Skip to content
Patch Next
Sign inAdd to your agent

← Public intelligence

Go package

github.com/mattermost/mattermost-plugin-calls

Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.

Open advisories

3 actionable advisories, newest first. Withdrawn advisories and news are excluded. Coverage is partial.

  1. High, CVSS 7.6GoPublished

    Mattermost doesn't sanitize sensitive configuration fields in the Mattermost Calls plugin

    CVE-2026-6347 · GHSA-82j6-4fq7-fx62

    Affected
    • Go github.com/mattermost/mattermost-plugin-calls < 1.12.0-rc2
    Fixed in
    1.12.0-rc2· Vendor fix available
    Issue
    Mattermost versions 11.5.x <= 11.5.1, 10.11.x <= 10.11.13, 11.4.x <= 11.4.3 fail to sanitize sensitive configuration fields in the Mattermost Calls plugin which allows an attacker with access to a support packet to obtain TURN server credentials via the plaintext values present in the exported plugin configuration.. Mattermost Advisory ID: MMSA-2026-00605

    Recommended action: Upgrade to 1.12.0-rc2 (pre-release) or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.

    Sources:github.comSource checked Evidence →
  2. Medium, CVSS 6.5GoPublished

    Mattermost fails to check Websocket request for proper UTF-8 format potentially crashing Calls plug-in

    CVE-2025-12689 · GHSA-j5vq-62gr-8v3r

    Affected
    • Go github.com/mattermost/mattermost-plugin-calls < 1.11.0
    Fixed in
    1.11.0· Vendor fix available
    Issue
    Mattermost versions 11.0.x <= 11.0.4, 10.12.x <= 10.12.2, 10.11.x <= 10.11.6 fail to check WebSocket request field for proper UTF-8 format, which allows attacker to crash Calls plug-in via sending malformed request.

    Recommended action: Upgrade to 1.11.0 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.

    Sources:github.comSource checked Evidence →
  3. Medium, CVSS 4.3GoPublished

    Mattermost has CSRF vulnerability via Calls Widget page

    CVE-2025-62190 · GHSA-gmx5-frv9-9m9f

    Affected
    • Go github.com/mattermost/mattermost-plugin-calls < 1.10.0
    Fixed in
    1.10.0· Vendor fix available
    Issue
    Mattermost versions 11.0.x < 11.0.4, 10.12.x <= 10.12.2, 10.11.x < 10.11.6 and Mattermost Calls versions < 1.10.0 fail to implement CSRF protection on the Calls widget page which allows an authenticated attacker to initiate calls and inject messages into channels or direct messages via a malicious webpage or crafted link.

    Recommended action: Upgrade to 1.10.0 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.

    Sources:github.comSource checked Evidence →