected by a vulnerability as referenced in the MMSA-2024-00351 advisory. - Mattermost versions 9.11.x = 9.11.0, 9.10.x = 9.10.1, 9.9.x = 9.9.2 and 9.5.x = 9.5.8 fail to...

GO-2024-3093 Mattermost doesn't redact remote users' original email addresses in github.com/mattermost/mattermost-server

Mattermost doesn't redact remote users' original email addresses in github.com/mattermost/mattermost-server...

GO-2024-3091 Mattermost allows user with systems manager role with read-only access to teams to perform write operations on teams in github.com/mattermost/mattermost-server

Mattermost allows user with systems manager role with read-only access to teams to perform write operations on teams in github.com/mattermost/mattermost-server...

Unauthorized Session Creation And Password Reset

github.com/mattermost/mattermost-server is vulnerable to Unauthorized Session Creation And Password Reset. The vulnerability is due to a lack of proper validation for remote/synthetic users due to a shared channel configuration. This allows attackers to create munged email addresses using shared...

Mattermost Server 9.10.x < 9.10.1 / 9.5.x < 9.5.8 (MMSA-2024-00352)

The version of Mattermost Server installed on the remote host is 9.5.x prior to 9.5.8 or 9.10.0 prior to 9.10.1. It is, therefore, affected by a vulnerability as referenced in the MMSA-2024-00352 advisory. - Mattermost versions 9.5.x = 9.5.7, 9.10.x = 9.10.0 fail to properly enforce permissions...

Mattermost Server 9.5.x < 9.5.8 / 9.8.x < 9.8.3 / 9.9.x < 9.9.2 / 9.10.x < 9.10.1 Multiple Vulnerabilities (MMSA-2024-00353/MMSA-2024-00357)

The version of Mattermost Server installed on the remote host is prior to 9.10.1, 9.5.8, 9.8.3, or 9.9.2. It is, therefore, affected by multiple vulnerabilities as referenced in the MMSA-2024-00353 and MMSA-2024-00357 advisories. - Mattermost versions 9.9.x = 9.9.1, 9.5.x = 9.5.7, 9.10.x = 9.10.0...

Improper Access Control

github.com/mattermost/mattermost-server is vulnerable to Improper Access Control. The vulnerability is caused due to a failure to restrict which roles can promote a user as system admin which allows a System Role with edit access to the permissions section of system console to update their role...

Improper Access Control

github.com/mattermost/mattermost-server is vulnerable to Improper Access Control. The vulnerability is caused due to a failure to enforce proper access controls which allows any authenticated user, including guests, to mark any channel inside any team as read for any user...

Improper Access Control

github.com/mattermost/mattermost-server is vulnerable to Improper Access Control. The vulnerability is caused due to a failure to properly enforce permissions which allows a user with systems manager role with read-only access to teams to perform write operations on teams...

Improper Access Control

github.com/mattermost/mattermost-server is vulnerable to Improper Access Control. The vulnerability is caused due to a failure to properly enforce permissions which allows a team admin user without "Add Team Members" permission to disable the invite URL...

Improper Access Control

github.com/mattermost/mattermost-server is vulnerable to Improper Access Control. The vulnerability is caused due to a failure to redact remote user's original email addresses stored in user props when email addresses are otherwise configured not to be visible in the local server...

GO-2022-0604 Cross-site Scripting in Mattermost in github.com/mattermost/mattermost-server

Cross-site Scripting in Mattermost in github.com/mattermost/mattermost-server...

GO-2022-0540 Mattermost users could access some sensitive information via API call in github.com/mattermost/mattermost-server

Mattermost users could access some sensitive information via API call in github.com/mattermost/mattermost-server...

Improper Access Control

github.com/mattermost/mattermost-server is vulnerable to Improper Access Control. The vulnerability is caused due to a failure to validate the source of sync messages and only allow the correct remote IDs. This allows a malicious remote user to set arbitrary RemoteId values for synced users and...

Incorrect Error Handling

github.com/mattermost/mattermost-server is vulnerable to Incorrect Error Handling. The vulnerability is caused due to a failure to properly safeguard an error handling. This allows an attacker to permanently delete local data by abusing dangerous error handling, when share channels were enabled...

Improper Access Control

github.com/mattermost/mattermost-server is vulnerable to Improper Access Control. The vulnerability is caused due to a failure to properly restrict channel creation. This allows a malicious remote user to create arbitrary channels, when shared channels were enabled...

Mattermost Server 9.0.x < 9.9.1 / 9.10.0 / 9.5.x < 9.5.7 (MMSA-2024-00356)

The version of Mattermost Server installed on the remote host is prior to 9.5.7 or 9.9.1 / 9.10.0. It is, therefore, affected by a vulnerability as referenced in the MMSA-2024-00356 advisory. - Mattermost versions 9.9.x = 9.9.0, 9.5.x = 9.5.6 fail to properly validate synced reactions, when share...