Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.
Open advisories
171 actionable advisories, newest first. Withdrawn advisories and news are excluded. Coverage is partial.
Mattermost versions 10.10.x <= 10.10.1, 10.5.x <= 10.5.9, 10.9.x <= 10.9.4 fail to validate the redirectto parameter, allowing an attacker to craft a malicious link that, once a user authenticates with their SAML provider, could post the user’s cookies to an attacker-controlled URL.
Recommended action: Upgrade to 10.10.2, 10.9.5 or 10.5.10 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Go github.com/mattermost/mattermost-server >= 10.10.0, < 10.10.2
Fixed in
10.10.2· Vendor fix available
Issue
Mattermost versions 10.10.x <= 10.10.1 fail to properly sanitize user data during shared channel membership synchronization, which allows malicious or compromised remote clusters to access sensitive user information via unsanitized user objects. This vulnerability affects Mattermost Server instances with shared channels enabled.
Recommended action: Upgrade to 10.10.2 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Mattermost versions 10.8.x <= 10.8.3, 10.5.x <= 10.5.8, 10.10.x <= 10.10.0, 10.9.x <= 10.9.3 fail to sanitize file names which allows users with file upload permission to overwrite file attachment thumbnails via path traversal in file streaming APIs.
Recommended action: Upgrade to 10.10.1, 10.9.4, 10.8.4 or 10.5.9 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Go github.com/mattermost/mattermost-server >= 10.5.0, <= 10.5.9
Fixed in
10.5.10· Vendor fix available
Issue
Mattermost Server versions 10.5.x <= 10.5.9 utilizing the Agents plugin fail to reject empty request bodies which allows users to trick users into clicking malicious links via post actions
Recommended action: Upgrade to 10.5.10 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Go github.com/mattermost/mattermost-server >= 10.5.0, <= 10.5.8
Fixed in
10.5.9· Vendor fix available
Issue
Mattermost versions 10.5.x <= 10.5.8 fail to validate access controls at time of access which allows user to read a thread via AI posts
Recommended action: Upgrade to 10.5.9 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Mattermost versions 10.8.x <= 10.8.1, 10.7.x <= 10.7.3, 10.5.x <= 10.5.7, 9.11.x <= 9.11.16 fail to sanitize input paths of file attachments in the bulk import JSONL file, which allows a system admin to read arbitrary system files via path traversal.
Recommended action: Upgrade to 10.8.2, 10.7.4, 10.5.8 or 9.11.17 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Go github.com/mattermost/mattermost-server >= 10.5.0, < 10.5.8; >= 9.11.0, < 9.11.17
Fixed in
9.11.1710.5.8· Vendor fix available
Issue
Mattermost versions 10.5.x <= 10.5.7, 9.11.x <= 9.11.16 fail to negotiate a new token when accepting the invite which allows a user that intercepts both invite and password to send synchronization payloads to the server that originally created the invite via the REST API.
Recommended action: Upgrade to 10.5.8 or 9.11.17 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Mattermost versions 10.5.x <= 10.5.6, 10.8.x <= 10.8.1, 10.7.x <= 10.7.3, 9.11.x <= 9.11.16 fail to verify authorization when retrieving cached posts by PendingPostID which allows an authenticated user to read posts in private channels they don't have access to via guessing the PendingPostID of recently created posts.
Recommended action: Upgrade to 10.8.2, 10.7.4, 10.5.7 or 9.11.17 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Go github.com/mattermost/mattermost-server < 0.0.0-20250513065225-4ae5d647fb88
Fixed in
0.0.0-20250513065225-4ae5d647fb88· Vendor fix available
Issue
Mattermost versions 10.5.x <= 10.5.5, 9.11.x <= 9.11.15, 10.8.x <= 10.8.0, 10.7.x <= 10.7.2, 10.6.x <= 10.6.5 fail to properly validate channel membership when retrieving playbook run metadata, allowing authenticated users who are playbook members but not channel members to access sensitive information about linked private channels including channel name, display name, and participant count through the run metadata API endpoint.
