Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.
Open advisories
171 actionable advisories, newest first. Withdrawn advisories and news are excluded. Coverage is partial.
Go github.com/mattermost/mattermost-server >= 10.11.0, <= 10.11.9
Fixed in
10.11.10· Vendor fix available
Issue
Mattermost versions 10.11.x <= 10.11.9 fail to properly validate channel membership at the time of data retrieval which allows a deactivated user to learn team names they should not have access to via a race condition in the /commonteams API endpoint.. Mattermost Advisory ID: MMSA-2025-00549
Recommended action: Upgrade to 10.11.10 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Mattermost versions 10.11.x <= 10.11.8, 11.1.x <= 11.1.1, 11.0.x <= 11.0.6 fail to prevent infinite re-renders on API errors which allows authenticated users to cause application-level DoS via triggering unbounded component re-render loops.
Recommended action: Upgrade to 11.1.2, 11.0.7 or 10.11.9 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Go github.com/mattermost/mattermost-server >= 10.11.0, <= 10.11.8; >= 11.0.0, < 11.2.0
Fixed in
10.11.911.2.0· Vendor fix available
Issue
Mattermost versions 10.11.x <= 10.11.8 fail to validate input size before processing hashtags which allows an authenticated attacker to exhaust CPU resources via a single HTTP request containing a post with thousands space-separated tokens.
Recommended action: Upgrade to 11.2.0 or 10.11.9 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Mattermost versions 11.1.x <= 11.1.0, 11.0.x <= 11.0.5, 10.12.x <= 10.12.3, 10.11.x <= 10.11.7 fail to verify that post actions invoking /share-issue-publicly were created by the Jira plugin which allowed a malicious Mattermost user to exfiltrate Jira tickets when victim users interacted with affected posts
Recommended action: Upgrade to 11.1.1, 11.0.6, 10.12.4 or 10.11.8 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Mattermost versions 11.1.x <= 11.1.0, 11.0.x <= 11.0.5, 10.12.x <= 10.12.3, 10.11.x <= 10.11.7 fails to validate user channel membership when attaching Mattermost posts as comments to Jira issues, which allows an authenticated attacker with access to the Jira plugin to read post content and attachments from channels they do not have access to.
Recommended action: Upgrade to 11.1.1, 11.0.6, 10.12.4 or 10.11.8 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Mattermost versions 11.0.x <= 11.0.2, 10.12.x <= 10.12.1, 10.11.x <= 10.11.4, 10.5.x <= 10.5.12 fail to to verify that the token used during the code exchange originates from the same authentication flow, which allows an authenticated user to perform account takeover via a specially crafted email address used when switching authentication methods and sending a request to the /users/login/sso/code-exchange endpoint. The vulnerability requires ExperimentalEnableAuthenticationTransfer to be enabled (default: enabled) and RequireEmailVerification to be disabled (default: disabled).
Recommended action: Upgrade to 11.0.3, 10.12.2, 10.11.5 or 10.5.13 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Mattermost versions 11.0.x <= 11.0.2, 10.12.x <= 10.12.1, 10.11.x <= 10.11.4, 10.5.x <= 10.5.12 fail to sanitize team email addresses to be visible only to Team Admins, which allows any authenticated user to view team email addresses via the GET /api/v4/channels/{channelid}/commonteams endpoint
Recommended action: Upgrade to 11.0.3, 10.12.2, 10.11.5 or 10.5.13 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Mattermost versions 10.12.x <= 10.12.1, 10.11.x <= 10.11.4, 10.5.x <= 10.5.12, 11.0.x <= 11.0.3 fail to properly validate OAuth state tokens during OpenID Connect authentication which allows an authenticated attacker with team creation privileges to take over a user account via manipulation of authentication data during the OAuth completion flow. This requires email verification to be disabled (default: disabled), OAuth/OpenID Connect to be enabled, and the attacker to control two users in the SSO system with one of them never having logged into Mattermost.
