github.com/mattermost/mattermost-server
Go296 known CVEs affecting this package
Aggregated from OSV, GitHub Security Advisories, NVD, and vendor advisories. Each CVE links to its full detail page with vendor advisories, patches, fixed versions, and remediation guidance.
CVEs affecting github.com/mattermost/mattermost-serverpage 6 of 6
- CVE-2026-3108HIGHCVSS 8.8EG 8.8fixed in 10.11.11+incompatible, 11.2.3+incompatible, 11.3.2+incompatible or 11.4.1+incompatible, by version range2026-03-26
Mattermost versions 11.2.x <= 11.2.2, 10.11.x <= 10.11.10, 11.4.x <= 11.4.0, 11.3.x <= 11.3.1 fail to sanitize user-controlled post content in the mmctl commands terminal output which allows attackers to manipulate administrator terminals …
- CVE-2026-3112MEDIUMCVSS 4.9EG 6.8fixed in 10.11.12+incompatible, 11.2.4+incompatible, 11.3.2+incompatible or 11.4.1+incompatible, by version range2026-03-26
Mattermost versions 11.4.x <= 11.4.0, 11.3.x <= 11.3.1, 11.2.x <= 11.2.3, 10.11.x <= 10.11.11 fail to validate Advanced Logging file target paths which allows system administrators to read arbitrary host files via malicious AdvancedLogging…
- CVE-2026-3113MEDIUMCVSS 5.5EG 5.5fixed in 11.4.1, 11.3.2, 11.2.4, 10.11.12, 8.0.0-20260217110922-b7d4a1f1f59b, 10.11.12+incompatible, 11.2.4+incompatible, 11.3.2+incompatible or 11.4.1+incompatible, by version range2026-03-26
Mattermost versions 11.4.x <= 11.4.0, 11.3.x <= 11.3.1, 11.2.x <= 11.2.3, 10.11.x <= 10.11.11 fail to set permissions on downloaded bulk export which allows other local users on the server to be able to read contents of the bulk export.. M…
- CVE-2026-3114MEDIUMCVSS 6.5EG 6.5fixed in 10.11.12+incompatible, 11.2.4+incompatible, 11.3.2+incompatible or 11.4.1+incompatible, by version range2026-03-26
Mattermost versions 11.4.x <= 11.4.0, 11.3.x <= 11.3.1, 11.2.x <= 11.2.3, 10.11.x <= 10.11.11 fail to validate decompressed archive entry sizes during file extraction which allows authenticated users with file upload permissions to cause a…
- CVE-2026-3115MEDIUMCVSS 4.3EG 4.3fixed in 10.11.11+incompatible, 11.2.3+incompatible, 11.3.2+incompatible or 11.4.1+incompatible, by version range2026-03-26
Mattermost versions 11.2.x <= 11.2.2, 10.11.x <= 10.11.10, 11.4.x <= 11.4.0, 11.3.x <= 11.3.1 fail to apply view restrictions when retrieving group member IDs, which allows authenticated guest users to enumerate user IDs outside their allo…
- CVE-2026-3433MEDIUMCVSS 4.3EG 4.3fixed in 11.6.1, 11.5.5, 10.11.17, 10.11.17+incompatible, 11.5.5+incompatible or 11.6.1+incompatible, by version range2026-06-12
vulnerable: 11.6.0
Mattermost versions 11.6.x <= 11.6.1, 11.5.x <= 11.5.4, 10.11.x <= 10.11.15, 10.11.x <= 10.11.16 fail to restrict role_updated websocket event broadcasts to members of the affected team or channel which allows an authenticated attacker wit…
- CVE-2026-3473HIGHCVSS 7.1EG 7.1fixed in 11.6.1, 11.5.4, 11.4.5, 10.11.15, 10.11.15+incompatible, 11.4.5+incompatible, 11.5.4+incompatible or 11.6.1+incompatible, by version range2026-05-26
vulnerable: 11.6.0
Mattermost versions 11.6.x <= 11.6.0, 11.5.x <= 11.5.3, 11.4.x <= 11.4.4, 10.11.x <= 10.11.14 fail to validate file ownership and access control, which allows an authenticated user to access and download files belonging to other users or t…
