github.com/mattermost/mattermost-server vulnerabilities (Go)
296 vulnerabilities.
github.com/mattermost/mattermost-serverGoMFA Enforcement Bypass in Search APIs4.3 Mediumgithub.com/mattermost/mattermost-serverGoUnauthorized Command Execution in Archived Channels4.3 Mediumgithub.com/mattermost/mattermost-serverGoUnauthorized Private-to-Public Channel Conversion5.4 Mediumgithub.com/mattermost/mattermost-serverGoAuto-Enrollment of Team Admins into Private Channels without explicit consent3.3 Lowgithub.com/mattermost/mattermost-serverGoUnauthorized View Access to Site Statistics and Team Statistics4.3 Mediumgithub.com/mattermost/mattermost-serverGoArbitrary file read via block duplication in Mattermost Boards9.9 Criticalgithub.com/mattermost/mattermost-serverGoArbitrary file read in Mattermost Boards via import & export board archive9.9 Criticalgithub.com/mattermost/mattermost-serverGoSession Persistence After User-to-Bot Conversion3.1 Lowgithub.com/mattermost/mattermost-serverGoChannel export permitted on archived channel when viewing archived channels is disabled4.3 Mediumgithub.com/mattermost/mattermost-serverGoWebapp crash via object that can't be cast to String in Attachment Field6.5 Mediumgithub.com/mattermost/mattermost-serverGoInsufficient Input Validation on Post Props6.5 Mediumgithub.com/mattermost/mattermost-serverGoInsufficient Input Validation on Post Props6.5 Mediumgithub.com/mattermost/mattermost-serverGoWebApp crash via improper validation of proto style in attachments6.5 Mediumgithub.com/mattermost/mattermost-serverGoMisleading UI for undefined admin console settings in Calls causes security confusion3.5 Lowgithub.com/mattermost/mattermost-serverGoDoS via custom post type for sysconsole plugin readers4.3 Mediumgithub.com/mattermost/mattermost-serverGoAccess control flaw for team admins allows unauthorized team additions3.8 Lowgithub.com/mattermost/mattermost-serverGoZipbomb DoS via Missing Slack Import Validation6.5 Mediumgithub.com/mattermost/mattermost-serverGoDoS via lack of type validation in Calls6.5 Mediumgithub.com/mattermost/mattermost-serverGoBypass of "Max failed attempts" restriction via race condition4.8 Mediumgithub.com/mattermost/mattermost-serverGoClient-Side Path Traversal Leading to CSRF in Playbooks4.6 Mediumgithub.com/mattermost/mattermost-serverGoDoS via Amplified GraphQL Response in Playbooks4.3 Mediumgithub.com/mattermost/mattermost-serverGoArbitrary post deletion via Playbooks /ignore-thread endpoint4.3 Mediumgithub.com/mattermost/mattermost-serverGoPrivate channel names leaked with Ctrl+K when ElasticSearch is enabled4.3 Mediumgithub.com/mattermost/mattermost-serverGoIncorrect Session Creation with Desktop SSO3.5 Lowgithub.com/mattermost/mattermost-serverGoDoS via non-string message using permalink embed3.1 Lowgithub.com/mattermost/mattermost-serverGoUnauthorized channel file upload4.3 Mediumgithub.com/mattermost/mattermost-serverGoInsufficient permissions checks on teams6.0 Mediumgithub.com/mattermost/mattermost-serverGoUnauthorized disabling of invite URL2.7 Lowgithub.com/mattermost/mattermost-serverGoSystem Role with edit access to permissions can elevate themselves to system admin4.7 Mediumgithub.com/mattermost/mattermost-serverGoOne-click Client-Side Path Traversal Leading to CSRF in User Management admin page4.6 Mediumgithub.com/mattermost/mattermost-serverGoEmail addresses of remote users visible in props regardless of server settings4.3 Mediumgithub.com/mattermost/mattermost-serverGoMunged email address used for password resets and notifications4.8 Mediumgithub.com/mattermost/mattermost-serverGoMalicious remote can claim that a user was synced from another remote2.7 Lowgithub.com/mattermost/mattermost-serverGoMalicious remote can make an arbitrary local channel read-only4.1 Mediumgithub.com/mattermost/mattermost-serverGoMalicious remote can create/update/delete arbitrary posts in arbitrary channels5.5 Mediumgithub.com/mattermost/mattermost-serverGoRemote username set to an arbitrary string by remote user4.3 Mediumgithub.com/mattermost/mattermost-serverGoMalicious remote can create arbitrary channels3.8 Lowgithub.com/mattermost/mattermost-serverGoPermanently local data deletion by malicious remote6.8 Mediumgithub.com/mattermost/mattermost-serverGoMalicious remote can invite itself to an arbitrary local channel8.7 Highgithub.com/mattermost/mattermost-serverGoMalicious remote can add users to arbitrary teams and channels8.7 Highgithub.com/mattermost/mattermost-serverGoExisting local user overwritten by malicious remote7.4 Highgithub.com/mattermost/mattermost-serverGoMalicious remote can create arbitrary reactions on arbitrary posts2.7 Lowgithub.com/mattermost/mattermost-serverGoMattermost fails to fully validate role changes2.7 Lowgithub.com/mattermost/mattermost-serverGoMattermost allows team admins to promote guests to team admins2.7 Lowgithub.com/mattermost/mattermost-serverGoMattermost fails to limit the number of active sessions4.3 Mediumgithub.com/mattermost/mattermost-serverGoMattermost crashes web clients via a malformed custom status4.3 Mediumgithub.com/mattermost/mattermost-serverGoDetailed error discloses full file path with dev mode off4.3 Mediumgithub.com/mattermost/mattermost-serverGoExcessive resource consumption due to lack to request path size limits3.1 Lowgithub.com/mattermost/mattermost-serverGoMattermost fails to authenticate the source of certain types of post actions6.5 Mediumgithub.com/mattermost/mattermost-serverGoInvite ID available to team admins even without the "Add Members" permission4.7 Medium- Show moreLoading…