Arbitrary post deletion via Playbooks /ignore-thread endpoint

Private channel names leaked with Ctrl+K when ElasticSearch is enabled

Insufficient Authorization On Unlinked Channel Files

Unauthorized access on archived channels via file links

Excessive Resource Consumption via `/export`

Unauthorized channel file upload

IDOR when marking read a user's channel

Malicious remote can claim that a user was synced from another remote

Malicious remote can make an arbitrary local channel read-only

Remote username set to an arbitrary string by remote user

Malicious remote can create arbitrary reactions on arbitrary posts

Slash commands run in channel without channel membership via playbook task commands

/playbook add slash command allows viewing arbitrary post contents

SAML to email switch possible when email signin is disabled

Run Details leak to guest via webhook event "custom_playbooks_playbook_run_updated"

Playbook Run Metadata leak to Guest

AD/LDAP Group Members Leak

Mattermost versions 9.6.0, 9.5.x before 9.5.3, 9.4.x before 9.4.5, and 8.1.x before 8.1.12 fail to handle JSON parsing errors in custom status values, which allows an…

Detailed error discloses full file path with dev mode off

Mattermost versions 8.1.x before 8.1.10, 9.2.x before 9.2.6, 9.3.x before 9.3.2, and 9.4.x before 9.4.3 fail to limit the number of @-mentions processed per message, allowing an…

Mattermost versions 8.1.x before 8.1.9, 9.2.x before 9.2.5, 9.3.0, and 9.4.x before 9.4.2 fail to limit the number of role names requested from the API, allowing an authenticated…

Mattermost version 8.1.x before 8.1.9 fails to sanitize data associated with permalinks when a plugin updates an ephemeral post, allowing an authenticated attacker who can control…

Mattermost versions 8.1.x before 8.1.9, 9.2.x before 9.2.5, and 9.3.0 fail to sanitize the metadata on posts containing permalinks under specific conditions, which allows an…

Existing server guests invited to the team by members without "invite_guest" permission

Public channel post content accessible without membership when compliance export is enabled

Files of archived channels accessible with the “Allow users to view archived channels” option disabled

Denial of service in mattermost mobile apps and server via emoji reactions

Incorrect Authorization leads to Channel Member Count Leak

Details of archived public channels are leaked to members of another team

Lack of restriction to manage group names for freshly demoted guests

Keywords that trigger mentions are leaked to other users

Leak Inaccessible Playbook Information via Channel Action IDOR

IDOR when updating the tasks of a private playbook run

Insecure Direct Object Reference in /plugins/focalboard/ api/v2/users of Mattermost Boards

Permalink previews displayed for posts in archived channels even if users are disallowed to view archived channels

Users full name disclosure through Mattermost Boards with Show Full Name Option disabled

Username and Icon override can be used by members when Hardened Mode is enabled

Denial of Service via crashing the Calls Plugin

Mobile app freezes when receiving a post with hundreds of emojis

Full name disclosure via team top membership with Show Full Name option disabled

A system/user manager can demote / deactivate another manager

Mattermost fails to delete the attachments when deleting a message in a thread allowing a simple user to still be able to access and download the attachment of a deleted message

Mattermost fails to properly truncate the postgres error log message of a search query failure allowing an attacker to cause the creation of large log files which can result in…

When creating a playbook run via the /dialog API, Mattermost fails to validate all parameters, allowing an authenticated attacker to edit an arbitrary channel post

Mattermost fails to properly check the permissions when executing commands allowing a member with no permissions to post a message in a channel to actually post it by executing…

Mattermost Apps Framework fails to verify that a secret provided in the incoming webhook request allowing an attacker to modify the contents of the post sent by the Apps

Mattermost fails to check the "Show Full Name" setting when rendering the result for the /plugins/focalboard/api/v2/users API call, allowing an attacker to learn the full name of…

The Guest account feature in Mattermost version 6.7.0 and earlier fails to properly restrict the permissions, which allows a guest user to fetch a list of all public channels in…

Missing per-channel team-scope check in ABAC access control policy unassign allows cross-team policy removal

Google OAuth Authentication Bypass for Converted Bot Accounts