Mattermost Server

Denial of service in mattermost mobile apps and server via emoji reactions

Mattermost versions 8.1.x before 8.1.9, 9.2.x before 9.2.5, 9.3.0, and 9.4.x before 9.4.2 fail to limit the number of role names requested from the API, allowing an authenticated attacker to cause the server to run out of memory and crash by issuing an unusually large HTTP request.

Archiving a team broadcasts unsanitized data over WebSockets

Keywords that trigger mentions are leaked to other users

Detailed error discloses full file path with dev mode off

Mattermost versions 8.1.x before 8.1.10, 9.2.x before 9.2.6, 9.3.x before 9.3.2, and 9.4.x before 9.4.3 fail to limit the number of @-mentions processed per message, allowing an authenticated attacker to crash the client applications of other users via large, crafted messages.

Insufficient input validation in GitHub plugin API causes denial of service

Leak Inaccessible Playbook Information via Channel Action IDOR

Limited blind SSRF to localhost/intranet in interactive dialog implementation

IDOR when updating the tasks of a private playbook run

Denial of service via malformed User-Agent header in getBrowserVersion

Memory Exhaustion via Malformed PSD File Upload

Memory Exhaustion via Malformed DOC File Upload

Mattermost version 8.1.x before 8.1.9 fails to sanitize data associated with permalinks when a plugin updates an ephemeral post, allowing an authenticated attacker who can control the ephemeral post update to access individual posts' contents in channels they are not a member of.

Denial of service via unbounded document content extraction in Mattermost Server

Guest user can upload files without permission across teams

Mattermost versions 8.1.x before 8.1.9, 9.2.x before 9.2.5, and 9.3.0 fail to sanitize the metadata on posts containing permalinks under specific conditions, which allows an authenticated attacker to access the contents of individual posts in channels they are not a member of.

Details of archived public channels are leaked to members of another team

Lack of channel membership check when linking a board to a channel

Denial of Service via specially crafted gif image

Remote username set to an arbitrary string by remote user

Global session revocation does not invalidate active WebSocket connections

Public channel post content accessible without membership when compliance export is enabled

Existing server guests invited to the team by members without "invite_guest" permission

Delegated OAuth tokens could revoke unrelated OAuth application authorizations

Guest user can add unauthorized team users to private channels

Lack of restriction to manage group names for freshly demoted guests

Files of archived channels accessible with the “Allow users to view archived channels” option disabled

Incorrect Authorization leads to Channel Member Count Leak

Guest user can discover active public channels

Mattermost fails to scope role_updated websocket events to authorized team and channel members

Improper access control to group information

Information Disclosure via WebSocket Event When Deleting Unrevealed Burn on Read Posts

Sanitize team member data returned by API

AD/LDAP Group Members Leak

Private channel names leaking when Elasticsearch is enabled

Private channel names leaked with Ctrl+K when ElasticSearch is enabled

Channel export permitted on archived channel when viewing archived channels is disabled

Unauthorized Guest user access to Playbook

Unauthorized Access to view channels' details