Github.Com Mattermost Mattermost-Server vulnerabilities

CVE-2023-1777 [MEDIUM] CWE-668 Mattermost vulnerable to information disclosure Mattermost vulnerable to information disclosure Mattermost allows an attacker to request a preview of an existing message when creating a new message via the createPost API call, disclosing the contents of the linked message.

CVE-2025-31947 Mattermost Fails to Lockout LDAP Users After Repeated Login Failures in github.com/mattermost/mattermost-server Mattermost Fails to Lockout LDAP Users After Repeated Login Failures in github.com/mattermost/mattermost-server Mattermost Fails to Lockout LDAP Users After Repeated Login Failures in github.com/mattermost/mattermost-server

CVE-2023-1774 [MEDIUM] CWE-862 Mattermost fails to properly authentication inviter's permissions to private channel Mattermost fails to properly authentication inviter's permissions to private channel When processing an email invite to a private channel on a team, Mattermost fails to validate the inviter's permission to that channel, allowing an attacker to invite themselves to a private channel. [Issue Identifier](https://mattermost.com/security-updates/): MMSA-2023-00137

CVE-2025-9084 [LOW] CWE-601 Mattermost Open Redirect vulnerability Mattermost Open Redirect vulnerability Mattermost versions 10.5.x <= 10.5.9 fail to properly validate redirect URLs which allows attackers to redirect users to malicious sites via crafted OAuth login URLs.

CVE-2017-18895 [MEDIUM] CWE-200 Mattermost Server exposes sensitive user status information via REST API version 4 endpoint Mattermost Server exposes sensitive user status information via REST API version 4 endpoint An issue was discovered in Mattermost Server before 4.2.0, 4.1.1, and 4.0.5. It allows attackers to obtain sensitive information (user statuses) via a REST API version 4 endpoint.

CVE-2016-11076 [HIGH] CWE-295 Mattermost Server does not check if cookies are used over SSL Mattermost Server does not check if cookies are used over SSL An issue was discovered in Mattermost Server before 3.0.0. It does not ensure that a cookie is used over SSL.

CVE-2017-18875 [MEDIUM] CWE-22 Mattermost Server does not prevent System Admin from arbitrary file creation Mattermost Server does not prevent System Admin from arbitrary file creation An issue was discovered in Mattermost Server before 4.3.0, 4.2.1, and 4.1.2 when local storage for files is used. A System Admin can create arbitrary files.

CVE-2016-11063 [MEDIUM] CWE-79 Mattermost Server vulnerable to Cross-site Scripting through file preview feature Mattermost Server vulnerable to Cross-site Scripting through file preview feature An issue was discovered in Mattermost Server before 3.5.1. XSS can occur via file preview.

CVE-2017-18879 [MEDIUM] CWE-79 Mattermost Server is vulnerable to XSS through author_link field in Slack attachments Mattermost Server is vulnerable to XSS through author_link field in Slack attachments An issue was discovered in Mattermost Server before 4.3.0, 4.2.1, and 4.1.2. XSS could occur via the author_link field of a Slack attachment.

CVE-2017-18893 [MEDIUM] CWE-79 Mattermost Server is vulnerable to XSS through display name field Mattermost Server is vulnerable to XSS through display name field An issue was discovered in Mattermost Server before 4.2.0, 4.1.1, and 4.0.5. Display names allow XSS.

CVE-2017-18918 [MEDIUM] CWE-22 Mattermost Server does not restrict SAML certificate path for System Administrators Mattermost Server does not restrict SAML certificate path for System Administrators An issue was discovered in Mattermost Server before 3.7.3 and 3.6.5. A System Administrator can place a SAML certificate at an arbitrary pathname.

CVE-2024-42497 Mattermost allows user with systems manager role with read-only access to teams to perform write operations on teams in github.com/mattermost/mattermost-server Mattermost allows user with systems manager role with read-only access to teams to perform write operations on teams in github.com/mattermost/mattermost-server Mattermost allows user with systems manager role with read-only access to teams to perform write operations on teams in github.com/mattermost/mattermost-server

CVE-2024-29977 Mattermost failed to properly validate synced reactions in github.com/mattermost/mattermost-server Mattermost failed to properly validate synced reactions in github.com/mattermost/mattermost-server Mattermost failed to properly validate synced reactions in github.com/mattermost/mattermost-server

CVE-2026-22892 [MEDIUM] CWE-863 Mattermost doesn't validate user permissions when creating Jira issues from Mattermost posts Mattermost doesn't validate user permissions when creating Jira issues from Mattermost posts Mattermost versions 11.1.x <= 11.1.2, 10.11.x <= 10.11.9, 11.2.x <= 11.2.1 fail to validate user permissions when creating Jira issues from Mattermost posts, which allows an authenticated attacker with access to the Jira plugin to read post content and attachments from channels th

CVE-2025-32093 [MEDIUM] CWE-863 Mattermost Fails to Restrict Certain Operations on System Admins Mattermost Fails to Restrict Certain Operations on System Admins Mattermost versions 10.5.x <= 10.5.1, 10.4.x <= 10.4.3, 9.11.x <= 9.11.9 fail to restrict certain operations on system admins to only other system admins, which allows delegated granular administration users with the "Edit Other Users" permission to perform unauthorized modifications to system administrators via improper permission val

CVE-2026-4265 [MEDIUM] CWE-863 Mattermost fails to validate team-specific upload_file permissions Mattermost fails to validate team-specific upload_file permissions Mattermost versions 11.3.x <= 11.3.0, 11.2.x <= 11.2.2, 10.11.x <= 10.11.10 fail to validate team-specific upload_file permissions which allows a guest user to post files in channels where they lack upload_file permission via uploading files in a team where they have permission and reusing the file metadata in a POST request to a di

CVE-2026-3637 [MEDIUM] CWE-862 Mattermost doesn't check the create_post channel permission during post edit operations Mattermost doesn't check the create_post channel permission during post edit operations Mattermost versions 11.5.x <= 11.5.1, 10.11.x <= 10.11.13, 11.4.x <= 11.4.3 fail to check the create_post channel permission during post edit operations which allows an authenticated attacker with revoked posting privileges to modify their existing posts via direct API requests to the post u

CVE-2026-3113 [MEDIUM] CWE-732 Mattermost doesn't set permissions on downloaded bulk export Mattermost doesn't set permissions on downloaded bulk export Mattermost versions 11.4.x <= 11.4.0, 11.3.x <= 11.3.1, 11.2.x <= 11.2.3, 10.11.x <= 10.11.11 fail to set permissions on downloaded bulk export which allows other local users on the server to be able to read contents of the bulk export. Mattermost Advisory ID: MMSA-2026-00593.

CVE-2017-18898 [MEDIUM] CWE-404 Mattermost Server is vulnerable to DoS through maliciously crafted posts Mattermost Server is vulnerable to DoS through maliciously crafted posts An issue was discovered in Mattermost Server before 4.2.0, 4.1.1, and 4.0.5. It allows crafted posts that potentially cause a web browser to hang.

CVE-2016-11067 [MEDIUM] CWE-400 Mattermost Server is vulnerable to Uncontrolled Resource Consumption Mattermost Server is vulnerable to Uncontrolled Resource Consumption An issue was discovered in Mattermost Server before 3.2.0. It allowed crafted posts that could cause a web browser to hang.