github.com/mattermost/mattermost-server/v5 vulnerabilities (Go)
199 vulnerabilities.
-
github.com/mattermost/mattermost-server/v5Go User Manager can demote bot accounts to guest without bot-management permission 3.8 Low -
github.com/mattermost/mattermost-server/v5Go CVE-2026-6961: Path traversal via unsanitized FileInfo.Name in Mattermost federation sync 7.6 High -
github.com/mattermost/mattermost-server/v5Go Mattermost group syncable endpoints allow privilege escalation via scheme_admin 8.8 High -
github.com/mattermost/mattermost-server/v5Go Plugin bot username conflict allows user account to be used as bot identity in Mattermost Server 5.3 Medium -
github.com/mattermost/mattermost-server/v5Go *Missing* {{invite_user}} *permission check on team creation allows unprivileged users to set open-invite and allowed-domains team settings* 4.3 Medium -
github.com/mattermost/mattermost-server/v5Go Mattermost Remote Cluster PATCH API Leaks Authentication Tokens 6.5 Medium -
github.com/mattermost/mattermost-server/v5Go Mattermost: Delegated admins could patch protected default system roles 6.7 Medium -
github.com/mattermost/mattermost-server/v5Go Mattermost fails to scope role_updated websocket events to authorized team and channel members 4.3 Medium -
github.com/mattermost/mattermost-server/v5Go Server panic via outgoing webhook responses 6.5 Medium -
github.com/mattermost/mattermost-server/v5Go Unauthenticated WebSocket binary frame causes denial of service in Mattermost Server 7.5 High -
github.com/mattermost/mattermost-server/v5Go Insufficient permission validation on cross-team playbook run creation 4.3 Medium -
github.com/mattermost/mattermost-server/v5Go SSRF via Host Header Spoofing in Custom Slash Commands 3.5 Low -
github.com/mattermost/mattermost-server/v5Go Prevent password disclosure and force reset during Slack import 6.5 Medium -
github.com/mattermost/mattermost-server/v5Go Sensitive credentials exposed in plaintext in Mattermost support packets 8.7 High -
github.com/mattermost/mattermost-server/v5Go Slash command trigger-word update allowed command hijacking 4.3 Medium -
github.com/mattermost/mattermost-server/v5Go Mattermost Playbooks Plugin fails to enforce view permissions in list endpoints, allowing unauthorized access to public playbooks 4.3 Medium -
github.com/mattermost/mattermost-server/v5Go Missing authorization check in AI message rewrite endpoint allows access to private thread content 6.5 Medium -
github.com/mattermost/mattermost-server/v5Go Playbooks Plugin fails to validate team transfers, allowing unauthorized removal of member access via playbook update 3.1 Low -
github.com/mattermost/mattermost-server/v5Go Missing request origin validation on burn-on-read reveal endpoint 4.3 Medium -
github.com/mattermost/mattermost-server/v5Go Memory Exhaustion via Malicious 7zip File Upload 4.3 Medium -
github.com/mattermost/mattermost-server/v5Go Unescaped variables during error page composition 3.8 Low -
github.com/mattermost/mattermost-server/v5Go Insufficient token rotation validation in remote cluster invite confirmation 3.7 Low -
github.com/mattermost/mattermost-server/v5Go Mattermost fails to enforce create_post permission when editing posts 4.3 Medium -
github.com/mattermost/mattermost-server/v5Go Insufficient authorization in shared channel membership sync allows remote cluster to remove users from arbitrary channels 4.3 Medium -
github.com/mattermost/mattermost-server/v5Go OAuth authorization code client binding not enforced during token redemption in Mattermost 3.1 Low -
github.com/mattermost/mattermost-server/v5Go Race Condition in Guest Magic Link Authentication Allows Token Reuse 6.5 Medium -
github.com/mattermost/mattermost-server/v5Go CSRF Protection Bypass Allows Updating a User's Authentication Method 6.8 Medium -
github.com/mattermost/mattermost-server/v5Go Arbitrary File Read via Advanced Logging Support Packet 6.8 Medium -
github.com/mattermost/mattermost-server/v5Go Guest users can view group member IDs without respecting view restrictions 4.3 Medium -
github.com/mattermost/mattermost-server/v5Go Zip Bomb Denial of Service via Unrestricted Archive Decompression 6.5 Medium -
github.com/mattermost/mattermost-server/v5Go Terminal Escape Injection in mmctl Report Posts Command 8.0 High -
github.com/mattermost/mattermost-server/v5Go Insufficient authorization in shared channel membership sync grants team-level access instead of channel-level access 5.4 Medium -
github.com/mattermost/mattermost-server/v5Go CSRF vulnerability in UpdateAccessControlPolicyActiveStatus endpoint 4.6 Medium -
github.com/mattermost/mattermost-server/v5Go DoS via URL Previews Rendering Malicious SVGs 4.3 Medium -
github.com/mattermost/mattermost-server/v5Go Account Takeover via Substring Matching in OpenID Connect Authentication 5.7 Medium -
github.com/mattermost/mattermost-server/v5Go Guest users can bypass read permissions via search API 4.3 Medium -
github.com/mattermost/mattermost-server/v5Go Password Change Bypass via Auth Switch Endpoint 3.1 Low -
github.com/mattermost/mattermost-server/v5Go SSRF bypass via IPv4-mapped IPv6 literals 4.3 Medium -
github.com/mattermost/mattermost-server/v5Go Private channel enumeration via /mute slash command 4.3 Medium -
github.com/mattermost/mattermost-server/v5Go Memory Exhaustion via Malformed DOC File Upload 4.3 Medium -
github.com/mattermost/mattermost-server/v5Go Guest user can upload files without permission across teams 4.3 Medium -
github.com/mattermost/mattermost-server/v5Go Denial of service via malformed User-Agent header in getBrowserVersion 4.3 Medium -
github.com/mattermost/mattermost-server/v5Go DoS attack via login attempts with multi-megabyte passwords 7.5 High -
github.com/mattermost/mattermost-server/v5Go Information Disclosure via WebSocket Event When Deleting Unrevealed Burn on Read Posts 4.3 Medium -
github.com/mattermost/mattermost-server/v5Go Memory Exhaustion via Malformed PSD File Upload 4.3 Medium -
github.com/mattermost/mattermost-server/v5Go Unauthorized channel enumeration in private teams after member removal 4.3 Medium -
github.com/mattermost/mattermost-server/v5Go WebSocket Message Spoofing via Permalink Embed Manipulation 4.3 Medium -
github.com/mattermost/mattermost-server/v5Go Unauthorized access to invite ID during team creation 4.3 Medium -
github.com/mattermost/mattermost-server/v5Go Denial of Service via Unbounded Memory Allocation in Integration Actions 5.3 Medium -
github.com/mattermost/mattermost-server/v5Go Team Admin Bypass of Invite Permissions via allow_open_invite Field 3.8 Low - Show olderLoading…