Github.Com Mattermost Mattermost Server V8 vulnerabilities

CVE-2026-6333 [LOW] CWE-918 Mattermost doesn't validate the Host header when constructing response URLs for custom slash command Mattermost doesn't validate the Host header when constructing response URLs for custom slash command Mattermost versions 11.5.x <= 11.5.1, 10.11.x <= 10.11.13 fail to validate the Host header when constructing response URLs for custom slash commands which allows an authenticated attacker to redirect slash command responses to an attacker-controlled server via a spoofe

CVE-2023-48369 [MEDIUM] CWE-400 Mattermost Uncontrolled Resource Consumption vulnerability Mattermost Uncontrolled Resource Consumption vulnerability Mattermost fails to limit the log size of server logs allowing an attacker sending specially crafted requests to different endpoints to potentially overflow the log.

CVE-2025-36530 [MEDIUM] CWE-22 Mattermost Fails to Validate File Paths Mattermost Fails to Validate File Paths Mattermost versions 10.9.x <= 10.9.1, 10.8.x <= 10.8.3, 10.5.x <= 10.5.8, 9.11.x <= 9.11.17 fail to properly validate file paths during plugin import operations which allows restricted admin users to install unauthorized custom plugins via path traversal in the import functionality, bypassing plugin signature enforcement and marketplace restrictions.

CVE-2025-8023 [MEDIUM] CWE-22 Mattermost Fails to Sanitize Path Traversal Sequences Mattermost Fails to Sanitize Path Traversal Sequences Mattermost versions 10.8.x <= 10.8.3, 10.5.x <= 10.5.8, 9.11.x <= 9.11.17, 10.9.x <= 10.9.2 fails to sanitize path traversal sequences in template file destination paths, which allows a system admin to perform path traversal attacks via malicious path components, potentially enabling malicious file placement outside intended directories.

CVE-2025-22445 [LOW] CWE-754 Mattermost has Improper Check for Unusual or Exceptional Conditions Mattermost has Improper Check for Unusual or Exceptional Conditions Mattermost versions 10.x <= 10.2 fail to accurately reflect missing settings, which allows confusion for admins regarding a Calls security-sensitive configuration via incorrect UI reporting.

CVE-2025-9072 [HIGH] CWE-601 Mattermost Open Redirect vulnerability Mattermost Open Redirect vulnerability Mattermost versions 10.10.x <= 10.10.1, 10.5.x <= 10.5.9, 10.9.x <= 10.9.4 fail to validate the redirect_to parameter, allowing an attacker to craft a malicious link that, once a user authenticates with their SAML provider, could post the user’s cookies to an attacker-controlled URL.

CVE-2025-62690 [LOW] CWE-601 Mattermost has missing redirect URL validation Mattermost has missing redirect URL validation Mattermost versions 10.11.x <= 10.11.4 fail to validate redirect URLs on the /error page, which allows an attacker to redirect a victim to a malicious site via a crafted link opened in a new tab.

CVE-2025-31947 [MEDIUM] CWE-645 Mattermost Fails to Lockout LDAP Users After Repeated Login Failures Mattermost Fails to Lockout LDAP Users After Repeated Login Failures Mattermost versions 10.6.x <= 10.6.1, 10.5.x <= 10.5.2, 10.4.x <= 10.4.4, 9.11.x <= 9.11.11 fail to lockout LDAP users following repeated login failures, which allows attackers to lock external LDAP accounts through repeated login failures through Mattermost.

CVE-2025-9084 [LOW] CWE-601 Mattermost Open Redirect vulnerability Mattermost Open Redirect vulnerability Mattermost versions 10.5.x <= 10.5.9 fail to properly validate redirect URLs which allows attackers to redirect users to malicious sites via crafted OAuth login URLs.

CVE-2023-6459 [MEDIUM] CWE-200 Mattermost Exposure of Sensitive Information to an Unauthorized Actor vulnerability Mattermost Exposure of Sensitive Information to an Unauthorized Actor vulnerability Mattermost is grouping calls in the /metrics endpoint by id and reports that id in the response. Since this id is the channelID, the public /metrics endpoint is revealing channelIDs.

