A crafted SVG attachment can crash a Mattermost server

OOM DoS in Mattermost image proxy

Stack overflow in document extractor in Mattermost

Team Creator's Email Address is disclosed to Team Members via one of the APIs

Users can view the contents of an archived channel when access is explicitly denied by the system admin

Missing server side validation allowed user to quarantine a DM and GM post

IDOR in Jira plugin subscription edit endpoint

Mattermost Jira plugin had unauthenticated {{/ac/installed}} lifecycle callback during pending Jira Cloud install

Existing local user overwritten by malicious remote

Boards plugin retains Board Admin rights for users demoted to System Guest

Channel member roles accept out-of-scope roles

Member promoted to channel admin via playbooks run linking to channel

Mobile SSO authentication flow allows credential theft via malicious server

Account Takeover via Substring Matching in OpenID Connect Authentication

Open redirect in error page when link opened in new tab

Mattermost Desktop DoS when user has basic authentication server configured

Open redirect in OAuth login

Lack of permissions prompting when opening external URLs

Reflected XSS in Mattermost Jira plugin

Mattermost version 8.1.6 and earlier fails to sanitize channel mention data in posts, which allows an attacker to inject markup in the web client

Open redirect in /oauth/<service>/mobile_login?redirect_to=

Reflected XSS in OAuth flow completion endpoints

Mattermost 5.38 and earlier fails to sufficiently sanitize clipboard contents, which allows a user-assisted attacker to inject arbitrary web script in product deployments that…

Fixed a bypass for a reflected cross-site scripting vulnerability affecting OAuth-enabled instances of Mattermost

Webhook Secret Exposure via Timing attack in MSteams plugin

Timing attack during remote cluster token comparison when shared channels are enabled

Playbook run link to private channel grants channel access

Denial of Service via Unbounded Memory Allocation in Integration Actions

User profile update exposes password hash and MFA secrets

Post actions can run playbook checklist task commands

Server-side Denial of Service while processing a specifically crafted GIF file

Mattermost 6.0 and earlier fails to sufficiently validate parameters during post creation, which allows authenticated attackers to cause a client-side crash of the web application…

Mattermost server-side request forgery via OAuth endpoints configurable by a System Administrator

Mattermost ABAC parent policy bypass via policy update endpoint

SAML certificate deletion allows path traversal to delete arbitrary files outside the config directory

mmctl export download command doesn’t restrict permissions to created file to file owner

Insecure Android File Provider Paths

Mattermost Desktop logs all keystrokes during initial run after fresh installation

Insufficient validation of guest board admin privileges on archive import

Deactivated guest accounts can authenticate via magic-link token in Mattermost REST API login endpoint

Ordinary group/direct message member can enable group_constrained and remove all channel participants

GitLab Plugin Allows Non-Admin Users to Modify Default Instance Configuration

GitHub OAuth Scope Validation

Insufficient authorization in shared channel membership sync grants team-level access instead of channel-level access

Slack import bypasses email verification for team access controls

One-Click Mattermost Account Takeover via Poisoned RelayState SAML Parameter

Mattermost Playbooks exposes private channel metadata to unauthorized users via run metadata API

Mattermost Playbooks allows privilege escalation through improper access control in playbook run participant management

Bypass of System Admin User Deactivation Controls for Personal Access Tokens in Mattermost Server

Unauthorized Bot Login Using Credentials