Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.
Open advisories
171 actionable advisories, newest first. Withdrawn advisories and news are excluded. Coverage is partial.
Mattermost versions 11.7.x <= 11.7.0, 11.6.x <= 11.6.2, 11.5.x <= 11.5.5, 10.11.x <= 10.11.17 Fail to validate channel ownership of an existing subscription before applying edits which allows an authenticated attacker to hijack subscriptions from channels they have no access to via a crafted PUT request to the subscription edit endpoint.. Mattermost Advisory ID: MMSA-2026-00650
Recommended action: Upgrade to 11.7.1, 11.6.3, 11.5.6 or 10.11.18 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Mattermost versions 11.7.x <= 11.7.0, 11.6.x <= 11.6.2, 11.5.x <= 11.5.5, 10.11.x <= 10.11.17 fail to invalidate cached authentication state for active WebSocket connections during global session revocation, which allows a user with an existing WebSocket connection to remain authenticated and continue receiving real-time events until the cached session expires or the client reconnects.. Mattermost Advisory ID: MMSA-2026-00664
Recommended action: Upgrade to 11.7.1, 11.6.3, 11.5.6 or 10.11.18 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Mattermost versions 11.7.x <= 11.7.0, 11.6.x <= 11.6.2, 11.5.x <= 11.5.5, 10.11.x <= 10.11.17 fail to enforce administrator authorization on the {{setDefaultInstance}} call within the {{/gitlab connect}} command handler, which allows any authenticated user to overwrite the global default GitLab instance configuration via the {{/gitlab connect <instance-name}} slash command.. Mattermost Advisory ID: MMSA-2026-00644
Recommended action: Upgrade to 11.7.1, 11.6.3, 11.5.6 or 10.11.18 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Go github.com/mattermost/mattermost-server >= 11.7.0, < 11.7.1; >= 10.11.0, < 10.11.18
Fixed in
11.7.110.11.18· Vendor fix available
Issue
Mattermost versions 11.7.x <= 11.7.0, 10.11.x <= 10.11.17 fail to enforce bot-specific permission checks on the user active status endpoint, which allows a User Manager with user management write access but no Integrations access to deactivate bot accounts via the PUT /api/v4/users/{id}/active API endpoint.. Mattermost Advisory ID: MMSA-2026-00667
Recommended action: Upgrade to 11.7.1 or 10.11.18 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Mattermost versions 11.7.x <= 11.7.0, 11.6.x <= 11.6.2, 11.5.x <= 11.5.5, 10.11.x <= 10.11.17 fail to authenticate Atlassian Connect installed callbacks, allowing a remote unauthenticated attacker to inject a rogue sharedSecret and disrupt the Jira integration via POST to /ac/installed during the pending-install window.. Mattermost Advisory ID: MMSA-2026-00654
Recommended action: Upgrade to 11.7.1, 11.6.3, 11.5.6 or 10.11.18 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Mattermost versions 11.6.x <= 11.6.0, 11.5.x <= 11.5.3, 11.4.x <= 11.4.4, 10.11.x <= 10.11.14 fail to filter nil elements from outgoing webhook attachment payloads before processing, which allows an authenticated user to cause a denial of service (server process termination) via a crafted webhook callback response containing a null attachment entry. Mattermost Advisory ID: MMSA-2026-00641
Recommended action: Upgrade to 11.6.1, 11.5.4, 11.4.5 or 10.11.15 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Mattermost versions 11.6.x <= 11.6.0, 11.5.x <= 11.5.3, 11.4.x <= 11.4.4, 10.11.x <= 10.11.14 fail to validate the OAuth token scope on the callback which allows an authenticated Mattermost user to gain access to private repositories via modifying the scope parameter in the GitHub authorization URL. Mattermost Advisory ID: MMSA-2026-00628
Recommended action: Upgrade to 11.6.1, 11.5.4, 11.4.5 or 10.11.15 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Mattermost versions 11.6.x <= 11.6.0, 11.5.x <= 11.5.3, 11.4.x <= 11.4.4, 10.11.x <= 10.11.14 fail to sanitize team member data when returned via API to users without elevated permissions which allows a user without permissions to get data about team members roles via invoking various team API endpoints. Mattermost Advisory ID: MMSA-2026-00626.
Recommended action: Upgrade to 11.6.1, 11.5.4, 11.4.5 or 10.11.15 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Mattermost versions 11.6.x <= 11.6.0, 11.5.x <= 11.5.3, 11.4.x <= 11.4.4, 10.11.x <= 10.11.14 fail to validate file ownership and access control, which allows an authenticated user to access and download files belonging to other users or teams via crafted Boards API requests using valid file IDs. Mattermost Advisory ID: MMSA-2026-00620.
