github.com/mattermost/mattermost-server vulnerabilities (Go)
296 vulnerabilities.
-
github.com/mattermost/mattermost-serverGo User Manager can demote bot accounts to guest without bot-management permission 3.8 Low -
github.com/mattermost/mattermost-serverGo IDOR in Jira plugin subscription edit endpoint 6.4 Medium -
github.com/mattermost/mattermost-serverGo Mattermost Jira plugin had unauthenticated {{/ac/installed}} lifecycle callback during pending Jira Cloud install 6.4 Medium -
github.com/mattermost/mattermost-serverGo Improper Permission Check Allows User Manager to Deactivate Bot Accounts 3.8 Low -
github.com/mattermost/mattermost-serverGo Global session revocation does not invalidate active WebSocket connections 4.3 Medium -
github.com/mattermost/mattermost-serverGo GitLab Plugin Allows Non-Admin Users to Modify Default Instance Configuration 5.4 Medium -
github.com/mattermost/mattermost-serverGo CVE-2026-6961: Path traversal via unsanitized FileInfo.Name in Mattermost federation sync 7.6 High -
github.com/mattermost/mattermost-serverGo Mattermost group syncable endpoints allow privilege escalation via scheme_admin 8.8 High -
github.com/mattermost/mattermost-serverGo Plugin bot username conflict allows user account to be used as bot identity in Mattermost Server 5.3 Medium -
github.com/mattermost/mattermost-serverGo *Missing* {{invite_user}} *permission check on team creation allows unprivileged users to set open-invite and allowed-domains team settings* 4.3 Medium -
github.com/mattermost/mattermost-serverGo Mattermost Remote Cluster PATCH API Leaks Authentication Tokens 6.5 Medium -
github.com/mattermost/mattermost-serverGo Mattermost: Delegated admins could patch protected default system roles 6.7 Medium -
github.com/mattermost/mattermost-serverGo Mattermost fails to scope role_updated websocket events to authorized team and channel members 4.3 Medium -
github.com/mattermost/mattermost-serverGo Server panic via outgoing webhook responses 6.5 Medium -
github.com/mattermost/mattermost-serverGo GitHub OAuth Scope Validation 5.4 Medium -
github.com/mattermost/mattermost-serverGo Persistent notification timing attack causing server denial of service 6.5 Medium -
github.com/mattermost/mattermost-serverGo Improper file ownership validation in the Boards API allows unauthorised file access 5.9 Medium -
github.com/mattermost/mattermost-serverGo Insufficient input validation in GitHub plugin API causes denial of service 4.3 Medium -
github.com/mattermost/mattermost-serverGo Sanitize team member data returned by API 4.3 Medium -
github.com/mattermost/mattermost-serverGo Unauthenticated WebSocket binary frame causes denial of service in Mattermost Server 7.5 High -
github.com/mattermost/mattermost-serverGo Missing request body size limits on Zoom plugin HTTP endpoints 4.9 Medium -
github.com/mattermost/mattermost-serverGo Denial of service via crafted TIFF file upload 6.5 Medium -
github.com/mattermost/mattermost-serverGo Path traversal in integration action URL leading to arbitrary API execution via system admin’s auth token. 8.0 High -
github.com/mattermost/mattermost-serverGo Insufficient permission validation on cross-team playbook run creation 4.3 Medium -
github.com/mattermost/mattermost-serverGo SSRF via Host Header Spoofing in Custom Slash Commands 3.5 Low -
github.com/mattermost/mattermost-serverGo Prevent password disclosure and force reset during Slack import 6.5 Medium -
github.com/mattermost/mattermost-serverGo Sensitive credentials exposed in plaintext in Mattermost support packets 8.7 High -
github.com/mattermost/mattermost-serverGo Slash command trigger-word update allowed command hijacking 4.3 Medium -
github.com/mattermost/mattermost-serverGo Mattermost Playbooks Plugin fails to enforce view permissions in list endpoints, allowing unauthorized access to public playbooks 4.3 Medium -
github.com/mattermost/mattermost-serverGo Mattermost Calls plugin exposes TURN server credentials in plaintext in support packets 7.6 High -
github.com/mattermost/mattermost-serverGo Missing authorization check in AI message rewrite endpoint allows access to private thread content 6.5 Medium -
github.com/mattermost/mattermost-serverGo Playbooks Plugin fails to validate team transfers, allowing unauthorized removal of member access via playbook update 3.1 Low -
github.com/mattermost/mattermost-serverGo Missing request origin validation on burn-on-read reveal endpoint 4.3 Medium -
github.com/mattermost/mattermost-serverGo Memory Exhaustion via Malicious 7zip File Upload 4.3 Medium -
github.com/mattermost/mattermost-serverGo Unescaped variables during error page composition 3.8 Low -
github.com/mattermost/mattermost-serverGo Insufficient token rotation validation in remote cluster invite confirmation 3.7 Low -
github.com/mattermost/mattermost-serverGo Mattermost fails to enforce create_post permission when editing posts 4.3 Medium -
github.com/mattermost/mattermost-serverGo Improper Input Validation in MS Teams Meetings API Handler 4.3 Medium -
github.com/mattermost/mattermost-serverGo Insufficient authorization in shared channel membership sync allows remote cluster to remove users from arbitrary channels 4.3 Medium -
github.com/mattermost/mattermost-serverGo OAuth authorization code client binding not enforced during token redemption in Mattermost 3.1 Low -
github.com/mattermost/mattermost-serverGo post edit time limit is not enforced on some post update operations 3.1 Low -
github.com/mattermost/mattermost-serverGo SVG content served through Mattermost image proxy despite Content-Type restrictions causes client-side denial of service 4.3 Medium -
github.com/mattermost/mattermost-serverGo Race Condition in Guest Magic Link Authentication Allows Token Reuse 6.5 Medium -
github.com/mattermost/mattermost-serverGo CSRF Protection Bypass Allows Updating a User's Authentication Method 6.8 Medium -
github.com/mattermost/mattermost-serverGo Connected Workspaces: Malicious remote server can manipulate arbitrary user's status 2.7 Low -
github.com/mattermost/mattermost-serverGo Arbitrary File Read via Advanced Logging Support Packet 6.8 Medium -
github.com/mattermost/mattermost-serverGo Guest users can view group member IDs without respecting view restrictions 4.3 Medium -
github.com/mattermost/mattermost-serverGo Zip Bomb Denial of Service via Unrestricted Archive Decompression 6.5 Medium -
github.com/mattermost/mattermost-serverGo mmctl export download command doesn’t restrict permissions to created file to file owner 5.0 Medium -
github.com/mattermost/mattermost-serverGo Terminal Escape Injection in mmctl Report Posts Command 8.0 High - Show olderLoading…