Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.
Open advisories
171 actionable advisories, newest first. Withdrawn advisories and news are excluded. Coverage is partial.
Go github.com/mattermost/mattermost-server < 5.3.2-0.20260316171743-090408f09f53
Fixed in
5.3.2-0.20260316171743-090408f09f53· Vendor fix available
Issue
Mattermost versions 11.5.x <= 11.5.1, 10.11.x <= 10.11.13, 11.4.x <= 11.4.3 fail to check the createpost channel permission during post edit operations which allows an authenticated attacker with revoked posting privileges to modify their existing posts via direct API requests to the post update and patch endpoints.. Mattermost Advisory ID: MMSA-2026-00627
Recommended action: Upgrade to 5.3.2-0.20260316171743-090408f09f53 (pre-release) or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Go github.com/mattermost/mattermost-server < 5.3.2-0.20260310115442-5a1ea95044dc
Fixed in
5.3.2-0.20260310115442-5a1ea95044dc· Vendor fix available
Issue
Mattermost versions 11.5.x <= 11.5.1, 10.11.x <= 10.11.13 fail to escape some variables that could contain malicious content during error page composition which allows an attacker with access to edit some site configuration to execute some malicious code via injecting some JS as part of those values.. Mattermost Advisory ID: MMSA-2026-00622
Recommended action: Upgrade to 5.3.2-0.20260310115442-5a1ea95044dc (pre-release) or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Go github.com/mattermost/mattermost-server < 5.3.2-0.20260325191733-fb11968f8798
Fixed in
5.3.2-0.20260325191733-fb11968f8798· Vendor fix available
Issue
Mattermost versions 11.5.x <= 11.5.1, 10.11.x <= 10.11.13, 11.4.x <= 11.4.3 fail to validate 7zip archive structure before processing which allows an authenticated attacker to cause server memory exhaustion and denial of service via uploading a specially crafted 7zip file with excessive folder declarations.. Mattermost Advisory ID: MMSA-2026-00573
Recommended action: Upgrade to 5.3.2-0.20260325191733-fb11968f8798 (pre-release) or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Go github.com/mattermost/mattermost-server < 5.3.2-0.20260318173148-e9ae890a013b
Fixed in
5.3.2-0.20260318173148-e9ae890a013b· Vendor fix available
Issue
Mattermost versions 11.5.x <= 11.5.1, 10.11.x <= 10.11.13 fail to enforce client identity binding during the OAuth authorization code redemption flow which allows an authenticated OAuth client to redeem authorization codes issued to a different client via a crafted token exchange request.. Mattermost Advisory ID: MMSA-2026-00570
Recommended action: Upgrade to 5.3.2-0.20260318173148-e9ae890a013b (pre-release) or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Go github.com/mattermost/mattermost-server >= 11.5.0, < 11.5.2; >= 0.0.0-20250731163400-5b955468ea1e, < 0.0.0-20260414103857-b21ef302025e
Fixed in
0.0.0-20260414103857-b21ef302025e11.5.2· Vendor fix available
Issue
Mattermost versions 11.5.x <= 11.5.1, 10.11.x <= 10.11.13 fail to enforce the PostEditTimeLimit on non-message post fields which allows an authenticated user to modify post file attachments, props, and pin status after the edit window has expired via the post patch and update API endpoints. Mattermost Advisory ID: MMSA-2026-00631.
Recommended action: Upgrade to 11.5.2 or 0.0.0-20260414103857-b21ef302025e (pre-release) by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
0.0.0-20260414103857-b21ef302025e11.4.411.5.2· Vendor fix available
Issue
Mattermost versions 11.5.x <= 11.5.1, 10.11.x <= 10.11.13, 11.4.x <= 11.4.3 fail to validate the response body of proxied images, which allows a remote attacker to enact client-side DoS via an SVG file served from an attacker-controlled origin under a non-SVG Content-Type header (e.g. image/png) embedded in an og:image meta tag or Markdown image link. Mattermost Advisory ID: MMSA-2026-00630.
