CRITICAL9.9CVE-2025-12421Mattermost fails to to verify the token used during code exchange in github.com/mattermost/mattermost-server from 0
CRITICAL9.9CVE-2025-12419Mattermost fails to properly validate OAuth state tokens during OpenID Connect authentication in github.com/mattermost/mattermost-server from 0
CRITICAL9.9CVE-2025-4981Mattermost allows authenticated users to write files to arbitrary locations in github.com/mattermost/mattermost-server from 0
CRITICAL9.9Mattermost allows reading arbitrary files related to importing boards in github.com/mattermost/mattermost-server
from 0
CRITICAL9.9Mattermost allows reading arbitrary files in github.com/mattermost/mattermost-server
from 0
HIGH8.8Insecure plugin handling in Mattermost in github.com/mattermost/mattermost-server
from 0
HIGH8.7Mattermost doesn't sanitize sensitive configuration fields before including them in support packet generation in github.com/mattermost/mattermost-server
from 0
HIGH8.7Mattermost allows unsolicited invites to expose access to local channels in github.com/mattermost/mattermost-server
from 0
HIGH8.7Mattermost failed to properly validate that the channel that comes from the sync message is a shared channel in github.com/mattermost/mattermost-server
from 0
HIGH8.1Mattermost has a Missing Authorization vulnerability in github.com/mattermost/mattermost-server
from 0
HIGH8.1Mattermost has a Missing Authorization vulnerability in github.com/mattermost/mattermost-server
from 0
HIGH8.0Mattermost allows attackers to manipulate administrator terminals via crafted messages containing ANSI and OSC escape sequences in github.com/mattermost/mattermost-server
from 0
HIGH8.0Mattermost Path Traversal vulnerability in github.com/mattermost/mattermost-server
from 0
HIGH7.6Mattermost Open Redirect vulnerability in github.com/mattermost/mattermost-server
from 0
HIGH7.5Mattermost doesn't properly validate msgpack-encoded WebSocket frames before memory allocation in github.com/mattermost/mattermost-server
from 0
HIGH7.5Mattermost fails to properly handle very long passwords in github.com/mattermost/mattermost-server
from 0
HIGH7.5Mattermost Fails to Enforce MFA on Plugin Endpoints in github.com/mattermost/mattermost-server
from 0
HIGH7.5Mattermost Server is vulnerable to a Denial of Service attack through `invite_people` command in github.com/mattermost/mattermost-server
from 0, < 5.1.0
HIGH7.4Mattermost failed to disallow the modification of local users when syncing users in shared channels in github.com/mattermost/mattermost-server
from 0
HIGH7.2Mattermost with Jira plugin enabled has Incorrect Implementation of Authentication Algorithm in github.com/mattermost/mattermost-plugin-jira
from 0
MEDIUM6.8Mattermost doesn't validate CSRF tokens on an authentication endpoint in github.com/mattermost/mattermost-server
from 0
MEDIUM6.8Mattermost allows system administrators to read arbitrary host files via malicious AdvancedLoggingJSON configuration in github.com/mattermost/mattermost-server
from 0
MEDIUM6.8Mattermost Fails to Sanitize Path Traversal Sequences in github.com/mattermost/mattermost-server
from 0, <= 5.39.5
MEDIUM6.8Mattermost Fails to Sanitize Path Traversal Sequences in github.com/mattermost/mattermost-server
from 0
MEDIUM6.8Mattermost Fails to Validate File Paths in github.com/mattermost/mattermost-server
from 0, <= 5.11.1
MEDIUM6.8Mattermost Fails to Validate Remote Cluster Upload Sessions in github.com/mattermost/mattermost-server
from 0, <= 5.39.3
MEDIUM6.8Mattermost Fails to Validate File Paths in github.com/mattermost/mattermost-server
from 0
MEDIUM6.8Mattermost Fails to Validate Remote Cluster Upload Sessions in github.com/mattermost/mattermost-server
from 0
MEDIUM6.8Mattermost Path Traversal vulnerability in github.com/mattermost/mattermost-server
from 0
MEDIUM6.8Mattermost allows a remote actor to permanently delete local data by abusing dangerous error handling in github.com/mattermost/mattermost-server
from 0
MEDIUM6.5Mattermost doesn't filter nil elements from outgoing webhook attachment payloads before processing in github.com/mattermost/mattermost-server
from 0
MEDIUM6.5Mattermost doesn't verify channel membership when processing AI-assisted message rewrites in github.com/mattermost/mattermost-server
from 0
MEDIUM6.5Mattermost doesn't prevent disclosure of created user password in github.com/mattermost/mattermost-server
