github.com/mattermost/mattermost-plugin-calls vulnerabilities (Go)

3 vulnerabilities.

• github.com/mattermost/mattermost-plugin-calls Go Mattermost Calls plugin exposes TURN server credentials in plaintext in support packets CVE-2026-6347 Fix available 7.6 HighMay 18, 2026
• github.com/mattermost/mattermost-plugin-calls Go DoS in Calls plugin via malformed UTF-8 in WebSocket request CVE-2025-12689 Fix available 6.5 MediumDecember 17, 2025
• github.com/mattermost/mattermost-plugin-calls Go CSRF Allows Call Initiation and Message Delivery CVE-2025-62190 Fix available 4.3 MediumDecember 17, 2025