Recommended action: Upgrade to 11.5.2, 11.4.4 or 0.0.0-20260414103857-b21ef302025e (pre-release) by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Mattermost versions 10.11.x <= 10.11.12, 11.5.x <= 11.5.0, 11.4.x <= 11.4.2, 11.3.x <= 11.3.2 fail to enforce atomic single-use consumption of guest magic link tokens, which allows an attacker with access to a valid magic link to establish multiple independent authenticated sessions via concurrent requests. Mattermost Advisory ID: MMSA-2026-00624.
Recommended action: Upgrade to 11.5.0, 11.4.3, 11.3.3 or 10.11.13 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Go github.com/mattermost/mattermost-server >= 8.0.0-20250721062209-4952acea88ce, < 8.0.0-20260316060126-bc1a2b34b1f9
Fixed in
8.0.0-20260316060126-bc1a2b34b1f9· Vendor fix available
Issue
Mattermost versions 10.11.x <= 10.11.12 fail to validate whether users were correctly owned by the correct Connected Workspace which allows a malicious remote server connected using the Conntexted Workspaces feature to change the displayed status of local users via the Connected Workspaces API. Mattermost Advisory ID: MMSA-2026-00603.
Recommended action: Upgrade to 8.0.0-20260316060126-bc1a2b34b1f9 (pre-release) or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
8.0.0-20260217110922-b7d4a1f1f59b11.4.111.3.211.2.410.11.12· Vendor fix available
Issue
Mattermost versions 11.4.x <= 11.4.0, 11.3.x <= 11.3.1, 11.2.x <= 11.2.3, 10.11.x <= 10.11.11 fail to set permissions on downloaded bulk export which allows other local users on the server to be able to read contents of the bulk export. Mattermost Advisory ID: MMSA-2026-00593.
Recommended action: Upgrade to 11.4.1, 11.3.2, 11.2.4 or 2 more by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Mattermost versions 11.4.x <= 11.4.0, 11.3.x <= 11.3.1, 11.2.x <= 11.2.3, 10.11.x <= 10.11.11 fail to rate limit login requests which allows unauthenticated remote attackers to cause denial of service (server crash and restart) via HTTP/2 single packet attack with 100+ parallel login requests.. Mattermost Advisory ID: MMSA-2025-00566
Recommended action: Upgrade to 11.4.1, 11.3.2, 11.2.4 or 10.11.12 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
11.3.15.3.2-0.20260127144908-ced9a56e398810.11.1111.2.3· Vendor fix available
Issue
Mattermost versions 10.11.x <= 10.11.10 fail to validate user's authentication method when processing account auth type switch which allows an authenticated attacker to change account password without confirmation via falsely claiming a different auth provider.. Mattermost Advisory ID: MMSA-2026-00583
Recommended action: Upgrade to 11.3.1, 11.2.3, 10.11.11 or 5.3.2-0.20260127144908-ced9a56e3988 (pre-release) by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
11.3.110.11.1111.2.35.3.2-0.20260129133647-5d787969c2d5· Vendor fix available
Issue
Mattermost versions 11.3.x <= 11.3.0, 11.2.x <= 11.2.2, 10.11.x <= 10.11.10 fail to canonicalize IPv4-mapped IPv6 addresses before reserved IP validation which allows an attacker to perform SSRF attacks against internal services via IPv4-mapped IPv6 literals (e.g., [::ffff:127.0.0.1]).. Mattermost Advisory ID: MMSA-2026-00585
Recommended action: Upgrade to 11.3.1, 11.2.3, 10.11.11 or 5.3.2-0.20260129133647-5d787969c2d5 (pre-release) by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
11.3.15.3.2-0.20260107142155-0481bd1fb04510.11.1111.2.3· Vendor fix available
Issue