from 0
MEDIUM6.5Mattermost has session spoofing due to lack of single-use consumption of guest magic link tokens enforcement in github.com/mattermost/mattermost-server
from 0
MEDIUM6.5Mattermost doesn't validate decompressed archive entry sizes during file extraction in github.com/mattermost/mattermost-server
from 0
MEDIUM6.5Mattermost does not enforce MFA on WebSocket connections in github.com/mattermost/mattermost-server
from 0
MEDIUM6.5Mattermost Missing Authorization vulnerability in github.com/mattermost/mattermost-server
from 0
MEDIUM6.5Mattermost Missing Authentication for Critical Function in github.com/mattermost/mattermost-server
from 0
MEDIUM6.5Mattermost Playbooks fails to properly validate the props used by the RetrospectivePost custom post type in github.com/mattermost/mattermost-plugin-playbooks
from 0
MEDIUM6.5Mattermost Playbooks fails to validate the uniqueness and quantity of task actions in github.com/mattermost/mattermost-plugin-playbooks
from 0
MEDIUM6.5Mattermost webapp crash via a crafted post in github.com/mattermost/mattermost-server
from 0
MEDIUM6.5Mattermost fails to properly validate post props in github.com/mattermost/mattermost-server
from 0
MEDIUM6.5Mattermost fails to properly validate post props in github.com/mattermost/mattermost-server
from 0
MEDIUM6.5Mattermost Incorrect Type Conversion or Cast in github.com/mattermost/mattermost-server
from 0
MEDIUM6.5Mattermost Improper Validation of Specified Type of Input vulnerability in github.com/mattermost/mattermost-server
from 0
MEDIUM6.5Mattermost Data Amplification vulnerability in github.com/mattermost/mattermost-server
from 0
MEDIUM6.5Mattermost fails to authenticate the source of certain types of post actions in github.com/mattermost/mattermost-server
from 0
MEDIUM6.5Mattermost vulnerable to information disclosure
>= 5.0.0, < 7.1.6
MEDIUM6.5Mattermost users could access some sensitive information via API call in github.com/mattermost/mattermost-server
from 0
MEDIUM6.5Resource exhaustion in Mattermost in github.com/mattermost/mattermost-server
from 0
MEDIUM6.1Cross-site Scripting in Mattermost in github.com/mattermost/mattermost-server
from 0, < 5.39.0
MEDIUM6.1Cross-site Scripting in Mattermost in github.com/mattermost/mattermost-server
from 0, < 5.39.0
MEDIUM6.0Mattermost allows user with systems manager role with read-only access to teams to perform write operations on teams in github.com/mattermost/mattermost-server
from 0
MEDIUM5.8Mattermost Fails to Lockout LDAP Users After Repeated Login Failures in github.com/mattermost/mattermost-server
from 0
MEDIUM5.7Mattermost allows attackers to take over arbitrary user accounts via overly permissive substring matching flaw in github.com/mattermost/mattermost-server
from 0
MEDIUM5.7Mattermost fails to sanitize sensitive data in WebSocket messages in github.com/mattermost/mattermost-server
from 0
MEDIUM5.5Mattermost allows remote actor to create/update/delete posts in arbitrary channels in github.com/mattermost/mattermost-server
from 0
MEDIUM5.4Mattermost has an Incorrect Authorization issue in github.com/mattermost/mattermost-server
from 0
MEDIUM5.4Mattermost fails to properly validate login method restrictions in github.com/mattermost/mattermost-server
from 0
MEDIUM5.4Mattermost allows an attacker to edit arbitrary posts via a crafted MSTeams plugin OAuth redirect URL in github.com/mattermost/mattermost-server
from 0
MEDIUM5.4Mattermost has a Missing Authorization vulnerability in github.com/mattermost/mattermost-server
from 0
MEDIUM5.4Mattermost Incorrect Authorization vulnerability in github.com/mattermost/mattermost-server
from 0
MEDIUM5.4Mattermost fails to properly invalidate personal access tokens upon user deactivation in github.com/mattermost/mattermost-server
from 0
MEDIUM5.4Mattermost vulnerable to Incorrect Implementation of Authentication Algorithm in github.com/mattermost/mattermost-server
from 0
MEDIUM5.4Mattermost allows members with permission to convert public channels to private and convert private to public in github.com/mattermost/mattermost-server
from 0
MEDIUM5.4Mattermost fails to strip `embeds` from `metadata` when broadcasting `posted` events in github.com/mattermost/mattermost-server
from 0
MEDIUM5.4Mattermost vulnerable to cross-site scripting (XSS)
