Channel export permitted on archived channel when viewing archived channels is disabled

Mobile crash via file with specially crafted filename

Improper propagation of permission scheme updates across cluster nodes

Private channel names leaking when Elasticsearch is enabled

Unauthorized Access to view channels' details

Arbitrary post deletion via Playbooks /ignore-thread endpoint

Private channel names leaked with Ctrl+K when ElasticSearch is enabled

Insufficient Authorization On Unlinked Channel Files

Unauthorized access on archived channels via file links

Excessive Resource Consumption via `/export`

Unauthorized channel file upload

IDOR when marking read a user's channel

Malicious remote can claim that a user was synced from another remote

Malicious remote can make an arbitrary local channel read-only

Remote username set to an arbitrary string by remote user

Malicious remote can create arbitrary reactions on arbitrary posts

Slash commands run in channel without channel membership via playbook task commands

/playbook add slash command allows viewing arbitrary post contents

SAML to email switch possible when email signin is disabled

Run Details leak to guest via webhook event "custom_playbooks_playbook_run_updated"

Playbook Run Metadata leak to Guest

AD/LDAP Group Members Leak

Mattermost versions 9.6.0, 9.5.x before 9.5.3, 9.4.x before 9.4.5, and 8.1.x before 8.1.12 fail to handle JSON parsing errors in custom status values, which allows an…

Detailed error discloses full file path with dev mode off

Mattermost versions 8.1.x before 8.1.10, 9.2.x before 9.2.6, 9.3.x before 9.3.2, and 9.4.x before 9.4.3 fail to limit the number of @-mentions processed per message, allowing an…

Mattermost versions 8.1.x before 8.1.9, 9.2.x before 9.2.5, 9.3.0, and 9.4.x before 9.4.2 fail to limit the number of role names requested from the API, allowing an authenticated…

Mattermost version 8.1.x before 8.1.9 fails to sanitize data associated with permalinks when a plugin updates an ephemeral post, allowing an authenticated attacker who can control…

Mattermost versions 8.1.x before 8.1.9, 9.2.x before 9.2.5, and 9.3.0 fail to sanitize the metadata on posts containing permalinks under specific conditions, which allows an…

Existing server guests invited to the team by members without "invite_guest" permission

Public channel post content accessible without membership when compliance export is enabled

Files of archived channels accessible with the “Allow users to view archived channels” option disabled

Denial of service in mattermost mobile apps and server via emoji reactions

Incorrect Authorization leads to Channel Member Count Leak

Details of archived public channels are leaked to members of another team

Lack of restriction to manage group names for freshly demoted guests

Keywords that trigger mentions are leaked to other users

Leak Inaccessible Playbook Information via Channel Action IDOR

IDOR when updating the tasks of a private playbook run

Insecure Direct Object Reference in /plugins/focalboard/ api/v2/users of Mattermost Boards

Permalink previews displayed for posts in archived channels even if users are disallowed to view archived channels

Users full name disclosure through Mattermost Boards with Show Full Name Option disabled

Username and Icon override can be used by members when Hardened Mode is enabled

Denial of Service via crashing the Calls Plugin

Mobile app freezes when receiving a post with hundreds of emojis

Full name disclosure via team top membership with Show Full Name option disabled

A system/user manager can demote / deactivate another manager

Attachment of deleted message in a thread remains accessible and downloadable

channel DoS by sharing a boards link

Lack of channel membership check when linking a board to a channel

Limited blind SSRF to localhost/intranet in interactive dialog implementation