Server-side Denial of Service while processing a specifically crafted GIF file

Mattermost 6.0 and earlier fails to sufficiently validate parameters during post creation, which allows authenticated attackers to cause a client-side crash of the web application…

Mattermost server-side request forgery via OAuth endpoints configurable by a System Administrator

Mattermost ABAC parent policy bypass via policy update endpoint

SAML certificate deletion allows path traversal to delete arbitrary files outside the config directory

mmctl export download command doesn’t restrict permissions to created file to file owner

Insecure Android File Provider Paths

Mattermost Desktop logs all keystrokes during initial run after fresh installation

Insufficient validation of guest board admin privileges on archive import

Deactivated guest accounts can authenticate via magic-link token in Mattermost REST API login endpoint

Ordinary group/direct message member can enable group_constrained and remove all channel participants

GitLab Plugin Allows Non-Admin Users to Modify Default Instance Configuration

GitHub OAuth Scope Validation

Insufficient authorization in shared channel membership sync grants team-level access instead of channel-level access

Slack import bypasses email verification for team access controls

One-Click Mattermost Account Takeover via Poisoned RelayState SAML Parameter

Mattermost Playbooks exposes private channel metadata to unauthorized users via run metadata API

Mattermost Playbooks allows privilege escalation through improper access control in playbook run participant management

Bypass of System Admin User Deactivation Controls for Personal Access Tokens in Mattermost Server

Unauthorized Bot Login Using Credentials

Unauthorized access on archived channels

Weak SSRF Filtering

Malicious remote can create arbitrary channels

Creating posts with user-defined IDs permitted in CreatePost API

Playbooks access/modification by removed team member

HTML injection via channel autocomplete

A team member can soft delete other teams that they are not part of

Disabling publicly-shared boards does not disable existing publicly available board links

Unrestricted navigation due to unvalidated mattermost server redirection

Stored XSS via SVG attachment on Boards

Unauthorized email invite to a private channel

HTML Injection while inviting Guests

Mattermost 6.0 and earlier fails to sufficiently validate the email address during registration, which allows attackers to trick users into signing up using attacker-controlled…

Unauthenticated webhook request with null notification entry could crash the Microsoft Calendar plugin.

Plugin bot username conflict allows user account to be used as bot identity in Mattermost Server

Persistent notification timing attack causing server denial of service

MS Teams plugin OAuth allows editing arbitrary posts

Repeated LDAP login failures can lock an LDAP account

Leaked User IDs and Metadata of Deleted DMs

Misleading UI for undefined admin console settings in Calls causes security confusion

Domain Restriction Bypass on Registration

Silent Desktop Screenshot Capture

User creation date manipulation in POST /api/v4/users

LaTeX post content manipulation via renderer state leak across contexts

Channel IDs of archived/restored channels leaked via webhook events

Lack of permission check when updating the profile picture of a remote user (shared channels enabled)

Inaccessible Post Information Leak via Run Timeline IDOR

Public endpoint /metrics of Calls plugin reveals channel IDs

Log Flooding due to specially crafted requests in different endpoints

Denial of Service via Link Preview in /api/v4/redirect_location