- CVE-2026-3495MEDIUMCVSS 4.8EG 4.8fixed in 5.3.2-0.20260310115442-5a1ea95044dc, 10.11.14+incompatible or 11.5.2+incompatible, by version range2026-05-18
Mattermost versions 11.5.x <= 11.5.1, 10.11.x <= 10.11.13 fail to escape some variables that could contain malicious content during error page composition which allows an attacker with access to edit some site configuration to execute some…
- CVE-2026-3590MEDIUMCVSS 6.5EG 6.5fixed in 10.11.13, 11.5.0, 11.4.3, 11.3.3, 10.11.13+incompatible, 11.3.3+incompatible, 11.4.3+incompatible or 11.5.0+incompatible, by version range2026-04-15
vulnerable: 11.5.0-rc1
Mattermost versions 10.11.x <= 10.11.12, 11.5.x <= 11.5.0, 11.4.x <= 11.4.2, 11.3.x <= 11.3.2 fail to enforce atomic single-use consumption of guest magic link tokens, which allows an attacker with access to a valid magic link to establish…
- CVE-2026-3636MEDIUMCVSS 4.3EG 4.3fixed in 11.6.1, 11.5.4, 11.4.5, 10.11.15, 10.11.15+incompatible, 11.4.5+incompatible, 11.5.4+incompatible or 11.6.1+incompatible, by version range2026-05-26
vulnerable: 11.6.0
Mattermost versions 11.6.x <= 11.6.0, 11.5.x <= 11.5.3, 11.4.x <= 11.4.4, 10.11.x <= 10.11.14 fail to sanitize team member data when returned via API to users without elevated permissions which allows a user without permissions to get data…
- CVE-2026-3637MEDIUMCVSS 4.3EG 4.3fixed in 5.3.2-0.20260316171743-090408f09f53, 10.11.14+incompatible, 11.4.4+incompatible or 11.5.2+incompatible, by version range2026-05-18
Mattermost versions 11.5.x <= 11.5.1, 10.11.x <= 10.11.13, 11.4.x <= 11.4.3 fail to check the create_post channel permission during post edit operations which allows an authenticated attacker with revoked posting privileges to modify their…
- CVE-2026-4053LOWCVSS 3.1EG 3.1fixed in 11.5.2, 0.0.0-20260414103857-b21ef302025e or 11.5.2+incompatible, by version range2026-05-15
Mattermost versions 11.5.x <= 11.5.1, 10.11.x <= 10.11.13 fail to enforce the PostEditTimeLimit on non-message post fields which allows an authenticated user to modify post file attachments, props, and pin status after the edit window has …
- CVE-2026-4054MEDIUMCVSS 4.3EG 4.3fixed in 11.5.2, 0.0.0-20260414103857-b21ef302025e, 11.4.4, 11.4.4+incompatible or 11.5.2+incompatible, by version range2026-05-15
Mattermost versions 11.5.x <= 11.5.1, 10.11.x <= 10.11.13, 11.4.x <= 11.4.3 Fail to validate the response body of proxied images, which allows a remote attacker to enact client-side DoS via an SVG file served from an attacker-controlled or…
- CVE-2026-4055MEDIUMCVSS 4.3EG 4.32026-05-21
Mattermost versions 11.5.x <= 11.5.1 fail to validate team-level run_create permission against the target team when creating a playbook run which allows an authenticated team member to create runs in teams where they lack permission via sp…
- CVE-2026-4265MEDIUMCVSS 4.3EG 4.3fixed in 5.3.2-0.20260107144005-c7f6efdfb035, 10.11.11, 11.2.3, 11.3.1, 10.11.11+incompatible, 11.2.3+incompatible or 11.3.1+incompatible, by version range2026-03-16
Mattermost versions 11.3.x <= 11.3.0, 11.2.x <= 11.2.2, 10.11.x <= 10.11.10 fail to validate team-specific upload_file permissions which allows a guest user to post files in channels where they lack upload_file permission via uploading fil…