Recommended action: Upgrade to 11.6.1, 11.5.4, 11.4.5 or 10.11.15 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Mattermost versions 11.6.x <= 11.6.0, 11.5.x <= 11.5.2, 11.5.x <= 11.5.3, 11.4.x <= 11.4.4, 10.11.x <= 10.11.14 fail to validate the TIFF IFD offset in the image header before allocating memory, which allows authenticated users with file upload or posting permissions to cause a denial of service (server OOM) via uploading a crafted TIFF file or posting a URL that serves one.. Mattermost Advisory ID: MMSA-2026-00648
Recommended action: Upgrade to 11.6.1, 11.5.4, 11.4.5 or 10.11.15 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Mattermost versions 11.6.x <= 11.6.0, 11.5.x <= 11.5.3, 11.4.x <= 11.4.4, 10.11.x <= 10.11.14 fail to properly validate msgpack-encoded WebSocket frames before memory allocation which allows an unauthenticated remote attacker to crash the server process and cause a full service outage for all users via a crafted binary WebSocket message sent to the public WebSocket endpoint.. Mattermost Advisory ID: MMSA-2026-00647
Recommended action: Upgrade to 11.6.1, 11.5.4, 11.4.5 or 10.11.15 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Mattermost versions 11.6.x <= 11.6.0, 11.5.x <= 11.5.3, 11.4.x <= 11.4.4, 10.11.x <= 10.11.14 fail to validate user-supplied input in API request handlers which allows an authenticated attacker to crash the plugin process via a crafted HTTP request to the PR details endpoint. Mattermost Advisory ID: MMSA-2026-00638
Recommended action: Upgrade to 11.6.1, 11.5.4, 11.4.5 or 10.11.15 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Mattermost versions 11.6.x <= 11.6.0, 11.5.x <= 11.5.3, 11.4.x <= 11.4.4, 10.11.x <= 10.11.14 fail to archive the channel before removing persistent notifications which allows authenticated user to crash the server via timing the creation of persistent notification message between the server deleting existing persistent notifications and archiving the channel. Mattermost Advisory ID: MMSA-2026-00637.
Recommended action: Upgrade to 11.6.1, 11.5.4, 11.4.5 or 10.11.15 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Mattermost versions 11.6.x <= 11.6.0, 11.5.x <= 11.5.3, 11.4.x <= 11.4.4, 10.11.x <= 10.11.14 fail to enforce request body size limits on plugin HTTP endpoints which allows an attacker to cause a denial of service via crafted oversized HTTP requests.. Mattermost Advisory ID: MMSA-2026-00646
Recommended action: Upgrade to 11.6.1, 11.5.4, 11.4.5 or 10.11.15 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Mattermost versions 11.6.x <= 11.6.0, 11.5.x <= 11.5.3, 11.4.x <= 11.4.4, 10.11.x <= 10.11.14 fail to check integration URL for path traversal which allows an malicious authenticated user to call an arbitrary API via system admin Mattermost auth token using via path traversal in integration action URL. Mattermost Advisory ID: MMSA-2026-00640.
Recommended action: Upgrade to 11.6.1, 11.5.4, 11.4.5 or 10.11.15 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Go github.com/mattermost/mattermost-server < 5.3.2-0.20260326202606-fac92f4a71f3
Fixed in
5.3.2-0.20260326202606-fac92f4a71f3· Vendor fix available
Issue
Mattermost versions 11.5.x <= 11.5.1, 10.11.x <= 10.11.13, 11.4.x <= 11.4.3 fail to sanitize sensitive configuration fields before including them in support packet generation, which allows a Mattermost System Admin or any party with access to a support packet to obtain sensitive credentials in plaintext via downloading a support packet from the System Console.. Mattermost Advisory ID: MMSA-2026-00607
Recommended action: Upgrade to 5.3.2-0.20260326202606-fac92f4a71f3 (pre-release) or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Go github.com/mattermost/mattermost-server < 5.3.2-0.20260325160634-e738016c5920
Fixed in
5.3.2-0.20260325160634-e738016c5920· Vendor fix available
Issue
Mattermost versions 11.5.x <= 11.5.1, 10.11.x <= 10.11.13 fail to validate the Host header when constructing response URLs for custom slash commands which allows an authenticated attacker to redirect slash command responses to an attacker-controlled server via a spoofed Host header.. Mattermost Advisory ID: MMSA-2026-00582
Recommended action: Upgrade to 5.3.2-0.20260325160634-e738016c5920 (pre-release) or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Go github.com/mattermost/mattermost-server < 5.3.2-0.20260401090745-f4d1abe7e8f5
Fixed in
5.3.2-0.20260401090745-f4d1abe7e8f5· Vendor fix available
Issue
