github.com/mattermost/mattermost-server vulnerabilities (Go)
296 vulnerabilities.
github.com/mattermost/mattermost-serverGoInsufficient authorization in shared channel membership sync grants team-level access instead of channel-level access5.4 Mediumgithub.com/mattermost/mattermost-serverGoCSRF vulnerability in UpdateAccessControlPolicyActiveStatus endpoint4.6 Mediumgithub.com/mattermost/mattermost-serverGoDoS via URL Previews Rendering Malicious SVGs4.3 Mediumgithub.com/mattermost/mattermost-serverGoAccount Takeover via Substring Matching in OpenID Connect Authentication5.7 Mediumgithub.com/mattermost/mattermost-serverGoDenial of Service via HTTP/2 single packet attack on login endpoint4.3 Mediumgithub.com/mattermost/mattermost-serverGoGuest users can bypass read permissions via search API4.3 Mediumgithub.com/mattermost/mattermost-serverGoPassword Change Bypass via Auth Switch Endpoint3.1 Lowgithub.com/mattermost/mattermost-serverGoSSRF bypass via IPv4-mapped IPv6 literals4.3 Mediumgithub.com/mattermost/mattermost-serverGoPrivate channel enumeration via /mute slash command4.3 Mediumgithub.com/mattermost/mattermost-serverGoMemory Exhaustion via Malformed DOC File Upload4.3 Mediumgithub.com/mattermost/mattermost-serverGoGuest user can upload files without permission across teams4.3 Mediumgithub.com/mattermost/mattermost-serverGoDenial of service via malformed User-Agent header in getBrowserVersion4.3 Mediumgithub.com/mattermost/mattermost-serverGoDoS attack via login attempts with multi-megabyte passwords7.5 Highgithub.com/mattermost/mattermost-serverGoInformation Disclosure via WebSocket Event When Deleting Unrevealed Burn on Read Posts4.3 Mediumgithub.com/mattermost/mattermost-serverGoMemory Exhaustion via Malformed PSD File Upload4.3 Mediumgithub.com/mattermost/mattermost-serverGoUnauthorized channel enumeration in private teams after member removal4.3 Mediumgithub.com/mattermost/mattermost-serverGoWebSocket Message Spoofing via Permalink Embed Manipulation4.3 Mediumgithub.com/mattermost/mattermost-serverGoUnauthorized access to invite ID during team creation4.3 Mediumgithub.com/mattermost/mattermost-serverGoDenial of Service via Unbounded Memory Allocation in Integration Actions5.3 Mediumgithub.com/mattermost/mattermost-serverGoTeam Admin Bypass of Invite Permissions via allow_open_invite Field3.8 Lowgithub.com/mattermost/mattermost-serverGoInformation disclosure via channel mentions in posts4.3 Mediumgithub.com/mattermost/mattermost-serverGoUser profile update exposes password hash and MFA secrets5.7 Mediumgithub.com/mattermost/mattermost-serverGoAuthentication bypass via userID login when email and username login are disabled5.4 Mediumgithub.com/mattermost/mattermost-serverGoTime-of-check time-of-use vulnerability in common teams API3.1 Lowgithub.com/mattermost/mattermost-serverGoInsufficient Authorization in Mattermost Jira Plugin Allows Unauthorized Access to Post Attachments4.3 Mediumgithub.com/mattermost/mattermost-serverGoApplication-Level DoS via infinite re-render loop in user profile handling6.8 Mediumgithub.com/mattermost/mattermost-serverGoDoS from quadratic complexity in model.ParseHashtags3.1 Lowgithub.com/mattermost/mattermost-serverGoMattermost Jira plugin crafted action leaks Jira issue details4.1 Mediumgithub.com/mattermost/mattermost-serverGoUnauthorized Read Access to Private Channel Posts via Mattermost Jira Plugin4.3 Mediumgithub.com/mattermost/mattermost-serverGoMattermost Jira plugin user spoofing enables Jira request forgery.7.2 Highgithub.com/mattermost/mattermost-serverGoLack of Invalidation of Legacy Remote Cluster Invite Tokens After Confirmation3.7 Lowgithub.com/mattermost/mattermost-serverGoOpen redirect in error page when link opened in new tab3.1 Lowgithub.com/mattermost/mattermost-serverGoMattermost GitHub Plugin allows unauthorized GitHub reactions via reaction forwarding hijacking3.0 Lowgithub.com/mattermost/mattermost-serverGoUnauthorized access and subscription vulnerability in Boards3.1 Lowgithub.com/mattermost/mattermost-serverGoInsecure Direct Object Reference in Mattermost Boards Plugin Enables Unauthorised Comment Deletion4.3 Mediumgithub.com/mattermost/mattermost-serverGoAccount Takeover via Code Exchange Endpoint9.9 Criticalgithub.com/mattermost/mattermost-serverGoInformation Disclosure in Common Teams API4.3 Mediumgithub.com/mattermost/mattermost-serverGoAccount takeover on OAuth/OpenID-enabled servers9.9 Criticalgithub.com/mattermost/mattermost-serverGoChannel member objects leak read status3.0 Lowgithub.com/mattermost/mattermost-serverGoPassword hash and MFA secret returned in user email verification endpoint4.9 Mediumgithub.com/mattermost/mattermost-serverGoMS Teams plugin OAuth allows editing arbitrary posts5.4 Mediumgithub.com/mattermost/mattermost-serverGoLack of MFA enforcement in WebSocket connections6.5 Mediumgithub.com/mattermost/mattermost-serverGoUnauthorized access to archived channel content via threads interface3.1 Lowgithub.com/mattermost/mattermost-serverGoGuest user can discover archived public channels4.3 Mediumgithub.com/mattermost/mattermost-serverGoCross-team channel membership access3.1 Lowgithub.com/mattermost/mattermost-serverGoArbitrary Mattermost Team can be joined by manipulating the OAuth state8.1 Highgithub.com/mattermost/mattermost-serverGoSlack import bypasses email verification for team access controls5.4 Mediumgithub.com/mattermost/mattermost-serverGoGuest user can add unauthorized team users to private channels3.1 Lowgithub.com/mattermost/mattermost-serverGoArbitrary Mattermost Team can be joined by manipulating the SAML RelayState8.1 Highgithub.com/mattermost/mattermost-serverGoInsecure string comparison enables timing attacks3.1 Low- Show moreLoading…