Recommended action: Upgrade to 0.0.0-20250513065225-4ae5d647fb88 (pre-release) or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Go github.com/mattermost/mattermost-server < 0.0.0-20250513065225-4ae5d647fb88
Fixed in
0.0.0-20250513065225-4ae5d647fb88· Vendor fix available
Issue
Mattermost versions 10.5.x <= 10.5.5, 9.11.x <= 9.11.15, 10.8.x <= 10.8.0, 10.7.x <= 10.7.2, 10.6.x <= 10.6.5 fail to properly enforce channel member management permissions when adding participants to playbook runs. This allows authenticated users with member-level permissions to bypass system admin restrictions and add or remove users to/from private channels via the playbook run participants feature, even when the 'Manage Members' permission has been explicitly removed. This can lead to unauthorized access to sensitive channel content and allow guest users to gain channel management privileges.
Recommended action: Upgrade to 0.0.0-20250513065225-4ae5d647fb88 (pre-release) or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Go github.com/mattermost/mattermost-server < 0.0.0-20250520060012-d0380305ef7a
Fixed in
0.0.0-20250520060012-d0380305ef7a· Vendor fix available
Issue
Mattermost versions 10.5.x <= 10.5.5, 9.11.x <= 9.11.15, 10.8.x <= 10.8.0, 10.7.x <= 10.7.2, 10.6.x <= 10.6.5 fail to properly enforce channel member management permissions in playbook runs, allowing authenticated users without the 'Manage Channel Members' permission to add or remove users from public and private channels by manipulating playbook run participants when the run is linked to a channel.
Recommended action: Upgrade to 0.0.0-20250520060012-d0380305ef7a (pre-release) or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Go github.com/mattermost/mattermost-server < 0.0.0-20250520060012-d0380305ef7a
Fixed in
0.0.0-20250520060012-d0380305ef7a· Vendor fix available
Issue
Mattermost versions 10.5.x <= 10.5.5, 9.11.x <= 9.11.15, 10.8.x <= 10.8.0, 10.7.x <= 10.7.2, 10.6.x <= 10.6.5 fail to properly retrieve requestorInfo from playbooks handler for guest users which allows an attacker access to the playbook run.
Recommended action: Upgrade to 0.0.0-20250520060012-d0380305ef7a (pre-release) or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Go github.com/mattermost/mattermost-server < 0.0.0-20250519205859-65aec10162f6
Fixed in
0.0.0-20250519205859-65aec10162f6· Vendor fix available
Issue
Mattermost versions 10.5.x <= 10.5.5, 9.11.x <= 9.11.15, 10.8.x <= 10.8.0, 10.7.x <= 10.7.2, 10.6.x <= 10.6.5 fail to sanitize filenames in the archive extractor which allows authenticated users to write files to arbitrary locations on the filesystem via uploading archives with path traversal sequences in filenames, potentially leading to remote code execution. The vulnerability impacts instances where file uploads and document search by content is enabled (FileSettings.EnableFileAttachments = true and FileSettings.ExtractContent = true). These configuration settings are enabled by default.
Recommended action: Upgrade to 0.0.0-20250519205859-65aec10162f6 (pre-release) or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Go github.com/mattermost/mattermost-server >= 10.5.0, < 10.5.5; >= 9.11.0, < 9.11.14
Fixed in
10.5.59.11.14· Vendor fix available
Issue
Mattermost versions 10.5.x <= 10.5.4, 9.11.x <= 9.11.13 fail to properly restrict API access to team information, allowing guest users to bypass permissions and view information about public teams they are not members of via a direct API call to /api/v4/teams/{teamid}.
Recommended action: Upgrade to 10.5.5 or 9.11.14 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Mattermost versions 10.7.x <= 10.7.1, 10.6.x <= 10.6.3, 10.5.x <= 10.5.4, 9.11.x <= 9.11.13 fail to properly validate LDAP group ID attributes, allowing an authenticated administrator with PermissionSysconsoleWriteUserManagementGroups permission to execute LDAP search filter injection via the PUT /api/v4/ldap/groups/{remoteid}/link API when objectGUID is configured as the Group ID Attribute.