- CVE-2026-4273MEDIUMCVSS 4.3EG 4.3fixed in 5.3.2-0.20260313190740-742e0be95074, 10.11.14+incompatible or 11.5.2+incompatible, by version range2026-05-18
Mattermost versions 11.5.x <= 11.5.1, 10.11.x <= 10.11.13 fail to validate that the RefreshedToken differs from the original invite token during remote cluster invite confirmation which allows an authenticated attacker to bypass token rota…
- CVE-2026-4274MEDIUMCVSS 5.4EG 5.4fixed in 10.11.11+incompatible, 11.2.3+incompatible, 11.3.2+incompatible or 11.4.1+incompatible, by version range2026-03-26
Mattermost versions 11.2.x <= 11.2.2, 10.11.x <= 10.11.10, 11.4.x <= 11.4.0, 11.3.x <= 11.3.1 fail to restrict team-level access when processing membership sync from a remote cluster, which allows a malicious remote cluster to grant a user…
- CVE-2026-4286MEDIUMCVSS 4.3EG 4.3fixed in 10.11.14+incompatible or 11.5.2+incompatible, by version range2026-05-18
Mattermost versions 11.5.x <= 11.5.1, 10.11.x <= 10.11.13 fail to check if {{team_id}} was being changed when updating playbooks, allowing users with only {{Manage Playbook Configurations}} permission to change a playbook's team, bypassing…
- CVE-2026-4635MEDIUMCVSS 5.3EG 5.3fixed in 11.6.1, 11.5.4, 11.4.5, 10.11.15, 10.11.15+incompatible, 11.4.5+incompatible, 11.5.4+incompatible or 11.6.1+incompatible, by version range2026-05-26
vulnerable: 11.6.0
Mattermost versions 11.6.x <= 11.6.0, 11.5.x <= 11.5.3, 11.4.x <= 11.4.4, 10.11.x <= 10.11.14 fail to archive the channel before removing persistent notifications which allows authenticated user to crash the server via timing the creation …
- CVE-2026-4646MEDIUMCVSS 4.3EG 4.3fixed in 11.6.1, 11.5.4, 11.4.5, 10.11.15, 10.11.15+incompatible, 11.4.5+incompatible, 11.5.4+incompatible or 11.6.1+incompatible, by version range2026-05-26
vulnerable: 11.6.0
Mattermost versions 11.6.x <= 11.6.0, 11.5.x <= 11.5.3, 11.4.x <= 11.4.4, 10.11.x <= 10.11.14 fail to validate user-supplied input in API request handlers which allows an authenticated attacker to crash the plugin process via a crafted HTT…
- CVE-2026-4858CRITICALCVSS 9.9EG 9.9fixed in 11.6.1, 11.5.4, 11.4.5, 10.11.15, 10.11.15+incompatible, 11.4.5+incompatible, 11.5.4+incompatible or 11.6.1+incompatible, by version range2026-05-21
vulnerable: 11.6.0
Mattermost versions 11.6.x <= 11.6.0, 11.5.x <= 11.5.3, 11.4.x <= 11.4.4, 10.11.x <= 10.11.14 fail to check integration URL for path traversal which allows an malicious authenticated user to call an arbitrary API via system admin Mattermo…
- CVE-2026-4915MEDIUMCVSS 6.5EG 6.5fixed in 11.6.1, 11.5.4, 11.4.5, 10.11.15, 10.11.15+incompatible, 11.4.5+incompatible, 11.5.4+incompatible or 11.6.1+incompatible, by version range2026-05-25
vulnerable: 11.6.0
Mattermost versions 11.6.x <= 11.6.0, 11.5.x <= 11.5.3, 11.4.x <= 11.4.4, 10.11.x <= 10.11.14 fail to filter nil elements from outgoing webhook attachment payloads before processing, which allows an authenticated user to cause a denial of …
- CVE-2026-5139MEDIUMCVSS 5.4EG 5.4fixed in 11.7.1, 11.6.3, 11.5.6, 10.11.18, 10.11.18+incompatible, 11.5.6+incompatible, 11.6.3+incompatible or 11.7.1+incompatible, by version range2026-06-22
Mattermost versions 11.7.x <= 11.7.0, 11.6.x <= 11.6.2, 11.5.x <= 11.5.5, 10.11.x <= 10.11.17 fail to enforce administrator authorization on the {{setDefaultInstance}} call within the {{/gitlab connect}} command handler, which allows any a…
