Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.
Open advisories
11 actionable advisories, newest first. Withdrawn advisories and news are excluded. Coverage is partial.
Go github.com/mattermost/mattermost-server/v5 < 5.3.2-0.20250815165020-c8d66301415d
Fixed in
5.3.2-0.20250815165020-c8d66301415d· Vendor fix available
Issue
Mattermost versions < 11 fail to properly restrict access to archived channel search API which allows guest users to discover archived public channels via the /api/v4/teams/{teamid}/channels/searcharchived endpoint
Recommended action: Upgrade to 5.3.2-0.20250815165020-c8d66301415d (pre-release) or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Go github.com/mattermost/mattermost-server/v5 < 5.3.2-0.20250905150616-ba86dfc5876b
Fixed in
5.3.2-0.20250905150616-ba86dfc5876b· Vendor fix available
Issue
Mattermost versions 10.11.x <= 10.11.3, 10.5.x <= 10.5.11 fail to properly validate team membership permissions in the Add Channel Member API, which allows users from one team to access user metadata and channel membership information from other teams via the API endpoint.
Recommended action: Upgrade to 5.3.2-0.20250905150616-ba86dfc5876b (pre-release) or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Go github.com/mattermost/mattermost-server/v5 < 5.3.2-0.20240626164322-c758cecaf30c
Fixed in
5.3.2-0.20240626164322-c758cecaf30c· Vendor fix available
Issue
Mattermost versions 9.9.x <= 9.9.0, 9.5.x <= 9.5.6 fail to properly restrict channel creation which allows a malicious remote to create arbitrary channels, when shared channels were enabled.
Recommended action: Upgrade to 5.3.2-0.20240626164322-c758cecaf30c (pre-release) or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Go github.com/mattermost/mattermost-server/v5 < 0.0.0-20240209181221-674f549daf0e
Fixed in
0.0.0-20240209181221-674f549daf0e· Vendor fix available
Issue
Resource Exhaustion in Mattermost Server versions 8.1.x before 8.1.10 fails to limit the size of the payload that can be read and parsed allowing an attacker to send a very large email payload and crash the server.
Recommended action: Upgrade to 0.0.0-20240209181221-674f549daf0e (pre-release) or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Go github.com/mattermost/mattermost-server/v5 < 5.3.2-0.20230825233148-f787fd63368a
Fixed in
5.3.2-0.20230825233148-f787fd63368a· Vendor fix available
Issue
Mattermost fails to properly sanitize the user object when updating the username, resulting in the password hash being included in the response body.
Recommended action: Upgrade to 5.3.2-0.20230825233148-f787fd63368a (pre-release) or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Go github.com/mattermost/mattermost-server/v5 >= 5.0.0, <= 5.39.3
Fixed in
7.1.6· Vendor fix available
Issue
When running in a High Availability configuration, Mattermost fails to sanitize some of the userupdated and postdeleted events broadcast to all users, leading to disclosure of sensitive information to some of the users with currently connected Websocket clients. Issue Identifier: MMSA-2023-00138
Recommended action: Upgrade to 7.1.6 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Go github.com/mattermost/mattermost-server/v5 >= 5.0.0, <= 5.39.3
Fixed in
7.1.6· Vendor fix available
Issue
Boards in Mattermost allows an attacker to upload a malicious SVG image file as an attachment to a card and share it using a direct link to the file. Issue Identifier: MMSA-2023-00139
Recommended action: Upgrade to 7.1.6 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Go github.com/mattermost/mattermost-server/v5 >= 5.0.0, <= 5.39.3
Fixed in
7.1.6· Vendor fix available
Issue
When processing an email invite to a private channel on a team, Mattermost fails to validate the inviter's permission to that channel, allowing an attacker to invite themselves to a private channel. Issue Identifier: MMSA-2023-00137
Recommended action: Upgrade to 7.1.6 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Go github.com/mattermost/mattermost-server/v5 < 5.20.0
Fixed in
5.20.0· Vendor fix available
Issue
An issue was discovered in Mattermost Server before 5.20.0. Non-members can receive broadcasted team details via the updateteam WebSocket event, aka MMSA-2020-0012.
Recommended action: Upgrade to 5.20.0 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Go github.com/mattermost/mattermost-server/v5 < 5.37.9
Fixed in
5.37.9· Vendor fix available
Issue
One of the API in Mattermost version 6.4.1 and earlier fails to properly protect the permissions, which allows the authenticated members with restricted custom admin role to bypass the restrictions and view the server logs and server config.json file contents. Per the Mattermost security updates page, versions 6.4.2, 6.3.5, 6.2.5, and 5.37.9 contain patches for this issue
Recommended action: Upgrade to 5.37.9 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Go github.com/mattermost/mattermost-server/v5 < 5.39.0
Fixed in
5.39.0· Vendor fix available
Issue
Mattermost 5.38 and earlier fails to sufficiently sanitize clipboard contents, which allows a user-assisted attacker to inject arbitrary web script in product deployments that explicitly disable the default CSP.
Recommended action: Upgrade to 5.39.0 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.