Recommended action: Upgrade to 10.7.2, 10.6.4, 10.5.5 or 9.11.14 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Mattermost versions 10.5.x <= 10.5.1, 10.4.x <= 10.4.3, 9.11.x <= 9.11.9 fail to restrict certain operations on system admins to only other system admins, which allows delegated granular administration users with the "Edit Other Users" permission to perform unauthorized modifications to system administrators via improper permission validation.
Recommended action: Upgrade to 10.5.2, 10.4.4 or 9.11.10 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Go github.com/mattermost/mattermost-server < 9.11.9
Fixed in
9.11.9· Vendor fix available
Issue
Mattermost versions 10.4.x <= 10.4.2, 10.3.x <= 10.3.3, 9.11.x <= 9.11.8 fail to to enforce channel conversion restrictions, which allows members with permission to convert public channels to private ones to also convert private ones to public.
Recommended action: Upgrade to 9.11.9 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Go github.com/mattermost/mattermost-server >= 9.11.0, < 9.11.9
Fixed in
9.11.9· Vendor fix available
Issue
Mattermost versions 9.11.x <= 9.11.8 fail to properly perform authorization of the Viewer role which allows an attacker with the Viewer role configured with No Access to Reporting to still view team and site statistics.
Recommended action: Upgrade to 9.11.9 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Go github.com/mattermost/mattermost-server >= 9.9.0, <= 9.9.0; >= 9.5.0, < 9.5.7
Fixed in
9.9.19.5.7· Vendor fix available
Issue
Mattermost versions 9.9.x <= 9.9.0, 9.5.x <= 9.5.6 fail to properly restrict channel creation which allows a malicious remote to create arbitrary channels, when shared channels were enabled.
Recommended action: Upgrade to 9.9.1 or 9.5.7 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Go github.com/mattermost/mattermost-server >= 9.5.0, <= 9.5.2; >= 8.1.0, <= 8.1.11
Fixed in
9.5.38.1.12· Vendor fix available
Issue
Mattermost versions 9.6.0, 9.5.x before 9.5.3, and 8.1.x before 8.1.12 fail to fully validate role changes, which allows an attacker authenticated as a team admin to promote guests to team admins via crafted HTTP requests.
Recommended action: Upgrade to 9.5.3 or 8.1.12 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Mattermost versions 8.1.x <= 8.1.10, 9.6.x <= 9.6.0, 9.5.x <= 9.5.2 and 8.1.x <= 8.1.11 fail to limit the size of a request path that includes user inputs which allows an attacker to cause excessive resource consumption, possibly leading to a DoS via sending large request paths
Recommended action: Upgrade to 9.6.1, 9.5.3 or 8.1.12 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Mattermost versions 9.6.0, 9.5.x before 9.5.3, and 8.1.x before 8.1.12 fail to fully validate role changes which allows an attacker authenticated as team admin to demote users to guest via crafted HTTP requests.
Recommended action: Upgrade to 9.6.1, 9.5.3 or 8.1.12 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Mattermost versions 9.6.x <= 9.6.0, 9.5.x <= 9.5.2, 9.4.x <= 9.4.4 and 8.1.x <= 8.1.11 fail to remove detailed error messages in API requests even if the developer mode is off which allows an attacker to get information about the server such as the full path were files are stored
Recommended action: Upgrade to 9.6.1, 9.5.3, 9.4.5 or 8.1.12 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Mattermost versions 8.1.x before 8.1.12, 9.6.x before 9.6.1, 9.5.x before 9.5.3, 9.4.x before 9.4.5 fail to limit the number of active sessions, which allows an authenticated attacker to crash the server via repeated requests to the getSessions API after flooding the sessions table.
Recommended action: Upgrade to 9.6.1, 9.5.3, 9.4.5 or 8.1.12 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Mattermost versions 9.6.0, 9.5.x before 9.5.3, 9.4.x before 9.4.5, and 8.1.x before 8.1.12 fail to handle JSON parsing errors in custom status values, which allows an authenticated attacker to crash other users' web clients via a malformed custom status.
Recommended action: Upgrade to 9.6.1, 9.5.3, 9.4.5 or 8.1.12 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.