Mattermost Desktop App fails to enable Hardened Runtime when packaged for Mac App Store

Team admin can escalate a team member's permissions via the team member roles endpoint

Mattermost schemes teams endpoint exposes private team invite IDs

User Manager can demote bot accounts to guest without bot-management permission

Improper Permission Check Allows User Manager to Deactivate Bot Accounts

OAuth authorization code client binding not enforced during token redemption in Mattermost

Team Admin Privilege Escalation to Demote Members to Guest

Channel and Team Membership APIs inadvertently allow loss of Member privileges.

Team Privacy Settings Authorization Bypass in Mattermost Server

Access control flaw for team admins allows unauthorized team additions

Mattermost Desktop App Missing IPC Sender Validation in Calls Leave Handler

Lack of Invalidation of Legacy Remote Cluster Invite Tokens After Confirmation

Insecure string comparison enables timing attacks

Email addresses of remote users visible in props regardless of server settings

Improper post type validation on scheduled post endpoints

Mattermost thread memberships persist after team removal, exposing private channel thread metadata on re-invite

Markdown image rendering bypass in AI bot tool result posts in Mattermost

Calling window.close() from server-side content causes crash in the Mattermost Desktop App

Password Change Bypass via Auth Switch Endpoint

Channel member objects leak read status

AI plugin APIs can be triggered using post actions

Incorrect Session Creation with Desktop SSO

Plaintext pre-auth secret exposure via Desktop App diagnostics report

Mattermost Desktop App logging sensitive information and fails to clear data on server deletion

macOS TCC Bypass via Code Injection

Time-of-check time-of-use vulnerability in common teams API

Invite token is used as part of the secure communication

Improper Access Control in Mattermost Channel Member API

Mattermost GitHub Plugin allows unauthorized GitHub reactions via reaction forwarding hijacking

Mattermost OpenID discovery endpoint request bypasses outbound connection filtering, allowing SSRF by a System Administrator

Connected Workspaces: Malicious remote server can manipulate arbitrary user's status

Team Admin Bypass of Invite Permissions via allow_open_invite Field

System Admin Cannot Access Environment settings in System Console While System Manager Can

MFA Enforcement Bypass Allows Unauthorized Removal of MFA for Other Users

Unauthorized Access to User Activity Logs API by delegated granular administration roles

Auto-Enrollment of Team Admins into Private Channels without explicit consent

Unauthorized disabling of invite URL

RemoteClusterFrame payloads are audit logged in full

Mattermost fails to properly check permissions when retrieving a post allowing for a System Role with the permission to manage channels to read the posts of a DM conversation

Mattermost fails to properly verify the permissions when managing/updating a bot allowing a User Manager role with user edit permissions to manage/update bots

Mattermost Desktop App plugin popout scheme validation bypass

Missing timestamp validation in Zoom webhook handler