Mattermost Mattermost Server

DoS from quadratic complexity in model.ParseHashtags

Mattermost Boards plugin didn’t enforce role-based authorization on board channel link allowing board editors to expose boards to arbitrary channels

Unbounded Request Body Read in MS Teams Plugin {{/lifecycle}} Webhook Endpoint

MFA Enforcement Bypass in Search APIs

Denial of Service via HTTP/2 single packet attack on login endpoint

Deactivated user accounts can continue to obtain valid OAuth access tokens via refresh token grant in Mattermost

Unauthorized users can trigger interactive post actions in private channels via action cookie channel mismatch in Mattermost

Data exfiltration via AI plugin Jira tool

DoS in Calls plugin via malformed UTF-8 in WebSocket request

Mattermost local image proxy allows server memory exhaustion via unbounded image response buffering

Server panic via outgoing webhook responses

IDOR in board file download allows any user to download any file by UUID

Mattermost Server exposes sensitive user credentials during shared channel membership synchronization

Mattermost Remote Cluster PATCH API Leaks Authentication Tokens

Mattermost leaks interactive-message integration secrets to non-admin users via post-deletion events and thread reads

Denial of service via crafted TIFF file upload

SVG content served through Mattermost image proxy despite Content-Type restrictions causes client-side denial of service

Improper Input Validation in MS Teams Meetings API Handler

Memory Exhaustion via Malicious 7zip File Upload

Prevent password disclosure and force reset during Slack import

Instance and webhook GitLab plugin commands were able to be run by non-admin users

Outgoing OAuth connection client secret exposure during connection validation

Mattermost versions 8.1.x before 8.1.11, 9.3.x before 9.3.3, 9.4.x before 9.4.4, and 9.5.x before 9.5.2 fail to authenticate the source of certain types of post actions, allowing an authenticated attacker to create posts as other users via a crafted post action.

Mattermost guest account privilege escalation via member roles API

Missing authorization check in AI message rewrite endpoint allows access to private thread content

Persistent notification timing attack causing server denial of service

Race Condition in Guest Magic Link Authentication Allows Token Reuse

SSRF via unvalidated attachment URLs in Mattermost Agents plugin MCP server

Mattermost Jira plugin had unauthenticated {{/ac/installed}} lifecycle callback during pending Jira Cloud install

IDOR in Jira plugin subscription edit endpoint

Missing server side validation allowed user to quarantine a DM and GM post

Boards plugin retains Board Admin rights for users demoted to System Guest

Channel member roles accept out-of-scope roles

Member promoted to channel admin via playbooks run linking to channel

An issue was discovered in Mattermost Server before 4.2.0, 4.1.1, and 4.0.5. It allows Phishing because an error page can have a link.

An issue was discovered in Mattermost Server before 4.2.0, 4.1.1, and 4.0.5, when used as an OAuth 2.0 service provider. It mishandles a deny action for a redirection.

An issue was discovered in Mattermost Server before 3.5.1. XSS can occur via file preview.

An issue was discovered in Mattermost Server before 3.1.0. It allows XSS because the noreferrer and noopener protection mechanisms were not in place.

An issue was discovered in Mattermost Server before 3.0.0. It allows XSS via a Legal or Support setting.

An issue was discovered in Mattermost Server before 3.0.0. It allows XSS via a redirect URL.