- CVE-2026-5163MEDIUMCVSS 6.5EG 6.5fixed in 5.3.2-0.20260401090745-f4d1abe7e8f5 or 11.5.2+incompatible, by version range2026-05-18
Mattermost versions 11.5.x <= 11.5.1 fail to verify channel membership when processing AI-assisted message rewrites which allows an authenticated attacker to read the content of threads in private channels and direct messages they do not h…
- CVE-2026-5308HIGHCVSS 7.5EG 7.5fixed in 11.6.1, 11.5.4, 11.4.5, 10.11.15, 10.11.15+incompatible, 11.4.5+incompatible, 11.5.4+incompatible or 11.6.1+incompatible, by version range2026-05-26
vulnerable: 11.6.0
Mattermost versions 11.6.x <= 11.6.0, 11.5.x <= 11.5.3, 11.4.x <= 11.4.4, 10.11.x <= 10.11.14 fail to enforce request body size limits on plugin HTTP endpoints which allows an attacker to cause a denial of service via crafted oversized HTT…
- CVE-2026-5740HIGHCVSS 7.5EG 7.5fixed in 11.6.1, 11.5.4, 11.4.5, 10.11.15, 10.11.15+incompatible, 11.4.5+incompatible, 11.5.4+incompatible or 11.6.1+incompatible, by version range2026-05-26
vulnerable: 11.6.0
Mattermost versions 11.6.x <= 11.6.0, 11.5.x <= 11.5.3, 11.4.x <= 11.4.4, 10.11.x <= 10.11.14 fail to properly validate msgpack-encoded WebSocket frames before memory allocation which allows an unauthenticated remote attacker to crash the …
- CVE-2026-5755MEDIUMCVSS 6.5EG 6.5fixed in 11.6.1, 11.5.4, 11.4.5, 10.11.15, 10.11.15+incompatible, 11.4.5+incompatible, 11.5.4+incompatible or 11.6.1+incompatible, by version range2026-05-26
vulnerable: 11.6.0
Mattermost versions 11.6.x <= 11.6.0, 11.5.x <= 11.5.2, 11.5.x <= 11.5.3, 11.4.x <= 11.4.4, 10.11.x <= 10.11.14 fail to validate the TIFF IFD offset in the image header before allocating memory, which allows authenticated users with file u…
- CVE-2026-6046MEDIUMCVSS 5.3EG 5.3fixed in 11.6.1, 11.5.5, 10.11.17, 10.11.17+incompatible, 11.5.5+incompatible or 11.6.1+incompatible, by version range2026-06-12
vulnerable: 11.6.0
Mattermost versions 11.6.x <= 11.6.1, 11.5.x <= 11.5.4, 10.11.x <= 10.11.15, 10.11.x <= 10.11.16 fail to validate that a username returned during bot registration belongs to a bot account, which allows an unprivileged attacker to intercept…
- CVE-2026-6062MEDIUMCVSS 6.4EG 6.4fixed in 11.7.1, 11.6.3, 11.5.6, 10.11.18, 10.11.18+incompatible, 11.5.6+incompatible, 11.6.3+incompatible or 11.7.1+incompatible, by version range2026-06-22
Mattermost versions 11.7.x <= 11.7.0, 11.6.x <= 11.6.2, 11.5.x <= 11.5.5, 10.11.x <= 10.11.17 Fail to validate channel ownership of an existing subscription before applying edits which allows an authenticated attacker to hijack subscriptio…
- CVE-2026-6333MEDIUMCVSS 5.0EG 5.0fixed in 5.3.2-0.20260325160634-e738016c5920, 10.11.14+incompatible or 11.5.2+incompatible, by version range2026-05-18
Mattermost versions 11.5.x <= 11.5.1, 10.11.x <= 10.11.13 fail to validate the Host header when constructing response URLs for custom slash commands which allows an authenticated attacker to redirect slash command responses to an attacker-…
- CVE-2026-6334LOWCVSS 3.8EG 3.8fixed in 5.3.2-0.20260318173148-e9ae890a013b, 10.11.14+incompatible or 11.5.2+incompatible, by version range2026-05-18