CVE-2023-5195 [MEDIUM] CWE-863 Mattermost Incorrect Authorization vulnerability Mattermost Incorrect Authorization vulnerability Mattermost fails to properly validate the permissions when soft deleting a team allowing a team member to soft delete other teams that they are not part of

CVE-2024-42497 [HIGH] CWE-284 Mattermost allows user with systems manager role with read-only access to teams to perform write operations on teams Mattermost allows user with systems manager role with read-only access to teams to perform write operations on teams Mattermost versions 9.9.x <= 9.9.1, 9.5.x <= 9.5.7, 9.10.x <= 9.10.0, 9.8.x <= 9.8.2 fail to properly enforce permissions which allows a user with systems manager role with read-only access to teams to perform write operations on teams

CVE-2024-29977 [MEDIUM] CWE-284 Mattermost failed to properly validate synced reactions Mattermost failed to properly validate synced reactions Mattermost versions 9.9.x <= 9.9.0, 9.5.x <= 9.5.6 fail to properly validate synced reactions, when shared channels are enabled, which allows a malicious remote to create arbitrary reactions on arbitrary posts

CVE-2025-32093 [MEDIUM] CWE-863 Mattermost Fails to Restrict Certain Operations on System Admins Mattermost Fails to Restrict Certain Operations on System Admins Mattermost versions 10.5.x <= 10.5.1, 10.4.x <= 10.4.3, 9.11.x <= 9.11.9 fail to restrict certain operations on system admins to only other system admins, which allows delegated granular administration users with the "Edit Other Users" permission to perform unauthorized modifications to system administrators via improper permission val

CVE-2026-4265 [MEDIUM] CWE-863 Mattermost fails to validate team-specific upload_file permissions Mattermost fails to validate team-specific upload_file permissions Mattermost versions 11.3.x <= 11.3.0, 11.2.x <= 11.2.2, 10.11.x <= 10.11.10 fail to validate team-specific upload_file permissions which allows a guest user to post files in channels where they lack upload_file permission via uploading files in a team where they have permission and reusing the file metadata in a POST request to a di

CVE-2026-3637 [MEDIUM] CWE-862 Mattermost doesn't check the create_post channel permission during post edit operations Mattermost doesn't check the create_post channel permission during post edit operations Mattermost versions 11.5.x <= 11.5.1, 10.11.x <= 10.11.13, 11.4.x <= 11.4.3 fail to check the create_post channel permission during post edit operations which allows an authenticated attacker with revoked posting privileges to modify their existing posts via direct API requests to the post u

CVE-2026-27659 [MEDIUM] CWE-352 Mattermost doesn't properly validate CSRF tokens Mattermost doesn't properly validate CSRF tokens Mattermost versions 11.2.x <= 11.2.2, 10.11.x <= 10.11.10, 11.4.x <= 11.4.0, 11.3.x <= 11.3.1 fail to properly validate CSRF tokens in the /api/v4/access_control_policies/{policy_id}/activate endpoint, which allows an attacker to trick an admin into changing access control policy active status via a crafted request. Mattermost Advisory ID: MMSA-2026-00578

CVE-2025-6465 [MEDIUM] CWE-22 Mattermost Fails to Sanitize File Names Mattermost Fails to Sanitize File Names Mattermost versions 10.8.x <= 10.8.3, 10.5.x <= 10.5.8, 10.10.x <= 10.10.0, 10.9.x <= 10.9.3 fail to sanitize file names which allows users with file upload permission to overwrite file attachment thumbnails via path traversal in file streaming APIs.

CVE-2023-47168 [MEDIUM] CWE-601 Mattermost Open Redirect vulnerability Mattermost Open Redirect vulnerability Mattermost fails to properly check a redirect URL parameter allowing for an open redirect was possible when the user clicked "Back to Mattermost" after providing a invalid custom url scheme in /oauth/{service}/mobile_login?redirect_to=

CVE-2023-35075 [LOW] CWE-74 Mattermost Injection vulnerability Mattermost Injection vulnerability Mattermost fails to use innerText / textContent when setting the channel name in the webapp during autocomplete, allowing an attacker to inject HTML to a victim's page by create a channel name that is valid HTML. No XSS is possible though.