Recommended action: Upgrade to 11.0.4, 10.12.2, 10.11.5 or 10.5.13 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Go github.com/mattermost/mattermost-server >= 10.11.0, < 10.11.4; >= 10.5.0, < 10.5.12
Fixed in
10.11.410.5.12· Vendor fix available
Issue
Mattermost versions 10.11.x <= 10.11.3, and 10.5.x <= 10.5.11 fail to enforce access permissions on the Agents plugin which allows other users to determine when users had read channels via channel member objects.
Recommended action: Upgrade to 10.11.4 or 10.5.12 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Mattermost versions 10.11.x <= 10.11.3, 10.5.x <= 10.5.11, 10.12.x <= 10.12.0 fail to sanitize user data which allows system administrators to access password hashes and MFA secrets via the POST /api/v4/users/{userid}/email/verify/member endpoint
Recommended action: Upgrade to 10.12.1, 10.11.4 or 10.5.12 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Mattermost versions 10.11.x <= 10.11.3, 10.5.x <= 10.5.11, 10.12.x <= 10.12.0 fail to validate the relationship between the post being updated and the MSTeams plugin OAuth flow which allows an attacker to edit arbitrary posts via a crafted MSTeams plugin OAuth redirect URL.
Recommended action: Upgrade to 10.12.1, 10.11.4 or 10.5.12 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Go github.com/mattermost/mattermost-server < 11.0.0-alpha.1
Fixed in
11.0.0-alpha.1· Vendor fix available
Issue
Mattermost versions < 11.0 fail to properly enforce the "Allow users to view archived channels" setting which allows regular users to access archived channel content and files via the "Open in Channel" functionality from followed threads
Recommended action: Upgrade to 11.0.0-alpha.1 (pre-release) or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Go github.com/mattermost/mattermost-server < 5.3.2-0.20250815165020-c8d66301415d
Fixed in
5.3.2-0.20250815165020-c8d66301415d· Vendor fix available
Issue
Mattermost versions < 11 fail to properly restrict access to archived channel search API which allows guest users to discover archived public channels via the /api/v4/teams/{teamid}/channels/searcharchived endpoint
Recommended action: Upgrade to 5.3.2-0.20250815165020-c8d66301415d (pre-release) or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Go github.com/mattermost/mattermost-server < 11.1.0
Fixed in
11.1.0· Vendor fix available
Issue
Mattermost versions < 11 fail to enforce multi-factor authentication on WebSocket connections which allows unauthenticated users to access sensitive information via WebSocket events.
Recommended action: Upgrade to 11.1.0 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
5.3.2-0.20250905150616-ba86dfc5876b10.11.410.5.12· Vendor fix available
Issue
Mattermost versions 10.11.x <= 10.11.3, 10.5.x <= 10.5.11 fail to properly validate team membership permissions in the Add Channel Member API, which allows users from one team to access user metadata and channel membership information from other teams via the API endpoint.
Recommended action: Upgrade to 10.11.4, 10.5.12 or 5.3.2-0.20250905150616-ba86dfc5876b (pre-release) by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Mattermost versions 10.11.x <= 10.11.1, 10.10.x <= 10.10.2, 10.5.x <= 10.5.10 fail to verify a user has permission to join a Mattermost team using the original invite token which allows any attacked to join any team on a Mattermost server regardless of restrictions via manipulating the OAuth state.
