Mattermost Server

Account Takeover via Substring Matching in OpenID Connect Authentication

Reflected XSS in Mattermost Jira plugin

Mattermost version 8.1.6 and earlier fails to sanitize channel mention data in posts, which allows an attacker to inject markup in the web client.

Open redirect in OAuth login

Open redirect in error page when link opened in new tab

Insufficient permissions checks on teams

Webhook Secret Exposure via Timing attack in MSteams plugin

Playbook run link to private channel grants channel access

Invitation Email is resent as a Reminder after invalidating pending email invites

Mattermost 6.0 and earlier fails to sufficiently validate the email address during registration, which allows attackers to trick users into signing up using attacker-controlled email addresses via crafted invitation token.

Repeated LDAP login failures can lock an LDAP account

Mattermost 6.0 and earlier fails to sufficiently validate parameters during post creation, which allows authenticated attackers to cause a client-side crash of the web application via a maliciously crafted post.

User profile update exposes password hash and MFA secrets

Post actions can run playbook checklist task commands

Denial of Service via Unbounded Memory Allocation in Integration Actions

Incorrect defaults can cause attackers to bypass rate limitations

An issue was discovered in Mattermost Server before 5.14.0, 5.13.3, 5.12.6, and 5.9.4. It allows remote attackers to cause a denial of service (application hang) via a crafted SVG document.

An issue was discovered in Mattermost Server before 5.9.0, 5.8.1, 5.7.3, and 4.10.8. Users can deactivate themselves, bypassing a policy.

SAML certificate deletion allows path traversal to delete arbitrary files outside the config directory

An issue was discovered in Mattermost Server before 5.9.0, 5.8.1, 5.7.3, and 4.10.8. SSRF can attack local services.

mmctl export download command doesn’t restrict permissions to created file to file owner

An issue was discovered in Mattermost Server before 3.1.0. It allows XSS via theme color-code values.

Unauthorized email invite to a private channel

Playbooks access/modification by removed team member

Slack import bypasses email verification for team access controls

Ordinary group/direct message member can enable group_constrained and remove all channel participants

GitLab Plugin Allows Non-Admin Users to Modify Default Instance Configuration

Insufficient validation of guest board admin privileges on archive import

Malicious remote can create arbitrary channels

Disabling publicly-shared boards does not disable existing publicly available board links

Deactivated guest accounts can authenticate via magic-link token in Mattermost REST API login endpoint

Insufficient authorization in shared channel membership sync grants team-level access instead of channel-level access

GitHub OAuth Scope Validation

Unauthorized Bot Login Using Credentials

Unauthorized access on archived channels

Bypass of System Admin User Deactivation Controls for Personal Access Tokens in Mattermost Server

Weak SSRF Filtering

Unauthorized Private-to-Public Channel Conversion

Mattermost Playbooks allows privilege escalation through improper access control in playbook run participant management

Mattermost Playbooks exposes private channel metadata to unauthorized users via run metadata API