Mattermost versions 11.3.x <= 11.3.0, 11.2.x <= 11.2.2, 10.11.x <= 10.11.10 fail to properly enforce read permissions in search API endpoints which allows guest users without read permissions to access posts and files in channels via search API requests. Mattermost Advisory ID: MMSA-2025-00554
Recommended action: Upgrade to 11.3.1, 11.2.3, 10.11.11 or 5.3.2-0.20260107142155-0481bd1fb045 (pre-release) by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
11.3.110.11.115.3.2-0.20260107144005-c7f6efdfb03511.2.3· Vendor fix available
Issue
Mattermost versions 11.3.x <= 11.3.0, 11.2.x <= 11.2.2, 10.11.x <= 10.11.10 fail to validate team-specific uploadfile permissions which allows a guest user to post files in channels where they lack uploadfile permission via uploading files in a team where they have permission and reusing the file metadata in a POST request to a different team. Mattermost Advisory ID: MMSA-2025-00553
Recommended action: Upgrade to 11.3.1, 11.2.3, 10.11.11 or 5.3.2-0.20260107144005-c7f6efdfb035 (pre-release) by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
11.3.15.3.2-0.20260130144323-5bb5261c72fa10.11.1111.2.3· Vendor fix available
Issue
Mattermost versions 11.3.x <= 11.3.0, 11.2.x <= 11.2.2, 10.11.x <= 10.11.10 fail to use consistent error responses when handling the /mute command which allows an authenticated team member to enumerate private channels they are not authorized to know about via differing error messages for nonexistent versus private channels. Mattermost Advisory ID: MMSA-2026-00588
Recommended action: Upgrade to 11.3.1, 11.2.3, 10.11.11 or 5.3.2-0.20260130144323-5bb5261c72fa (pre-release) by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
11.3.110.11.1111.2.35.3.2-0.20260127062706-c6b205f0d770· Vendor fix available
Issue
Mattermost versions 11.3.x <= 11.3.0 fail to preserve the redacted state of burn-on-read posts during deletion which allows channel members to access unrevealed burn-on-read message contents via the WebSocket post deletion event. Mattermost Advisory ID: MMSA-2026-00579
Recommended action: Upgrade to 11.3.1, 11.2.3, 10.11.11 or 5.3.2-0.20260127062706-c6b205f0d770 (pre-release) by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
11.3.15.3.2-0.20260127165411-fe3052073dc610.11.1111.2.3· Vendor fix available
Issue
Mattermost versions 11.3.x <= 11.3.0, 11.2.x <= 11.2.2, 10.11.x <= 10.11.10 Mattermost fails to limit the size of responses from integration action endpoints, which allows an authenticated attacker to cause server memory exhaustion and denial of service via a malicious integration server that returns an arbitrarily large response when a user clicks an interactive message button. Mattermost Advisory ID: MMSA-2026-00571
Recommended action: Upgrade to 11.3.1, 11.2.3, 10.11.11 or 5.3.2-0.20260127165411-fe3052073dc6 (pre-release) by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
5.3.2-0.20260105134819-cc427af41b2a11.3.110.11.1111.2.3· Vendor fix available
Issue
Mattermost versions 11.3.x <= 11.3.0, 11.2.x <= 11.2.2, 10.11.x <= 10.11.10 fail to filter invite IDs based on user permissions, which allows regular users to bypass access control restrictions and register unauthorized accounts via leaked invite IDs during team creation. Mattermost Advisory ID: MMSA-2025-00565
Recommended action: Upgrade to 11.3.1, 11.2.3, 10.11.11 or 5.3.2-0.20260105134819-cc427af41b2a (pre-release) by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
11.3.110.11.1111.2.35.3.2-0.20260113182106-a18b80ba4c32· Vendor fix available
Issue
Mattermost versions 11.3.x <= 11.3.0, 11.2.x <= 11.2.2, 10.11.x <= 10.11.10 fail to properly validate team membership when searching channels which allows a removed team member to enumerate all public channels within a private team via the channel search API endpoint. Mattermost Advisory ID: MMSA-2025-00568
