Denial of Service while unescaping a Markdown string

Path traversal in GitHub plugin's code preview feature

Stack exhaustion in PreparePostForClientWithEmbedsAndImages

Ephemeral messages return private channel contents in permalink previews

Deactivated user can retain access using oauth2 api

Collapsed Reply Threads APIs leak message contents from private channels

Apps Framework allows install requests from regular members via an internal path

A missing permissions check in Mattermost Playbooks in Mattermost allows an attacker to modify a playbook via the /plugins/playbooks/api/v0/playbooks/[playbookID] API

A missing permissions check in the /plugins/playbooks/api/v0/runs API in Mattermost allows an attacker to list and view playbooks belonging to a team they are not a member of

A denial-of-service vulnerability in the Mattermost allows an authenticated user to crash the server via multiple requests to one of the API endpoints which could fetch a large…

A denial-of-service vulnerability in Mattermost allows an authenticated user to crash the server via multiple large autoresponder messages

A denial-of-service vulnerability in the Mattermost Playbooks plugin allows an authenticated user to crash the server via multiple large requests to one of the Playbooks API…

The legacy Slack import feature in Mattermost version 6.7.0 and earlier fails to properly limit the sizes of imported files, which allows an authenticated attacker to crash the…

Mattermost 6.3.0 and earlier fails to protect email addresses of the creator of the team via one of the APIs, which allows authenticated team members to access this information…

Mattermost 6.1 and earlier fails to sufficiently validate permissions while viewing archived channels, which allows authenticated users to view contents of archived channels even…

Missing server side validation allowed user to quarantine a DM and GM post

IDOR in Jira plugin subscription edit endpoint

Mattermost Jira plugin had unauthenticated {{/ac/installed}} lifecycle callback during pending Jira Cloud install

Existing local user overwritten by malicious remote

Boards plugin retains Board Admin rights for users demoted to System Guest

Channel member roles accept out-of-scope roles

Member promoted to channel admin via playbooks run linking to channel

Mobile SSO authentication flow allows credential theft via malicious server

Account Takeover via Substring Matching in OpenID Connect Authentication

Open redirect in error page when link opened in new tab

Mattermost Desktop DoS when user has basic authentication server configured

Open redirect in OAuth login

Lack of permissions prompting when opening external URLs

Reflected XSS in Mattermost Jira plugin

Mattermost version 8.1.6 and earlier fails to sanitize channel mention data in posts, which allows an attacker to inject markup in the web client

Open redirect in /oauth/<service>/mobile_login?redirect_to=

Mattermost 5.38 and earlier fails to sufficiently sanitize clipboard contents, which allows a user-assisted attacker to inject arbitrary web script in product deployments that…

Fixed a bypass for a reflected cross-site scripting vulnerability affecting OAuth-enabled instances of Mattermost

Webhook Secret Exposure via Timing attack in MSteams plugin

Timing attack during remote cluster token comparison when shared channels are enabled

Playbook run link to private channel grants channel access

Denial of Service via Unbounded Memory Allocation in Integration Actions

User profile update exposes password hash and MFA secrets

Post actions can run playbook checklist task commands

Mattermost 6.2 and earlier fails to sufficiently process a specifically crafted GIF file when it is uploaded while drafting a post, which allows authenticated users to cause…

Mattermost server-side request forgery via OAuth endpoints configurable by a System Administrator

Mattermost ABAC parent policy bypass via policy update endpoint

SAML certificate deletion allows path traversal to delete arbitrary files outside the config directory

mmctl export download command doesn’t restrict permissions to created file to file owner

Insecure Android File Provider Paths

Mattermost Desktop logs all keystrokes during initial run after fresh installation

Insufficient validation of guest board admin privileges on archive import

Deactivated guest accounts can authenticate via magic-link token in Mattermost REST API login endpoint

Ordinary group/direct message member can enable group_constrained and remove all channel participants

GitLab Plugin Allows Non-Admin Users to Modify Default Instance Configuration