github.com/mattermost/mattermost-server vulnerabilities (Go)
296 vulnerabilities.
github.com/mattermost/mattermost-serverGoGuest user can discover active public channels4.3 Mediumgithub.com/mattermost/mattermost-serverGoIDOR in board file download allows any user to download any file by UUID3.1 Lowgithub.com/mattermost/mattermost-serverGoAdmin RCE via prepackaged plugins by way of misconfigured imports directory8.0 Highgithub.com/mattermost/mattermost-serverGoOne-Click Mattermost Account Takeover via Poisoned RelayState SAML Parameter7.6 Highgithub.com/mattermost/mattermost-serverGoOpen redirect in OAuth login3.1 Lowgithub.com/mattermost/mattermost-serverGoWeak cache keys lead to post IDOR and link preview poisoning4.3 Mediumgithub.com/mattermost/mattermost-serverGoMattermost Server exposes sensitive user credentials during shared channel membership synchronization6.5 Mediumgithub.com/mattermost/mattermost-serverGoNil pointer dereference in bulk import crashes server4.9 Mediumgithub.com/mattermost/mattermost-serverGoPath traversal in image upload with preview overwrite4.3 Mediumgithub.com/mattermost/mattermost-serverGoTeam invite ID leaked to team admin with no member invite privileges4.3 Mediumgithub.com/mattermost/mattermost-serverGoMattermost Shared Channel Upload Type Validation Bypass6.8 Mediumgithub.com/mattermost/mattermost-serverGoPath Traversal in Template Upload Allows Uploading Files Outside Target Directory6.8 Mediumgithub.com/mattermost/mattermost-serverGoChannel and Team Membership APIs inadvertently allow loss of Member privileges.3.8 Lowgithub.com/mattermost/mattermost-serverGoAI plugin APIs can be triggered using post actions3.5 Lowgithub.com/mattermost/mattermost-serverGoThread summarization allows persistent access to channel3.5 Lowgithub.com/mattermost/mattermost-serverGoImport Path Traversal Enables Unauthorized Unsigned Plugin Installation6.8 Mediumgithub.com/mattermost/mattermost-serverGoInvite token is used as part of the secure communication2.2 Lowgithub.com/mattermost/mattermost-serverGoArbitrary file read by system admin via path traversal6.8 Mediumgithub.com/mattermost/mattermost-serverGoIDOR in CreatePost API allows for timeboxed message disclosure6.5 Mediumgithub.com/mattermost/mattermost-serverGoMattermost Playbooks exposes private channel metadata to unauthorized users via run metadata API4.3 Mediumgithub.com/mattermost/mattermost-serverGoMattermost Playbooks allows privilege escalation through improper access control in playbook run participant management5.4 Mediumgithub.com/mattermost/mattermost-serverGoUnauthorized Guest user access to Playbook4.3 Mediumgithub.com/mattermost/mattermost-serverGoUnauthorized channel member management through playbook runs4.3 Mediumgithub.com/mattermost/mattermost-serverGoPath Traversal Leading to RCE by Any Authenticated Mattermost User9.9 Criticalgithub.com/mattermost/mattermost-serverGoMattermost Guest User Information Disclosure Vulnerability3.1 Lowgithub.com/mattermost/mattermost-serverGoLDAP Injection in Mattermost Enterprise Edition When Using Active Directory4.1 Mediumgithub.com/mattermost/mattermost-serverGoImproper Access Control in Mattermost allows System Managers to view team details despite role restrictions3.1 Lowgithub.com/mattermost/mattermost-serverGoBypass of System Admin User Deactivation Controls for Personal Access Tokens in Mattermost Server5.4 Mediumgithub.com/mattermost/mattermost-serverGoGoogle OAuth Authentication Bypass for Converted Bot Accounts4.2 Mediumgithub.com/mattermost/mattermost-serverGoImproper Access Control in Mattermost Channel Member API3.1 Lowgithub.com/mattermost/mattermost-serverGoTeam Privacy Settings Authorization Bypass in Mattermost Server5.3 Mediumgithub.com/mattermost/mattermost-serverGoSystem Admin Cannot Access Environment settings in System Console While System Manager Can2.7 Lowgithub.com/mattermost/mattermost-serverGoImproper access control to group information4.3 Mediumgithub.com/mattermost/mattermost-serverGoMembers Without Guest Invite Permissions Can Add Guests to Teams4.3 Mediumgithub.com/mattermost/mattermost-serverGoRepeated LDAP login failures can lock an LDAP account5.8 Mediumgithub.com/mattermost/mattermost-serverGoUnauthorized Playbooks Post Deletion in Mattermost Playbooks Plugin3.1 Lowgithub.com/mattermost/mattermost-serverGoDoS in Mattermost Playbooks via Excessive Task Actions6.5 Mediumgithub.com/mattermost/mattermost-serverGoWebapp DoS via malicious retrospective post in Playbooks6.5 Mediumgithub.com/mattermost/mattermost-serverGoUnauthorized View Access to Archived Channel Member Info4.3 Mediumgithub.com/mattermost/mattermost-serverGoWebhook Secret Exposure via Timing attack in MSteams plugin5.3 Mediumgithub.com/mattermost/mattermost-serverGoData exfiltration via AI plugin Jira tool3.0 Lowgithub.com/mattermost/mattermost-serverGoChannel metadata visible in archived channels despite configuration setting4.3 Mediumgithub.com/mattermost/mattermost-serverGoMFA Enforcement Bypass Allows Unauthorized Removal of MFA for Other Users2.2 Lowgithub.com/mattermost/mattermost-serverGoUnauthorized AI bot activation via Wrangler plugin3.1 Lowgithub.com/mattermost/mattermost-serverGoUnauthorized Bot Login Using Credentials5.4 Mediumgithub.com/mattermost/mattermost-serverGoLeaked Metadata of Deleted Files via Bookmark Creation3.1 Lowgithub.com/mattermost/mattermost-serverGoSyatem admin profile modification by delegated granular administration role4.7 Mediumgithub.com/mattermost/mattermost-serverGoUnauthorized Access to User Activity Logs API by delegated granular administration roles2.7 Lowgithub.com/mattermost/mattermost-serverGoBypassing MFA Enforcement on Plugin Endpoints7.5 Highgithub.com/mattermost/mattermost-serverGoUnauthorized Bookmark Creation and Modification in Archived Channels4.3 Medium- Show moreLoading…