Recommended action: Upgrade to 11.3.1, 11.2.3, 10.11.11 or 5.3.2-0.20260113182106-a18b80ba4c32 (pre-release) by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
11.3.15.3.2-0.20260123211116-9efe617be8b810.11.1111.2.3· Vendor fix available
Issue
Mattermost versions 11.3.x <= 11.3.0, 11.2.x <= 11.2.2, 10.11.x <= 10.11.10 fail to sanitize client-supplied post metadata which allows an authenticated attacker to spoof permalink embeds impersonating other users via crafted PUT requests to the post update API endpoint. Mattermost Advisory ID: MMSA-2025-00569
Recommended action: Upgrade to 11.3.1, 11.2.3, 10.11.11 or 5.3.2-0.20260123211116-9efe617be8b8 (pre-release) by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
11.3.15.3.2-0.20260115183946-38b413a2760410.11.1111.2.3· Vendor fix available
Issue
Mattermost versions 11.3.x <= 11.3.0, 11.2.x <= 11.2.2, 10.11.x <= 10.11.10 fail to bound memory allocation when processing PSD image files which allows an authenticated attacker to cause server memory exhaustion and denial of service via uploading a specially crafted PSD file. Mattermost Advisory ID: MMSA-2026-00572
Recommended action: Upgrade to 11.3.1, 11.2.3, 10.11.11 or 5.3.2-0.20260115183946-38b413a27604 (pre-release) by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
11.3.110.11.115.3.2-0.20260123215601-86797c508c4411.2.3· Vendor fix available
Issue
Mattermost versions 11.3.x <= 11.3.0, 11.2.x <= 11.2.2, 10.11.x <= 10.11.10 fail to bound memory allocation when processing DOC files which allows an authenticated attacker to cause server memory exhaustion and denial of service via uploading a specially crafted DOC file.. Mattermost Advisory ID: MMSA-2026-00581
Recommended action: Upgrade to 11.3.1, 11.2.3, 10.11.11 or 5.3.2-0.20260123215601-86797c508c44 (pre-release) by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
11.3.110.11.115.3.2-0.20260129181235-1346cf529aef11.2.3· Vendor fix available
Issue
Mattermost versions 11.3.x <= 11.3.0, 11.2.x <= 11.2.2, 10.11.x <= 10.11.10 fail to properly validate User-Agent header tokens which allows an authenticated attacker to cause a request panic via a specially crafted User-Agent header. Mattermost Advisory ID: MMSA-2026-00586
Recommended action: Upgrade to 11.3.1, 11.2.3, 10.11.11 or 5.3.2-0.20260129181235-1346cf529aef (pre-release) by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
11.3.110.11.1111.2.35.3.2-0.20260129164748-7201f42d955f· Vendor fix available
Issue
Mattermost versions 11.3.x <= 11.3.0, 11.2.x <= 11.2.2, 10.11.x <= 10.11.10 fail to properly handle very long passwords, which allows an attacker to overload the server CPU and memory via executing login attempts with multi-megabyte passwords. Mattermost Advisory ID: MMSA-2026-00587
Recommended action: Upgrade to 11.3.1, 11.2.3, 10.11.11 or 5.3.2-0.20260129164748-7201f42d955f (pre-release) by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Mattermost versions 11.1.x <= 11.1.2, 10.11.x <= 10.11.9, 11.2.x <= 11.2.1 fail to validate user permissions when creating Jira issues from Mattermost posts, which allows an authenticated attacker with access to the Jira plugin to read post content and attachments from channels they do not have access to via the /create-issue API endpoint by providing the post ID of an inaccessible post.. Mattermost Advisory ID: MMSA-2025-00550
Recommended action: Upgrade to 11.2.2, 11.1.3 or 10.11.10 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.