Mattermost versions 11.5.x <= 11.5.1 fail to verify channel membership when processing AI-assisted message rewrites which allows an authenticated attacker to read the content of threads in private channels and direct messages they do not have access to via a crafted request to the post rewrite endpoint.. Mattermost Advisory ID: MMSA-2026-00645
Recommended action: Upgrade to 5.3.2-0.20260401090745-f4d1abe7e8f5 (pre-release) or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Go github.com/mattermost/mattermost-server < 5.3.2-0.20260311102650-3057ae7e83e9
Fixed in
5.3.2-0.20260311102650-3057ae7e83e9· Vendor fix available
Issue
Mattermost versions 11.5.x <= 11.5.1, 10.11.x <= 10.11.13, 11.4.x <= 11.4.3 doesn't prevent disclosure of created user password which allows a malicious attacker to impersonate a user via the use of some of those passwords.. Mattermost Advisory ID: MMSA-2026-00614
Recommended action: Upgrade to 5.3.2-0.20260311102650-3057ae7e83e9 (pre-release) or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Go github.com/mattermost/mattermost-server < 5.3.2-0.20260327001745-7a339a6438f5
Fixed in
5.3.2-0.20260327001745-7a339a6438f5· Vendor fix available
Issue
Mattermost versions 11.5.x <= 11.5.1, 11.4.x <= 11.4.3 fail to validate the X-Requested-With header on the burn-on-read reveal endpoint which allows an authenticated channel member to force the reveal of a burn-on-read message without recipient consent via a crafted Markdown image tag.. Mattermost Advisory ID: MMSA-2026-00636
Recommended action: Upgrade to 5.3.2-0.20260327001745-7a339a6438f5 (pre-release) or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Mattermost versions 11.5.x <= 11.5.1, 10.11.x <= 10.11.13, 11.4.x <= 11.4.3 fail to sanitize sensitive configuration fields in the Mattermost Calls plugin which allows an attacker with access to a support packet to obtain TURN server credentials via the plaintext values present in the exported plugin configuration.. Mattermost Advisory ID: MMSA-2026-00605
Recommended action: Upgrade to 11.5.2, 11.4.4 or 10.11.14 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Go github.com/mattermost/mattermost-server < 5.3.2-0.20260306123948-f5fe8ded6b63
Fixed in
5.3.2-0.20260306123948-f5fe8ded6b63· Vendor fix available
Issue
Mattermost versions 11.5.x <= 11.5.1, 10.11.x <= 10.11.13, 11.4.x <= 11.4.3 Fail to enforce slash command trigger-word uniqueness during command updates which allows an authenticated team member with Manage Own Slash Commands permission to hijack and impersonate existing system or custom slash commands via editing their own slash command trigger to an already-registered trigger through the command update API. Mattermost Advisory ID: MMSA-2026-00597
Recommended action: Upgrade to 5.3.2-0.20260306123948-f5fe8ded6b63 (pre-release) or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Mattermost versions 11.5.x <= 11.5.1, 10.11.x <= 10.11.13, 11.4.x <= 11.4.3 fail to limit the size of the request body on the start meeting API endpoint, which allows an authenticated attacker to cause resource exhaustion or denial of service via a crafted oversized HTTP POST request to {{/api/v1/meetings}}.. Mattermost Advisory ID: MMSA-2026-00608
Recommended action: Upgrade to 11.5.2, 11.4.4 or 10.11.14 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Go github.com/mattermost/mattermost-server < 5.3.2-0.20260313190740-742e0be95074
Fixed in
5.3.2-0.20260313190740-742e0be95074· Vendor fix available
Issue
Mattermost versions 11.5.x <= 11.5.1, 10.11.x <= 10.11.13 fail to validate that the RefreshedToken differs from the original invite token during remote cluster invite confirmation which allows an authenticated attacker to bypass token rotation and reuse the original invite token via sending a crafted invite confirmation with a RefreshedToken matching the original token. Mattermost Advisory ID: MMSA-2026-00575
Recommended action: Upgrade to 5.3.2-0.20260313190740-742e0be95074 (pre-release) or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Go github.com/mattermost/mattermost-server < 5.3.2-0.20260216150504-8738f8c4b3d4
Fixed in
5.3.2-0.20260216150504-8738f8c4b3d4· Vendor fix available
Issue
Mattermost versions 11.5.x <= 11.5.1, 10.11.x <= 10.11.13, 11.4.x <= 11.4.3 fail to validate that a remote cluster has access to a channel before processing membership removal requests during shared channel membership sync, which allows a malicious remote cluster to remove any user from any channel, including private channels, via crafted membership sync messages targeting channels the remote cluster is not authorized to access. Mattermost Advisory ID: MMSA-2026-00576.
Recommended action: Upgrade to 5.3.2-0.20260216150504-8738f8c4b3d4 (pre-release) or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.