Security
فارسی
All products

github.com/mattermost/mattermost

Go · Package
11 reports
Vulnerability alerts
Follow
ReportProductEcosystemSeverityFix statusLast updated
Mattermost GitHub Plugin Bot Identity Validation Bypass Allows Arbitrary GitHub Reaction InjectionCVE-2025-13352 · GHSA-JF5H-XFW4-P8GPVersion ranges need review. github.com/mattermost/mattermost-plugin-githubgithub.com/mattermost/mattermost-server/v5 Go Low Fix reported
Mattermost has an Invite Token Replay Vulnerability via Channel Membership ManipulationCVE-2025-13324 · GHSA-X3R8-2HMH-89F5Version ranges need review. github.com/mattermost/mattermost-server/v5github.com/mattermost/mattermost-server/v6 Go Medium Fix reported
Mattermost has missing redirect URL validationCVE-2025-62690 · GHSA-Q66G-Q98C-Q454Version ranges need review. github.com/mattermost/mattermost-server/v5github.com/mattermost/mattermost-server/v6 Go Low Fix reported
Mattermost fails to validate user permissions in BoardsCVE-2025-13870 · GHSA-58W6-W55X-6WQ8Version ranges need review. github.com/mattermost/mattermost-server/v5github.com/mattermost/mattermost-server/v6 Go Low Fix reported
Mattermost fails to validate user permissions when deleting comments in BoardsCVE-2025-12756 · GHSA-P6GJ-JC38-X2M7Version ranges need review. github.com/mattermost/mattermost-server/v5github.com/mattermost/mattermost-server/v6 Go Medium No fix reported
Mattermost fails to properly restrict access to archived channel search APICVE-2025-11776 · GHSA-J6GG-R5JC-47CMVersion ranges need review. github.com/mattermost/mattermost-server/v5github.com/mattermost/mattermost-server/v6 Go Medium Fix reported
Mattermost Incorrect Authorization vulnerabilityCVE-2025-11777 · GHSA-MQCJ-8C2G-H97QVersion ranges need review. github.com/mattermost/mattermost-server/v5github.com/mattermost/mattermost-server/v6 Go Low Fix reported
Mattermost allows remote actor to create/update/delete posts in arbitrary channelsCVE-2024-41144 · GHSA-VG67-CHM7-8M3JVersion ranges need review. github.com/mattermost/mattermost-server/v5github.com/mattermost/mattermost-server/v6 Go High Fix reported
Mattermost allows a remote actor to make an arbitrary local channel read-onlyCVE-2024-41162 · GHSA-JR9X-3X7M-4J75Version ranges need review. github.com/mattermost/mattermost-server/v5github.com/mattermost/mattermost-server/v6 Go Medium Fix reported
Mattermost Server Sensitive Data ExposureCVE-2020-14457 · GHSA-J2H2-CVWH-CR64Version ranges need review. github.com/mattermost/mattermost-server/v5github.com/mattermost/mattermost-server Go Medium Fix reported
Mattermost allows remote actor to set arbitrary RemoteId values for synced usersCVE-2024-41926 · GHSA-9FPW-C9X7-CV3JVersion ranges need review. github.com/mattermost/mattermost-server/v5github.com/mattermost/mattermost-server/v6 Go Medium Fix reported