Recommended action: Upgrade to 10.11.2, 10.10.3 or 10.5.11 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Go github.com/mattermost/mattermost-server >= 10.5.0, < 10.5.11; >= 10.11.0, < 10.11.3
Fixed in
10.11.310.5.11· Vendor fix available
Issue
Mattermost versions 10.5.x <= 10.5.10, 10.11.x <= 10.11.2 fail to properly validate guest user permissions when adding channel members which allows guest users to add any team members to their private channels via the /api/v4/channels/{channelid}/members endpoint
Recommended action: Upgrade to 10.11.3 or 10.5.11 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Go github.com/mattermost/mattermost-server >= 10.5.0, < 10.5.11; >= 10.11.0, < 10.11.3
Fixed in
10.11.310.5.11· Vendor fix available
Issue
Mattermost versions 10.5.x <= 10.5.10, 10.11.x <= 10.11.2 fail to use constant-time comparison for sensitive string comparisons which allows attackers to exploit timing oracles to perform byte-by-byte brute force attacks via response time analysis on Cloud API keys and OAuth client secrets.
Recommended action: Upgrade to 10.11.3 or 10.5.11 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Go github.com/mattermost/mattermost-server >= 10.5.0, < 10.5.11; >= 10.11.0, < 10.11.3
Fixed in
10.11.310.5.11· Vendor fix available
Issue
Mattermost versions 10.5.x <= 10.5.10, 10.11.x <= 10.11.2 fail to properly validate guest user permissions when accessing channel information which allows guest users to discover active public channels and their metadata via the /api/v4/teams/{teamid}/channels/ids endpoint
Recommended action: Upgrade to 10.11.3 or 10.5.11 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Mattermost versions 10.11.x <= 10.11.1, 10.10.x <= 10.10.2, 10.5.x <= 10.5.10 fail to verify a user has permission to join a Mattermost team using the original invite token which allows any attacked to join any team on a Mattermost server regardless of restrictions via manipulating the RelayState.
Recommended action: Upgrade to 10.11.2, 10.10.3 or 10.5.11 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Mattermost versions 10.10.x <= 10.10.2, 10.5.x <= 10.5.10, 10.11.x <= 10.11.2 fail to validate email ownership during Slack import process which allows attackers to create verified user accounts with arbitrary email domains via malicious Slack import data to bypass email-based team access restrictions.
Recommended action: Upgrade to 10.11.3, 10.10.3 or 10.5.11 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Go github.com/mattermost/mattermost-server >= 10.5.0-rc1, < 10.5.9; >= 9.11.0-rc1, < 9.11.18
Fixed in
10.5.99.11.18· Vendor fix available
Issue
Mattermost versions 10.5.x <= 10.5.8, 9.11.x <= 9.11.17 fail to properly validate access controls which allows any authenticated user to download sensitive files via board file download endpoint using UUID enumeration
Recommended action: Upgrade to 10.5.9 or 9.11.18 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
10.10.210.9.410.5.99.11.1810.8.4· Vendor fix available
Issue
Mattermost versions 10.8.x <= 10.8.3, 10.5.x <= 10.5.8, 9.11.x <= 9.11.17, 10.10.x <= 10.10.1, 10.9.x <= 10.9.3 fail to validate import directory path configuration which allows admin users to execute arbitrary code via malicious plugin upload to prepackaged plugins directory
Recommended action: Upgrade to 10.10.2, 10.9.4, 10.8.4 or 2 more by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Go github.com/mattermost/mattermost-server >= 10.5.0, < 10.5.10
Fixed in
10.5.10· Vendor fix available
Issue
Mattermost versions 10.5.x <= 10.5.9 fail to properly validate redirect URLs which allows attackers to redirect users to malicious sites via crafted OAuth login URLs.
Recommended action: Upgrade to 10.5.10 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
10.10.210.9.410.5.99.11.1810.8.4· Vendor fix available
Issue
Mattermost versions 10.8.x <= 10.8.3, 10.5.x <= 10.5.8, 9.11.x <= 9.11.17, 10.10.x <= 10.10.1, 10.9.x <= 10.9.3 fail to properly validate cache keys for link metadata which allows authenticated users to access unauthorized posts and poison link previews via hash collision attacks on FNV-1 hashing.
Recommended action: Upgrade to 10.10.2, 10.9.4, 10.8.4 or 2 more by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.