Github.Com Mattermost Mattermost-Server vulnerabilities

CVE-2016-11079 [MEDIUM] CWE-79 Mattermost Server allows XSS via redirect URL Mattermost Server allows XSS via redirect URL An issue was discovered in Mattermost Server before 3.0.0. It allows XSS via a redirect URL.

CVE-2017-18877 [MEDIUM] CWE-79 Mattermost Server is vulnerable to XSS attacks against an OAuth 2.0 allow/deny page Mattermost Server is vulnerable to XSS attacks against an OAuth 2.0 allow/deny page An issue was discovered in Mattermost Server before 4.3.0, 4.2.1, and 4.1.2. XSS attacks could occur against an OAuth 2.0 allow/deny page.

CVE-2017-18892 [MEDIUM] CWE-116 Mattermost Server does not neutralize HTML content in an Email template field Mattermost Server does not neutralize HTML content in an Email template field An issue was discovered in Mattermost Server before 4.2.0, 4.1.1, and 4.0.5. E-mail templates can have a field in which HTML content is not neutralized.

CVE-2017-18891 [MEDIUM] Mattermost Server does not safeguard against phishing via error page links Mattermost Server does not safeguard against phishing via error page links An issue was discovered in Mattermost Server before 4.2.0, 4.1.1, and 4.0.5. It allows Phishing because an error page can have a link.

CVE-2023-5968 [MEDIUM] CWE-116 Mattermost password hash disclosure vulnerability Mattermost password hash disclosure vulnerability Mattermost fails to properly sanitize the user object when updating the username, resulting in the password hash being included in the response body.

CVE-2024-54682 Mattermost Data Amplification vulnerability in github.com/mattermost/mattermost-server Mattermost Data Amplification vulnerability in github.com/mattermost/mattermost-server Mattermost Data Amplification vulnerability in github.com/mattermost/mattermost-server

CVE-2024-41162 Mattermost allows a remote actor to make an arbitrary local channel read-only in github.com/mattermost/mattermost-server Mattermost allows a remote actor to make an arbitrary local channel read-only in github.com/mattermost/mattermost-server Mattermost allows a remote actor to make an arbitrary local channel read-only in github.com/mattermost/mattermost-server

CVE-2025-41423 Mattermost Playbooks fails to properly validate permissions in github.com/mattermost/mattermost-plugin-playbooks Mattermost Playbooks fails to properly validate permissions in github.com/mattermost/mattermost-plugin-playbooks Mattermost Playbooks fails to properly validate permissions in github.com/mattermost/mattermost-plugin-playbooks. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions.

CVE-2024-48872 Mattermost Race Condition vulnerability in github.com/mattermost/mattermost-server Mattermost Race Condition vulnerability in github.com/mattermost/mattermost-server Mattermost Race Condition vulnerability in github.com/mattermost/mattermost-server

CVE-2025-12559 [MEDIUM] CWE-200 Mattermost fails to sanitize team email addresses Mattermost fails to sanitize team email addresses Mattermost versions 11.0.x <= 11.0.2, 10.12.x <= 10.12.1, 10.11.x <= 10.11.4, 10.5.x <= 10.5.12 fail to sanitize team email addresses to be visible only to Team Admins, which allows any authenticated user to view team email addresses via the GET /api/v4/channels/{channel_id}/common_teams endpoint

CVE-2025-13767 [MEDIUM] CWE-863 Mattermost doesn't validate user channel membership when attaching Mattermost posts as comments to Jira issues Mattermost doesn't validate user channel membership when attaching Mattermost posts as comments to Jira issues Mattermost versions 11.1.x <= 11.1.0, 11.0.x <= 11.0.5, 10.12.x <= 10.12.3, 10.11.x <= 10.11.7 fails to validate user channel membership when attaching Mattermost posts as comments to Jira issues, which allows an authenticated attacker with acce

CVE-2026-3636 [MEDIUM] CWE-200 Mattermost doesn't sanitize team member data when returned via API to users without elevated permissions Mattermost doesn't sanitize team member data when returned via API to users without elevated permissions Mattermost versions 11.6.x <= 11.6.0, 11.5.x <= 11.5.3, 11.4.x <= 11.4.4, 10.11.x <= 10.11.14 fail to sanitize team member data when returned via API to users without elevated permissions which allows a user without permissions to get data about team members

