Mattermost Server any version

Arbitrary file read in Mattermost Boards via import & export board archive

Path Traversal Leading to RCE by Any Authenticated Mattermost User

Arbitrary file read via block duplication in Mattermost Boards

Account takeover on OAuth/OpenID-enabled servers

Account Takeover via Code Exchange Endpoint

Path traversal in integration action URL leading to arbitrary API execution via system admin’s auth token.

An issue was discovered in Mattermost Server before 3.8.2, 3.7.5, and 3.6.7. It allows an attacker to specify a full pathname of a log file.

An issue was discovered in Mattermost Server before 4.1.0, 4.0.4, and 3.10.3. It allows CSV injection via a compliance report.

An issue was discovered in Mattermost Server before 3.6.2. The WebSocket feature does not follow the Same Origin Policy.

An issue was discovered in Mattermost Server before 5.2 and 5.1.1. Authorization could be bypassed if the channel name were not the same in the params and the body.

An issue was discovered in Mattermost Server before 4.3.0, 4.2.1, and 4.1.2. It allows attackers to gain privileges by accessing unintended API endpoints on a user's behalf.

An issue was discovered in Mattermost Server before 4.0.0, 3.10.2, and 3.9.2. A password-reset request was sometime sent to an attacker-provided e-mail address.

An issue was discovered in Mattermost Server before 3.0.0. A password-reset link could be reused.

An issue was discovered in Mattermost Server before 3.8.2, 3.7.5, and 3.6.7. After a restart of a server, an attacker might suddenly gain API Endpoint access.

An issue was discovered in Mattermost Server before 4.3.0, 4.2.1, and 4.1.2. It allows SQL injection during the fetching of multiple posts.

Client side path traversal due to lack of route parameters validation

SQL Injection in Mattermost Boards via board category ID reordering

An issue was discovered in Mattermost Server before 4.3.0, 4.2.1, and 4.1.2, when serving as an OAuth 2.0 Service Provider. There is low entropy for authorization data.

An issue was discovered in Mattermost Server before 3.8.2, 3.7.5, and 3.6.7. The X.509 certificate validation can be skipped for a TLS-based e-mail server.

An issue was discovered in Mattermost Server before 4.7.0, 4.6.2, and 4.5.2. It did not enforce the expiration date of a SAML response.

An issue was discovered in Mattermost Server before 4.3.0, 4.2.1, and 4.1.2. It allows a bypass of restrictions on use of slash commands.

An issue was discovered in Mattermost Server before 4.7.0, 4.6.2, and 4.5.2. An attacker could authenticate to a different user's account via a crafted SAML response.

Authorized users are allowed to install old plugin versions from the Marketplace

Mattermost versions 8.1.x before 8.1.10, 9.2.x before 9.2.6, 9.3.x before 9.3.2, and 9.4.x before 9.4.3 fail to correctly verify account ownership when switching from email to SAML authentication, allowing an authenticated attacker to take over other user accounts via a crafted switch request under specific conditions.

An issue was discovered in Mattermost Server before 5.12.0, 5.11.1, 5.10.2, 5.9.2, and 4.10.10. The login page allows CSRF.

Privilege escalation to system admin via personal access tokens

An issue was discovered in Mattermost Server before 5.18.0, 5.17.2, 5.16.4, 5.15.4, and 5.9.7. CSRF can sometimes occur via a crafted web site for account takeover attacks.

An issue was discovered in Mattermost Server before 4.0.0, 3.10.2, and 3.9.2. CSRF can occur if CORS is enabled.

Unauthorized Command Execution in Archived Channels

Bypassing MFA Enforcement on Plugin Endpoints

Reflected client side path traversal leading to CSRF in Playbooks

Mattermost group syncable endpoints allow privilege escalation via scheme_admin

Terminal Escape Injection in mmctl Report Posts Command

Session Persistence After User-to-Bot Conversion

Sensitive credentials exposed in plaintext in Mattermost support packets

DoS in Calls plugin via malformed msgpack in websocket request.

Insufficient server-side validation of board member role fields permits privilege escalation

Mattermost Jira plugin user spoofing enables Jira request forgery.

Parameter tampering in the registration resulting in blocked accounts to be created

Domain Restriction Bypass on Registration