Skip to contentMattermost Server vulnerabilities
- mattermost, mattermost server +1 moreMattermost race conditionCVE-2024-1949Fix available2.6 Low
- mattermost, mattermost server +1 moreMattermost allows attackers access to posts in channels they are not a member ofCVE-2024-1942Fix available4.3 Medium
- mattermost, mattermost server +1 moreExisting server guests invited to the team by members without "invite_guest" permissionCVE-2024-1888Fix available4.3 Medium
- mattermost, mattermost server +1 moreExcessive resource consumption when sending long emoji names in user custom statusCVE-2024-24988Fix available4.3 Medium
- mattermost, mattermost server +1 morePublic channel post content accessible without membership when compliance export is enabledCVE-2024-1887Fix available4.3 Medium
- mattermost, mattermost server +1 moreFiles of archived channels accessible with the “Allow users to view archived channels” option disabledCVE-2024-23488Fix available3.1 Low
- mattermost, mattermost server +1 moreTeam associated AD/LDAP Groups Leaked due to missing authorizationCVE-2024-23493Fix available4.3 Medium
- mattermost, mattermost server +1 moreDenial of service in mattermost mobile apps and server via emoji reactionsCVE-2024-1402Fix available4.3 Medium
- mattermost, mattermost server +1 moreIncorrect Authorization leads to Channel Member Count LeakCVE-2024-24776Fix available3.1 Low
- mattermost, mattermost server +1 moreMissing authorization allows users to access arbitrary security levels on Jira through webhooks (Jira Plugin)CVE-2024-24774Fix available3.4 Low
- mattermost, mattermost server +1 moreCSRF issue allows disconnecting a user's Jira connection through a simple post message (Jira Plugin)CVE-2024-23319Fix available3.5 Low
- mattermost, mattermost server +1 moreDetails of archived public channels are leaked to members of another teamCVE-2023-47858Fix available4.3 Medium
- mattermost, mattermost server +1 moreLack of restriction to manage group names for freshly demoted guestsCVE-2023-50333Fix available3.7 Low
- mattermost, mattermost server +1 moreKeywords that trigger mentions are leaked to other usersCVE-2023-48732Fix available4.3 Medium
- mattermost, mattermost server +1 moreMattermost Cross-site Scripting vulnerabilityCVE-2023-7113Fix available3.7 Low
- mattermost, mattermost server +1 moreLeak Inaccessible Playbook Information via Channel Action IDORCVE-2023-6727Fix available3.1 Low
- mattermost, mattermost server +1 moreReflected client side path traversal leading to CSRF in PlaybooksCVE-2023-45316Fix available7.3 High
- mattermost, mattermost server +1 morePlaybooks access/modification by removed team memberCVE-2023-6547Fix available3.7 Low
- mattermost, mattermost server +1 morePlaybook plugin crash via missing interface type assertionCVE-2023-49607Fix available4.3 Medium
- mattermost, mattermost server +1 moreTodo plugin gets crashed and disabled by memberCVE-2023-49809Fix available4.3 Medium
- mattermost, mattermost server +1 moreInaccessible Post Information Leak via Run Timeline IDORCVE-2023-46701Fix available6.5 Medium
- mattermost, mattermost server +1 moreIDOR when updating the tasks of a private playbook runCVE-2023-49874Fix available4.3 Medium
- mattermost, mattermost server +1 morePlaybook Plugin Crash via Run ChecklistCVE-2023-45847Fix available4.3 Medium
- mattermost, mattermost server +1 morePublic endpoint /metrics of Calls plugin reveals channel IDsCVE-2023-6459Fix available5.3 Medium
- mattermost, mattermost server +1 moreClient side path traversal due to lack of route parameters validationCVE-2023-6458Fix available7.1 High
- mattermost, mattermost server +1 moreDenial of Service via multiple identical User IDs in /api/v4/users/idsCVE-2023-5333Fix available4.3 Medium
- mattermost, mattermost server +1 moreFile Information Leak via IDOR in file_id in Draft PostsCVE-2023-5331Fix available4.3 Medium
- mattermost, mattermost server +1 moreDenial of Service via Opengraph Data CacheCVE-2023-5330Fix available4.3 Medium
- mattermost, mattermost server +1 moreParameter tampering in the registration resulting in blocked accounts to be createdCVE-2023-4478Fix available4.3 Medium
- mattermost, mattermost server +1 moreServer crash via a specially crafted markdown inputCVE-2023-3593Fix available4.3 Medium
- mattermost, mattermost server +1 moreDenial of Service via specially crafted gif imageCVE-2023-3614Fix available4.3 Medium
- mattermost plugins, server +1 moreGuest accounts invited and added to channels by Welcomebot pluginCVE-2023-3613Fix available3.5 Low
- mattermost, mattermost server +1 moreLack of previous password reset tokens on new token creationCVE-2023-3591Fix available4.8 Medium
- mattermost, mattermost server +1 moreDeleted attachments in Boards remain accessibleCVE-2023-3590Fix available3.1 Low
- mattermost, mattermost server +1 moreInconsistent state in UI after boards permission change by system adminCVE-2023-3587Fix available2.7 Low
- mattermost, mattermost server +1 moreDisabling publicly-shared boards does not disable existing publicly available board linksCVE-2023-3586Fix available4.2 Medium
- mattermost, mattermost server +1 morechannel DoS by sharing a boards linkCVE-2023-3585Fix available4.3 Medium
- mattermost, mattermost server +1 moreMember can create team with team override schemeCVE-2023-3584Fix available3.1 Low
- mattermost, mattermost server +1 moreLack of channel membership check when linking a board to a channelCVE-2023-3582Fix available4.3 Medium
- mattermost, mattermost server +1 moreWebSockets accept connections from HTTPS originCVE-2023-3581Fix available6.2 Medium
- mattermost, mattermost server +1 moreLimited blind SSRF to localhost/intranet in interactive dialog implementationCVE-2023-3577Fix available3.5 Low
- mattermost, mattermost server +1 morePrivilege escalation to system admin via personal access tokensCVE-2023-2515Fix available4.7 Medium
- mattermost, mattermost server +1 moreArchiving a team broadcasts unsanitized data over WebSocketsCVE-2023-2281Fix available3.1 Low
- mattermost, mattermost server +1 moreUser password logged in audit logsCVE-2023-1831Fix available7.2 High
- mattermost, mattermost server +1 moreInformation disclosure in linked message previewsCVE-2023-1777Fix available6.5 Medium
- mattermost, mattermost server +1 moreStored XSS via SVG attachment on BoardsCVE-2023-1776Fix available7.3 High
- mattermost, mattermost server +1 moreUnsanitized events sent over Websocket to regular users in a High Availability environmentCVE-2023-1775Fix available4.3 Medium
- mattermost, mattermost server +1 moreUnauthorized email invite to a private channelCVE-2023-1774Fix available4.2 Medium
- mattermost, mattermost server +1 moreReflected XSS in OAuth flow completion endpointsCVE-2023-1421Fix available3.5 Low
- mattermost, mattermost server +1 moreDisclosure of team owner email address when when accessing the teams APICVE-2023-27266Fix available2.7 Low
- Show moreLoading…