CVE-2026-3433 [MEDIUM] CWE-200 Mattermost doesn't restrict role_updated websocket event broadcasts to members of the affected team or channel Mattermost doesn't restrict role_updated websocket event broadcasts to members of the affected team or channel Mattermost versions 11.6.x <= 11.6.1, 11.5.x <= 11.5.4, 10.11.x <= 10.11.15, 10.11.x <= 10.11.16 fail to restrict role_updated websocket event broadcasts to members of the affected team or channel, which allows an authenticated attacker with gues

CVE-2026-0999 [MEDIUM] CWE-303 Mattermost fails to properly validate login method restrictions Mattermost fails to properly validate login method restrictions Mattermost versions 11.1.x <= 11.1.2, 10.11.x <= 10.11.9, 11.2.x <= 11.2.1 fail to properly validate login method restrictions which allows an authenticated user to bypass SSO-only login requirements via userID-based authentication. Mattermost Advisory ID: MMSA-2025-00548

CVE-2026-2463 [MEDIUM] CWE-862 Mattermost fails to filter invite IDs based on user permissions Mattermost fails to filter invite IDs based on user permissions Mattermost versions 11.3.x <= 11.3.0, 11.2.x <= 11.2.2, 10.11.x <= 10.11.10 fail to filter invite IDs based on user permissions, which allows regular users to bypass access control restrictions and register unauthorized accounts via leaked invite IDs during team creation. Mattermost Advisory ID: MMSA-2025-00565

CVE-2026-4053 [LOW] CWE-672 Mattermost doesn't enforce the PostEditTimeLimit on non-message post fields Mattermost doesn't enforce the PostEditTimeLimit on non-message post fields Mattermost versions 11.5.x <= 11.5.1, 10.11.x <= 10.11.13 fail to enforce the PostEditTimeLimit on non-message post fields which allows an authenticated user to modify post file attachments, props, and pin status after the edit window has expired via the post patch and update API endpoints. Mattermost Advisory ID: MMS

CVE-2026-2455 [MEDIUM] CWE-918 Mattermost fails to canonicalize IPv4-mapped IPv6 addresses before reserved IP validation Mattermost fails to canonicalize IPv4-mapped IPv6 addresses before reserved IP validation Mattermost versions 11.3.x <= 11.3.0, 11.2.x <= 11.2.2, 10.11.x <= 10.11.10 fail to canonicalize IPv4-mapped IPv6 addresses before reserved IP validation which allows an attacker to perform SSRF attacks against internal services via IPv4-mapped IPv6 literals (e.g., [::ffff:127.0.0.1])..

CVE-2026-2458 [MEDIUM] CWE-862 Mattermost allows a removed team member to enumerate all public channels within a private team Mattermost allows a removed team member to enumerate all public channels within a private team Mattermost versions 11.3.x <= 11.3.0, 11.2.x <= 11.2.2, 10.11.x <= 10.11.10 fail to properly validate team membership when searching channels which allows a removed team member to enumerate all public channels within a private team via the channel search API endpoint. Mattermos

CVE-2026-24692 [MEDIUM] CWE-863 Mattermost fails to properly enforce read permissions in search API endpoints Mattermost fails to properly enforce read permissions in search API endpoints Mattermost versions 11.3.x <= 11.3.0, 11.2.x <= 11.2.2, 10.11.x <= 10.11.10 fail to properly enforce read permissions in search API endpoints which allows guest users without read permissions to access posts and files in channels via search API requests. Mattermost Advisory ID: MMSA-2025-00554

CVE-2026-4273 [LOW] CWE-863 Mattermost doesn't validate that the RefreshedToken differs from the original invite token during remote cluster invite confirmation Mattermost doesn't validate that the RefreshedToken differs from the original invite token during remote cluster invite confirmation Mattermost versions 11.5.x <= 11.5.1, 10.11.x <= 10.11.13 fail to validate that the RefreshedToken differs from the original invite token during remote cluster invite confirmation which allows an authentic