Mattermost

Mattermost fails to disable public Boards after the "Enable Publicly-Shared Boards" configuration option is disabled, re

Mattermost Boards fail to properly validate a board link, allowing an attacker to crash a channel by posting a specially

Mattermost fails to properly check the authorization of POST /api/v4/teams when passing a team override scheme ID in the

Mattermost fails to verify channel membership when linking a board to a channel allowing a low-privileged authenticated

Mattermost fails to properly validate the origin of a websocket connection allowing a MITM attacker on Mattermost to acc

Mattermost fails to properly restrict requests to localhost/intranet during the interactive dialog, which could allow an

Mattermost fails to unescape Markdown strings in a memory-efficient way, allowing an attacker to cause a Denial of Servi

Mattermost fails to sanitize code permalinks, allowing an attacker to preview code from private repositories by posting

Mattermost fails to validate links on external websites when constructing a preview for a linked website, allowing an at

Mattermost fails to sanitize ephemeral error messages, allowing an attacker to obtain arbitrary message contents by a sp

Mattermost fails to properly truncate the postgres error log message of a search query failure allowing an attacker to c

When creating a playbook run via the /dialog API, Mattermost fails to validate all parameters, allowing an authenticated

Mattermost fails to check if an admin user account active after an oauth2 flow is started, allowing an attacker with adm

Mattermost fails to check channel membership when accessing message threads, allowing an attacker to access arbitrary po

Mattermost fails to properly check the permissions when executing commands allowing a member with no permissions to post

Mattermost fails to verify if the requestor is a sysadmin or not, before allowing `install` requests to the Apps allowin

Mattermost Apps Framework fails to verify that a secret provided in the incoming webhook request allowing an attacker to

Mattermost fails to normalize UTF confusable characters when determining if a preview should be generated for a hyperlin

Mattermost fails to restrict a user with permissions to edit other users and to create personal access tokens from eleva

Mattermost Sever fails to redact the DB username and password before emitting an application log during server initializ

Mattermost Desktop App fails to validate a mattermost server redirection and navigates to an arbitrary website

When archiving a team, Mattermost fails to sanitize the related Websocket event sent to currently connected clients. Thi

Mattermost fails to invalidate existing authorization codes when deauthorizing an OAuth2 app, allowing an attacker posse

Mattermost fails to redact from audit logs the user password during user creation and the user password hash in other op

Mattermost allows an attacker to request a preview of an existing message when creating a new message via the createPost

Boards in Mattermost allows an attacker to upload a malicious SVG image file as an attachment to a card and share it usi

When running in a High Availability configuration, Mattermost fails to sanitize some of the user_updated and post_delete

When processing an email invite to a private channel on a team, Mattermost fails to validate the inviter's permission to

Mattermost fails to check the "Show Full Name" setting when rendering the result for the /plugins/focalboard/api/v2/user

A reflected cross-site scripting vulnerability in the OAuth flow completion endpoints in Mattermost allows an attacker t

Mattermost fails to honor the ShowEmailAddress setting when constructing a response to the /api/v4/users/me/teams API e

Mattermost fails to honor the ShowEmailAddress setting when constructing a response to the "Regenerate Invite Id" API en

A missing permissions check in Mattermost Playbooks in Mattermost allows an attacker to modify a playbook via the /plugi

A missing permissions check in the /plugins/playbooks/api/v0/runs API in Mattermost allows an attacker to list and view

A denial-of-service vulnerability in the Mattermost allows an authenticated user to crash the server via multiple reques

A denial-of-service vulnerability in Mattermost allows an authenticated user to crash the server via multiple large auto

A denial-of-service vulnerability in the Mattermost Playbooks plugin allows an authenticated user to crash the server vi

Mattermost version 7.1.x and earlier fails to sufficiently process a specifically crafted GIF file when it is uploaded w

Mattermost version 7.0.x and earlier fails to sufficiently limit the in-memory sizes of concurrently uploaded JPEG image

The Guest account feature in Mattermost version 6.7.0 and earlier fails to properly restrict the permissions, which allo

The legacy Slack import feature in Mattermost version 6.7.0 and earlier fails to properly limit the sizes of imported fi

Unrestricted information disclosure of all users in Mattermost version 6.7.0 and earlier allows team members to access s

Incorrect default configuration for trusted IP header in Mattermost version 6.7.0 and earlier allows attacker to bypass

Uncontrolled resource consumption in Mattermost version 6.6.0 and earlier allows an authenticated attacker to crash the

Mattermost Playbooks plugin 1.25 and earlier fails to properly restrict user-level permissions, which allows playbook me

Mattermost 6.4.x and earlier fails to properly invalidate pending email invitations when the action is performed from th

Mattermost version 6.4.x and earlier fails to properly check the plugin version when a plugin is installed from the Mark

The image proxy component in Mattermost version 6.4.1 and earlier allocates memory for multiple copies of a proxied imag

Mattermost Playbooks plugin v1.24.0 and earlier fails to properly check the limit on the number of webhooks, which allow

One of the API in Mattermost version 6.4.1 and earlier fails to properly protect the permissions, which allows the authe