Mattermost versions 11.5.x <= 11.5.1, 10.11.x <= 10.11.13 fail to enforce client identity binding during the OAuth authorization code redemption flow which allows an authenticated OAuth client to redeem authorization codes issued to a diff…
- CVE-2026-6339MEDIUMCVSS 4.3EG 4.3fixed in 5.3.2-0.20260327001745-7a339a6438f5, 11.4.4+incompatible or 11.5.2+incompatible, by version range2026-05-18
Mattermost versions 11.5.x <= 11.5.1, 11.4.x <= 11.4.3 fail to validate the X-Requested-With header on the burn-on-read reveal endpoint which allows an authenticated channel member to force the reveal of a burn-on-read message without reci…
- CVE-2026-6340MEDIUMCVSS 6.5EG 6.5fixed in 5.3.2-0.20260325191733-fb11968f8798, 10.11.14+incompatible, 11.4.4+incompatible or 11.5.2+incompatible, by version range2026-05-18
Mattermost versions 11.5.x <= 11.5.1, 10.11.x <= 10.11.13, 11.4.x <= 11.4.3 fail to validate 7zip archive structure before processing which allows an authenticated attacker to cause server memory exhaustion and denial of service via upload…
- CVE-2026-6343MEDIUMCVSS 4.3EG 4.3fixed in 10.11.14+incompatible, 11.4.4+incompatible or 11.5.2+incompatible, by version range2026-05-18
Mattermost versions 11.5.x <= 11.5.1, 10.11.x <= 10.11.13, 11.4.x <= 11.4.3 fail to check public/private permissions which allows members without these permissions to access public playbooks via /get.. Mattermost Advisory ID: MMSA-2026-005…
- CVE-2026-6345MEDIUMCVSS 6.5EG 6.5fixed in 5.3.2-0.20260311102650-3057ae7e83e9, 10.11.14+incompatible, 11.4.4+incompatible or 11.5.2+incompatible, by version range2026-05-18
Mattermost versions 11.5.x <= 11.5.1, 10.11.x <= 10.11.13, 11.4.x <= 11.4.3 fail prevent disclosure of created user password which allows a malicious attacker to impersonate a user via the use of some of those passwords.. Mattermost Adviso…
- CVE-2026-6346HIGHCVSS 8.7EG 8.7fixed in 5.3.2-0.20260326202606-fac92f4a71f3, 10.11.14+incompatible, 11.4.4+incompatible or 11.5.2+incompatible, by version range2026-05-18
Mattermost versions 11.5.x <= 11.5.1, 10.11.x <= 10.11.13, 11.4.x <= 11.4.3 fail to sanitize sensitive configuration fields before including them in support packet generation, which allows a Mattermost System Admin or any party with access…
- CVE-2026-6347HIGHCVSS 7.6EG 7.6fixed in 11.5.2, 10.11.14, 11.4.4, 10.11.14+incompatible, 11.4.4+incompatible or 11.5.2+incompatible, by version range2026-05-18
Mattermost versions 11.5.x <= 11.5.1, 10.11.x <= 10.11.13, 11.4.x <= 11.4.3 fail to sanitize sensitive configuration fields in the Mattermost Calls plugin which allows an attacker with access to a support packet to obtain TURN server crede…
- CVE-2026-6673MEDIUMCVSS 6.4EG 6.4fixed in 11.7.1, 11.6.3, 11.5.6, 10.11.18, 10.11.18+incompatible, 11.5.6+incompatible, 11.6.3+incompatible or 11.7.1+incompatible, by version range2026-06-22
Mattermost versions 11.7.x <= 11.7.0, 11.6.x <= 11.6.2, 11.5.x <= 11.5.5, 10.11.x <= 10.11.17 fail to authenticate Atlassian Connect installed callbacks, allowing a remote unauthenticated attacker to inject a rogue sharedSecret and disrupt…
- CVE-2026-6689MEDIUMCVSS 4.3EG 4.3fixed in 11.6.1, 11.5.5, 10.11.17, 10.11.17+incompatible, 11.5.5+incompatible or 11.6.1+incompatible, by version range2026-06-12
vulnerable: 11.6.0
Mattermost versions 11.6.x <= 11.6.1, 11.5.x <= 11.5.4, 10.11.x <= 10.11.15, 10.11.x <= 10.11.16 Fail to enforce PermissionInviteUser when setting AllowOpenInvite or AllowedDomains during team creation (the check was only applied on update…
