Mattermost Server any version

IDOR in CreatePost API allows for timeboxed message disclosure

Unbounded Request Body Read in MS Teams Plugin {{/lifecycle}} Webhook Endpoint

MFA Enforcement Bypass in Search APIs

Deactivated user accounts can continue to obtain valid OAuth access tokens via refresh token grant in Mattermost

Unauthorized users can trigger interactive post actions in private channels via action cookie channel mismatch in Mattermost

DoS in Calls plugin via malformed UTF-8 in WebSocket request

Persistent notification timing attack causing server denial of service

Data exfiltration via AI plugin Jira tool

IDOR in board file download allows any user to download any file by UUID

Mattermost Server exposes sensitive user credentials during shared channel membership synchronization

Improper Input Validation in MS Teams Meetings API Handler

Mattermost versions 8.1.x before 8.1.11, 9.3.x before 9.3.3, 9.4.x before 9.4.4, and 9.5.x before 9.5.2 fail to authenticate the source of certain types of post actions, allowing an authenticated attacker to create posts as other users via a crafted post action.

Race Condition in Guest Magic Link Authentication Allows Token Reuse

SSRF via unvalidated attachment URLs in Mattermost Agents plugin MCP server

Mattermost Jira plugin had unauthenticated {{/ac/installed}} lifecycle callback during pending Jira Cloud install

IDOR in Jira plugin subscription edit endpoint

Channel member roles accept out-of-scope roles

Boards plugin retains Board Admin rights for users demoted to System Guest

Member promoted to channel admin via playbooks run linking to channel

An issue was discovered in Mattermost Server before 4.2.0, 4.1.1, and 4.0.5, when used as an OAuth 2.0 service provider. It mishandles a deny action for a redirection.

An issue was discovered in Mattermost Server before 4.2.0, 4.1.1, and 4.0.5. It allows Phishing because an error page can have a link.

An issue was discovered in Mattermost Server before 4.3.0, 4.2.1, and 4.1.2. XSS could occur via the author_link field of a Slack attachment.

An issue was discovered in Mattermost Server before 3.0.0. It allows XSS via a redirect URL.

An issue was discovered in Mattermost Server before 3.1.0. It allows XSS because the noreferrer and noopener protection mechanisms were not in place.

An issue was discovered in Mattermost Server before 2.2.0. It allows XSS via a crafted link.

An issue was discovered in Mattermost Server before 2.2.0. It allows XSS because it configures files to be opened in a browser window.

An issue was discovered in Mattermost Server before 4.2.0, 4.1.1, and 4.0.5. E-mail templates can have a field in which HTML content is not neutralized.

An issue was discovered in Mattermost Server before 4.2.0, 4.1.1, and 4.0.5. Display names allow XSS.

An issue was discovered in Mattermost Server before 3.0.0. It allows XSS via a Legal or Support setting.

An issue was discovered in Mattermost Server before 3.5.1. XSS can occur via file preview.

An issue was discovered in Mattermost Server before 4.0.0, 3.10.2, and 3.9.2. It allows XSS via an uploaded file.

An issue was discovered in Mattermost Server before 4.0.0, 3.10.2, and 3.9.2. XSS could occur via a channel header.

An issue was discovered in Mattermost Server before 4.3.0, 4.2.1, and 4.1.2. XSS attacks could occur against an OAuth 2.0 allow/deny page.

An issue was discovered in Mattermost Server before 3.8.2, 3.7.5, and 3.6.7. XSS can occur via a link on an error page.

An issue was discovered in Mattermost Server before 4.3.0, 4.2.1, and 4.1.2. XSS could occur via the title_link field of a Slack attachment.

An issue was discovered in Mattermost Server before 4.3.0, 4.2.1, and 4.1.2. XSS could occur via a goto_location response to a slash command.

An issue was discovered in Mattermost Server before 4.3.0, 4.2.1, and 4.1.2. XSS can occur via OpenGraph data.

An issue was discovered in Mattermost Server before 3.6.0 and 3.5.2. XSS can occur via a link on an error page.

Reflected XSS in OAuth flow completion endpoints

An issue was discovered in Mattermost Server before 2.1.0. It allows XSS via CSRF.