Mattermost schemes teams endpoint exposes private team invite IDs

User Manager can demote bot accounts to guest without bot-management permission

Improper Permission Check Allows User Manager to Deactivate Bot Accounts

OAuth authorization code client binding not enforced during token redemption in Mattermost

Team Admin Privilege Escalation to Demote Members to Guest

Channel and Team Membership APIs inadvertently allow loss of Member privileges.

Team Privacy Settings Authorization Bypass in Mattermost Server

Access control flaw for team admins allows unauthorized team additions

Invite ID available to team admins even without the "Add Members" permission

Lack of Invalidation of Legacy Remote Cluster Invite Tokens After Confirmation

Insecure string comparison enables timing attacks

An issue was discovered in Mattermost Server before 5.3.0

Mattermost thread memberships persist after team removal, exposing private channel thread metadata on re-invite

Markdown image rendering bypass in AI bot tool result posts in Mattermost

Password Change Bypass via Auth Switch Endpoint

Channel member objects leak read status

AI plugin APIs can be triggered using post actions

CSRF issue allows disconnecting a user's Jira connection through a simple post message (Jira Plugin)

Mattermost WelcomeBot plugin fails to to validate the membership status when inviting or adding users to channels allowing guest accounts to be added or invited to channels by…

Mattermost fails to properly validate a gif image file, allowing an attacker to consume a significant amount of server resources, making the server unresponsive for an extended…

Time-of-check time-of-use vulnerability in common teams API

Invite token is used as part of the secure communication

Improper Access Control in Mattermost Channel Member API

Users maintain access to active call after being removed from a channel

Mattermost fails to properly check the authorization of POST /api/v4/teams when passing a team override scheme ID in the request, allowing an authenticated attacker with knowledge…

Mattermost GitHub Plugin allows unauthorized GitHub reactions via reaction forwarding hijacking

Connected Workspaces: Malicious remote server can manipulate arbitrary user's status

Team Admin Bypass of Invite Permissions via allow_open_invite Field

System Admin Cannot Access Environment settings in System Console While System Manager Can

MFA Enforcement Bypass Allows Unauthorized Removal of MFA for Other Users

Unauthorized Access to User Activity Logs API by delegated granular administration roles

Auto-Enrollment of Team Admins into Private Channels without explicit consent

Unauthorized disabling of invite URL

Mattermost versions 9.6.0, 9.5.x before 9.5.3, and 8.1.x before 8.1.12 fail to fully validate role changes which allows an attacker authenticated as team admin to demote users to…

Mattermost versions 9.6.0, 9.5.x before 9.5.3, and 8.1.x before 8.1.12 fail to fully validate role changes, which allows an attacker authenticated as a team admin to promote…

Mattermost fails to properly show information in the UI, allowing a system admin to modify a board state allowing any user with a valid sharing link to join the board with editor…

Mattermost fails to honor the ShowEmailAddress setting when constructing a response to the /api/v4/users/me/teams API endpoint, allowing an attacker with team admin privileges to…

Mattermost fails to honor the ShowEmailAddress setting when constructing a response to the "Regenerate Invite Id" API endpoint, allowing an attacker with team admin privileges to…

An issue was discovered in Mattermost Server before 3.0.0

An issue was discovered in Mattermost Server before 4.8.1, 4.7.4, and 4.6.3

A race condition in Mattermost versions 8.1.x before 8.1.9, and 9.4.x before 9.4.2 allows an authenticated attacker to gain unauthorized access to individual posts' contents via…