Filtered by vendor Mattermost Subscriptions
Total 346 CVE
CVE Vendors Products Updated CVSS v3.1
CVE-2025-25274 1 Mattermost 1 Mattermost Server 2025-03-27 4.3 Medium
Mattermost versions 10.4.x <= 10.4.2, 10.3.x <= 10.3.3, 9.11.x <= 9.11.8 fail to restrict command execution in archived channels, which allows authenticated users to run commands in archived channels.
CVE-2025-27715 1 Mattermost 1 Mattermost Server 2025-03-27 3.3 Low
Mattermost versions 9.11.x <= 9.11.8 fail to prompt for explicit approval before adding a team admin to a private channel, which team admins to joining private channels via crafted permalink links without explicit consent from them.
CVE-2025-27933 1 Mattermost 1 Mattermost Server 2025-03-27 5.4 Medium
Mattermost versions 10.4.x <= 10.4.2, 10.3.x <= 10.3.3, 9.11.x <= 9.11.8 fail to fail to enforce channel conversion restrictions, which allows members with permission to convert public channels to private ones to also convert private ones to public
CVE-2025-30179 1 Mattermost 1 Mattermost Server 2025-03-27 4.3 Medium
Mattermost versions 10.4.x <= 10.4.2, 10.3.x <= 10.3.3, 9.11.x <= 9.11.8 fail to enforce MFA on certain search APIs, which allows authenticated attackers to bypass MFA protections via user search, channel search, or team search queries.
CVE-2025-24920 1 Mattermost 1 Mattermost Server 2025-03-27 4.3 Medium
Mattermost versions 10.4.x <= 10.4.2, 10.3.x <= 10.3.3, 9.11.x <= 9.11.8, 10.5.x <= 10.5.0 fail to restrict bookmark creation and updates in archived channels, which allows authenticated users created or update bookmarked in archived channels
CVE-2025-25068 1 Mattermost 1 Mattermost Server 2025-03-27 7.5 High
Mattermost versions 10.4.x <= 10.4.2, 10.3.x <= 10.3.3, 9.11.x <= 9.11.8, 10.5.x <= 10.5.0 fail to enforce MFA on plugin endpoints, which allows authenticated attackers to bypass MFA protections via API requests to plugin-specific routes.
CVE-2023-5920 2 Apple, Mattermost 2 Macos, Mattermost Desktop 2025-02-27 2.9 Low
Mattermost Desktop for MacOS fails to utilize the secure keyboard input functionality provided by macOS, allowing for other processes to read the keyboard input.
CVE-2024-21848 1 Mattermost 1 Mattermost Server 2025-02-27 3.1 Low
Improper Access Control in Mattermost Server versions 8.1.x before 8.1.11 allows an attacker that is in a channel with an active call to keep participating in the call even if they are removed from the channel
CVE-2024-24975 1 Mattermost 1 Mattermost Mobile 2025-01-21 3.5 Low
Uncontrolled Resource Consumption in Mattermost Mobile versions before 2.13.0 fails to limit the size of the code block that will be processed by the syntax highlighter, allowing an attacker to send a very large code block and crash the mobile app.
CVE-2024-3872 1 Mattermost 1 Mattermost Mobile 2025-01-21 3.1 Low
Mattermost Mobile app versions 2.13.0 and earlier use a regular expression with polynomial complexity to parse certain deeplinks, which allows an unauthenticated remote attacker to freeze or crash the app via a long maliciously crafted link.
CVE-2024-24988 1 Mattermost 1 Mattermost Server 2025-01-10 4.3 Medium
Mattermost fails to properly validate the length of the emoji value in the custom user status, allowing an attacker to send multiple times a very long string as an emoji value causing high resource consumption and possibly crashing the server.
CVE-2024-23493 1 Mattermost 1 Mattermost Server 2025-01-10 4.3 Medium
Mattermost fails to properly authorize the requests fetching team associated AD/LDAP groups, allowing a user to fetch details of AD/LDAP groups of a team that they are not a member of. 
CVE-2023-6459 1 Mattermost 1 Mattermost Server 2024-12-16 5.3 Medium
Mattermost is grouping calls in the /metrics endpoint by id and reports that id in the response. Since this id is the channelID, the public /metrics endpoint is revealing channelIDs.
CVE-2024-2445 1 Mattermost 1 Mattermost Server 2024-12-13 6.1 Medium
Mattermost Jira plugin versions shipped with Mattermost versions 8.1.x before 8.1.10, 9.2.x before 9.2.6, 9.3.x before 9.3.2, and 9.4.x before 9.4.3 fail to escape user-controlled outputs when generating HTML pages, which allows an attacker to perform reflected cross-site scripting attacks against the users of the Mattermost server.
CVE-2024-1953 1 Mattermost 1 Mattermost Server 2024-12-13 4.3 Medium
Mattermost versions 8.1.x before 8.1.9, 9.2.x before 9.2.5, 9.3.0, and 9.4.x before 9.4.2 fail to limit the number of role names requested from the API, allowing an authenticated attacker to cause the server to run out of memory and crash by issuing an unusually large HTTP request.
CVE-2024-1952 1 Mattermost 1 Mattermost Server 2024-12-13 3.1 Low
Mattermost version 8.1.x before 8.1.9 fails to sanitize data associated with permalinks when a plugin updates an ephemeral post, allowing an authenticated attacker who can control the ephemeral post update to access individual posts' contents in channels they are not a member of.
CVE-2024-1949 1 Mattermost 1 Mattermost Server 2024-12-13 2.6 Low
A race condition in Mattermost versions 8.1.x before 8.1.9, and 9.4.x before 9.4.2 allows an authenticated attacker to gain unauthorized access to individual posts' contents via carefully timed post creation while another user deletes posts.
CVE-2024-1942 1 Mattermost 1 Mattermost Server 2024-12-13 4.3 Medium
Mattermost versions 8.1.x before 8.1.9, 9.2.x before 9.2.5, and 9.3.0 fail to sanitize the metadata on posts containing permalinks under specific conditions, which allows an authenticated attacker to access the contents of individual posts in channels they are not a member of.
CVE-2024-28053 1 Mattermost 1 Mattermost Server 2024-12-13 3.1 Low
Resource Exhaustion in Mattermost Server versions 8.1.x before 8.1.10 fails to limit the size of the payload that can be read and parsed allowing an attacker to send a very large email payload and crash the server.
CVE-2024-2446 1 Mattermost 1 Mattermost Server 2024-12-13 4.3 Medium
Mattermost versions 8.1.x before 8.1.10, 9.2.x before 9.2.6, 9.3.x before 9.3.2, and 9.4.x before 9.4.3 fail to limit the number of @-mentions processed per message, allowing an authenticated attacker to crash the client applications of other users via large, crafted messages.