github.com/mattermost/mattermost-server/v6 vulnerabilities (Go)
222 vulnerabilities.
-
github.com/mattermost/mattermost-server/v6Go User Manager can demote bot accounts to guest without bot-management permission 3.8 Low -
github.com/mattermost/mattermost-server/v6Go CVE-2026-6961: Path traversal via unsanitized FileInfo.Name in Mattermost federation sync 7.6 High -
github.com/mattermost/mattermost-server/v6Go Mattermost group syncable endpoints allow privilege escalation via scheme_admin 8.8 High -
github.com/mattermost/mattermost-server/v6Go Plugin bot username conflict allows user account to be used as bot identity in Mattermost Server 5.3 Medium -
github.com/mattermost/mattermost-server/v6Go *Missing* {{invite_user}} *permission check on team creation allows unprivileged users to set open-invite and allowed-domains team settings* 4.3 Medium -
github.com/mattermost/mattermost-server/v6Go Mattermost Remote Cluster PATCH API Leaks Authentication Tokens 6.5 Medium -
github.com/mattermost/mattermost-server/v6Go Mattermost: Delegated admins could patch protected default system roles 6.7 Medium -
github.com/mattermost/mattermost-server/v6Go Mattermost fails to scope role_updated websocket events to authorized team and channel members 4.3 Medium -
github.com/mattermost/mattermost-server/v6Go Server panic via outgoing webhook responses 6.5 Medium -
github.com/mattermost/mattermost-server/v6Go Unauthenticated WebSocket binary frame causes denial of service in Mattermost Server 7.5 High -
github.com/mattermost/mattermost-server/v6Go Insufficient permission validation on cross-team playbook run creation 4.3 Medium -
github.com/mattermost/mattermost-server/v6Go SSRF via Host Header Spoofing in Custom Slash Commands 3.5 Low -
github.com/mattermost/mattermost-server/v6Go Prevent password disclosure and force reset during Slack import 6.5 Medium -
github.com/mattermost/mattermost-server/v6Go Sensitive credentials exposed in plaintext in Mattermost support packets 8.7 High -
github.com/mattermost/mattermost-server/v6Go Slash command trigger-word update allowed command hijacking 4.3 Medium -
github.com/mattermost/mattermost-server/v6Go Mattermost Playbooks Plugin fails to enforce view permissions in list endpoints, allowing unauthorized access to public playbooks 4.3 Medium -
github.com/mattermost/mattermost-server/v6Go Missing authorization check in AI message rewrite endpoint allows access to private thread content 6.5 Medium -
github.com/mattermost/mattermost-server/v6Go Playbooks Plugin fails to validate team transfers, allowing unauthorized removal of member access via playbook update 3.1 Low -
github.com/mattermost/mattermost-server/v6Go Missing request origin validation on burn-on-read reveal endpoint 4.3 Medium -
github.com/mattermost/mattermost-server/v6Go Memory Exhaustion via Malicious 7zip File Upload 4.3 Medium -
github.com/mattermost/mattermost-server/v6Go Unescaped variables during error page composition 3.8 Low -
github.com/mattermost/mattermost-server/v6Go Insufficient token rotation validation in remote cluster invite confirmation 3.7 Low -
github.com/mattermost/mattermost-server/v6Go Mattermost fails to enforce create_post permission when editing posts 4.3 Medium -
github.com/mattermost/mattermost-server/v6Go Insufficient authorization in shared channel membership sync allows remote cluster to remove users from arbitrary channels 4.3 Medium -
github.com/mattermost/mattermost-server/v6Go OAuth authorization code client binding not enforced during token redemption in Mattermost 3.1 Low -
github.com/mattermost/mattermost-server/v6Go Race Condition in Guest Magic Link Authentication Allows Token Reuse 6.5 Medium -
github.com/mattermost/mattermost-server/v6Go CSRF Protection Bypass Allows Updating a User's Authentication Method 6.8 Medium -
github.com/mattermost/mattermost-server/v6Go Arbitrary File Read via Advanced Logging Support Packet 6.8 Medium -
github.com/mattermost/mattermost-server/v6Go Guest users can view group member IDs without respecting view restrictions 4.3 Medium -
github.com/mattermost/mattermost-server/v6Go Zip Bomb Denial of Service via Unrestricted Archive Decompression 6.5 Medium -
github.com/mattermost/mattermost-server/v6Go Terminal Escape Injection in mmctl Report Posts Command 8.0 High -
github.com/mattermost/mattermost-server/v6Go Insufficient authorization in shared channel membership sync grants team-level access instead of channel-level access 5.4 Medium -
github.com/mattermost/mattermost-server/v6Go CSRF vulnerability in UpdateAccessControlPolicyActiveStatus endpoint 4.6 Medium -
github.com/mattermost/mattermost-server/v6Go DoS via URL Previews Rendering Malicious SVGs 4.3 Medium -
github.com/mattermost/mattermost-server/v6Go Account Takeover via Substring Matching in OpenID Connect Authentication 5.7 Medium -
github.com/mattermost/mattermost-server/v6Go Guest users can bypass read permissions via search API 4.3 Medium -
github.com/mattermost/mattermost-server/v6Go Password Change Bypass via Auth Switch Endpoint 3.1 Low -
github.com/mattermost/mattermost-server/v6Go SSRF bypass via IPv4-mapped IPv6 literals 4.3 Medium -
github.com/mattermost/mattermost-server/v6Go Private channel enumeration via /mute slash command 4.3 Medium -
github.com/mattermost/mattermost-server/v6Go Memory Exhaustion via Malformed DOC File Upload 4.3 Medium -
github.com/mattermost/mattermost-server/v6Go Guest user can upload files without permission across teams 4.3 Medium -
github.com/mattermost/mattermost-server/v6Go Denial of service via malformed User-Agent header in getBrowserVersion 4.3 Medium -
github.com/mattermost/mattermost-server/v6Go DoS attack via login attempts with multi-megabyte passwords 7.5 High -
github.com/mattermost/mattermost-server/v6Go Information Disclosure via WebSocket Event When Deleting Unrevealed Burn on Read Posts 4.3 Medium -
github.com/mattermost/mattermost-server/v6Go Memory Exhaustion via Malformed PSD File Upload 4.3 Medium -
github.com/mattermost/mattermost-server/v6Go Unauthorized channel enumeration in private teams after member removal 4.3 Medium -
github.com/mattermost/mattermost-server/v6Go WebSocket Message Spoofing via Permalink Embed Manipulation 4.3 Medium -
github.com/mattermost/mattermost-server/v6Go Unauthorized access to invite ID during team creation 4.3 Medium -
github.com/mattermost/mattermost-server/v6Go Denial of Service via Unbounded Memory Allocation in Integration Actions 5.3 Medium -
github.com/mattermost/mattermost-server/v6Go Team Admin Bypass of Invite Permissions via allow_open_invite Field 3.8 Low - Show olderLoading…