>= 5.0.0, < 7.1.6
MEDIUM5.4Mattermost fails to properly authentication inviter's permissions to private channel
>= 5.0.0, < 7.1.6
MEDIUM5.3Mattermost fails to limit the size of responses from integration action endpoints in github.com/mattermost/mattermost-server
from 0
MEDIUM5.3Mattermost improperly allows team administrators to modify team invites in github.com/mattermost/mattermost-server
from 0
MEDIUM5.3Mattermost vulnerable to Observable Timing Discrepancy in github.com/mattermost/mattermost-plugin-msteams
from 0
MEDIUM5.3Mattermost Server Sensitive Data Exposure in github.com/mattermost/mattermost
from 0, < 5.20.0
MEDIUM5.3Mattermost Server Sensitive Data Exposure in github.com/mattermost/mattermost
from 0, < 5.20.0
MEDIUM4.9Mattermost allows system administrators to access password hashes and MFA secrets in github.com/mattermost/mattermost-server
from 0
MEDIUM4.9Mattermost has Potential Server Crash due to Unvalidated Import Data in github.com/mattermost/mattermost-server
from 0, <= 5.39.3
MEDIUM4.9Mattermost has Potential Server Crash due to Unvalidated Import Data in github.com/mattermost/mattermost-server
from 0
MEDIUM4.9Mattermost password hash disclosure vulnerability
from 0, < 5.3.2-0.20230825233148-f787fd63368a
MEDIUM4.8Mattermost Race Condition vulnerability in github.com/mattermost/mattermost-server
from 0
MEDIUM4.8Mattermost allows remote/synthetic users to create sessions, reset passwords in github.com/mattermost/mattermost-server
from 0
MEDIUM4.7Mattermost Fails to Restrict Certain Operations on System Admins in github.com/mattermost/mattermost-server
from 0
MEDIUM4.7Mattermost doesn't restrict which roles can promote a user as system admin in github.com/mattermost/mattermost-server
from 0
MEDIUM4.7Mattermost Server Improper Access Control in github.com/mattermost/mattermost-server
from 0
MEDIUM4.6Mattermost doesn't properly validate CSRF tokens in github.com/mattermost/mattermost-server
from 0
MEDIUM4.6Mattermost Server Path Traversal vulnerability that leads to Cross-Site Request Forgery in github.com/mattermost/mattermost-server
from 0
MEDIUM4.6Mattermost Cross-Site Request Forgery vulnerability in github.com/mattermost/mattermost-server
from 0
MEDIUM4.6Improper Control of a Resource Through its Lifetime in Mattermost in github.com/mattermost/mattermost-server
from 0
MEDIUM4.3Mattermost has an Incorrect Authorization issue in github.com/mattermost/mattermost-server
from 0
MEDIUM4.3Mattermost doesn't check public/private permissions in github.com/mattermost/mattermost-plugin-playbooks
from 0
MEDIUM4.3Mattermost doesn't enforce slash command trigger-word uniqueness during command updates in github.com/mattermost/mattermost-server
from 0
MEDIUM4.3Mattermost doesn't validate the X-Requested-With header on the burn-on-read reveal endpoint in github.com/mattermost/mattermost-server
from 0
MEDIUM4.3Mattermost does not verify remote cluster channel access when processing shared channel membership removals in github.com/mattermost/mattermost-server
from 0
MEDIUM4.3Mattermost doesn't validate 7zip archive structure before processing in github.com/mattermost/mattermost-server
from 0
MEDIUM4.3Mattermost doesn't check the create_post channel permission during post edit operations in github.com/mattermost/mattermost-server
from 0
MEDIUM4.3Mattermost allows authenticated guest users to enumerate user IDs outside their allowed visibility scope in github.com/mattermost/mattermost-server
from 0
MEDIUM4.3Mattermost: Authenticated DoS through failure to prevent rendering of external SVGs on link embeds in github.com/mattermost/mattermost-server
from 0
MEDIUM4.3Mattermost fails to properly enforce read permissions in search API endpoints in github.com/mattermost/mattermost-server
from 0
MEDIUM4.3Mattermost fails to canonicalize IPv4-mapped IPv6 addresses before reserved IP validation in github.com/mattermost/mattermost-server
from 0
MEDIUM4.3Mattermost fails to use consistent error responses when handling the /mute command in github.com/mattermost/mattermost-server
from 0
MEDIUM4.3Mattermost fails to validate team-specific upload_file permissions in github.com/mattermost/mattermost-server
from 0
MEDIUM4.3Mattermost allows a removed team member to enumerate all public channels within a private team in github.com/mattermost/mattermost-server
from 0