- CVE-2026-6739HIGHCVSS 7.2EG 7.2fixed in 11.6.1, 11.5.5, 10.11.17, 10.11.17+incompatible, 11.5.5+incompatible or 11.6.1+incompatible, by version range2026-06-12
vulnerable: 11.6.0
Mattermost versions 11.6.x <= 11.6.1, 11.5.x <= 11.5.4, 10.11.x <= 10.11.15, 10.11.x <= 10.11.16 fail to require system-level permission when patching protected default system roles, which allows authenticated users with delegated user-man…
- CVE-2026-6961HIGHCVSS 7.6EG 7.6fixed in 11.6.1, 11.5.5, 10.11.17, 10.11.17+incompatible, 11.5.5+incompatible or 11.6.1+incompatible, by version range2026-06-12
vulnerable: 11.6.0
Mattermost versions 11.6.x <= 11.6.1, 11.5.x <= 11.5.4, 10.11.x <= 10.11.15, 10.11.x <= 10.11.16 Mattermost fails to sanitize FileInfo.Name received from federated peers during shared channel file sync, which allows an attacker who control…
- CVE-2026-7184MEDIUMCVSS 6.5EG 6.5fixed in 11.6.1, 11.5.5, 10.11.16, 10.11.16+incompatible, 11.5.5+incompatible or 11.6.1+incompatible, by version range2026-06-12
vulnerable: 11.6.0
Mattermost versions 11.6.x <= 11.6.1, 11.5.x <= 11.5.4, 10.11.x <= 10.11.15 fail to sanitize the Remote Cluster API response on PATCH operations, which allows authenticated users with the {{manage_secure_connections}} permission to obtain …
- CVE-2026-7387HIGHCVSS 8.8EG 8.8fixed in 11.6.1, 11.5.5, 10.11.17, 10.11.17+incompatible, 11.5.5+incompatible or 11.6.1+incompatible, by version range2026-06-12
vulnerable: 11.6.0
Mattermost versions 11.6.x <= 11.6.1, 11.5.x <= 11.5.4, 10.11.x <= 10.11.15, 10.11.x <= 10.11.16 Mattermost fails to require role-management authorization when setting the scheme_admin flag on group syncable link and patch endpoints, which…
- CVE-2026-8074LOWCVSS 3.8EG 3.8fixed in 11.7.1, 10.11.18, 10.11.18+incompatible or 11.7.1+incompatible, by version range2026-06-22
Mattermost versions 11.7.x <= 11.7.0, 10.11.x <= 10.11.17 fail to enforce bot-specific permission checks on the user active status endpoint, which allows a User Manager with user management write access but no Integrations access to deacti…
- CVE-2026-8823LOWCVSS 3.8EG 3.8fixed in 11.7.1, 10.11.18, 10.11.18+incompatible or 11.7.1+incompatible, by version range2026-06-22
vulnerable: 11.7.0
Mattermost versions 11.7.x <= 11.7.0, 10.11.x <= 10.11.17 fail to validate bot targets when demoting users to guests which allows a lower-privileged administrator to degrade arbitrary bot accounts via the standard demote-user API.. Matterm…
- CVE-2026-9162MEDIUMCVSS 4.3EG 4.3fixed in 11.7.1, 11.6.3, 11.5.6, 10.11.18, 10.11.18+incompatible, 11.5.6+incompatible, 11.6.3+incompatible or 11.7.1+incompatible, by version range2026-06-22
Mattermost versions 11.7.x <= 11.7.0, 11.6.x <= 11.6.2, 11.5.x <= 11.5.5, 10.11.x <= 10.11.17 fail to invalidate cached authentication state for active WebSocket connections during global session revocation, which allows a user with an exi…
Check whether github.com/mattermost/mattermost-server is used in your infrastructure
EchelonGraph scans your cloud and SBOMs to map every package to your actual deployments. See blast radius for github.com/mattermost/mattermost-server CVEs against the assets you own.
Book a Demo →