Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.
Open advisories
4 actionable advisories, newest first. Withdrawn advisories and news are excluded. Coverage is partial.
Go github.com/mattermost/mattermost-plugin-msteams < 1.15.1-0.20260213190728-6fe4d295592e
Fixed in
1.15.1-0.20260213190728-6fe4d295592e· Vendor fix available
Issue
Mattermost Plugins versions <=2.3.1 fail to limit the request body size on the {{/lifecycle}} webhook endpoint which allows an authenticated attacker to cause memory exhaustion and denial of service via sending an oversized JSON payload. Mattermost Advisory ID: MMSA-2026-00610.
Recommended action: Upgrade to 1.15.1-0.20260213190728-6fe4d295592e (pre-release) or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Go github.com/mattermost/mattermost-plugin-msteams < 1.15.1-0.20260213190728-6fe4d295592e
Fixed in
1.15.1-0.20260213190728-6fe4d295592e· Vendor fix available
Issue
Mattermost Plugins versions <=2.1.3.0 fail to limit the request body size on the {{/changes}} webhook endpoint which allows an authenticated attacker to cause memory exhaustion and denial of service via sending an oversized JSON payload. Mattermost Advisory ID: MMSA-2026-00611.
Recommended action: Upgrade to 1.15.1-0.20260213190728-6fe4d295592e (pre-release) or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Go github.com/mattermost/mattermost-plugin-msteams < 1.15.1-0.20260102165339-036c761bd3cb
Fixed in
1.15.1-0.20260102165339-036c761bd3cb· Vendor fix available
Issue
Mattermost Plugins versions <=2.0.3.0 fail to properly mask sensitive configuration values which allows an attacker with access to support packets to obtain original plugin settings via exported configuration data. Mattermost Advisory ID: MMSA-2026-00606
Recommended action: Upgrade to 1.15.1-0.20260102165339-036c761bd3cb (pre-release) or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Go github.com/mattermost/mattermost-plugin-msteams <= 1.15.0
Fixed in
2.1.0· Vendor fix available
Issue
Mattermost Plugin MSTeams versions <2.1.0 and Mattermost Server versions 10.5.x <=10.5.1 with the MS Teams plugin enabled fail to perform constant time comparison on a MSTeams plugin webhook secret which allows an attacker to retrieve the webhook secret of the MSTeams plugin via a timing attack during webhook secret comparison.
Recommended action: Upgrade to 2.1.0 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.