Vulnerabilities in Mattermost
512 resultsCVE-2024-1953MEDIUMMattermost versions 8.1.x before 8.1.9, 9.2.x before 9.2.5, 9.3.0, and 9.4.x before 9.4.2 fail to limit the number of role names requested fEPSS 0.5%CVE-2023-5967MEDIUMDenial of Service via crashing the Calls PluginEPSS 0.5%CVE-2024-28053LOWResource Exhaustion via the Invitation FeatureEPSS 0.5%CVE-2023-43754MEDIUMPermalink previews displayed for posts in archived channels even if users are disallowed to view archived channelsEPSS 0.5%CVE-2023-45223MEDIUMUsers full name disclosure through Mattermost Boards with Show Full Name Option disabledEPSS 0.5%CVE-2023-4478MEDIUMParameter tampering in the registration resulting in blocked accounts to be createdEPSS 0.5%CVE-2023-2788MEDIUMDeactivated user can retain access using oauth2 apiEPSS 0.5%CVE-2022-1003LOWSysadmin can override existing configs & bypass restrictions like EnableUploadsEPSS 0.5%CVE-2024-4198LOWMattermost versions 9.6.0, 9.5.x before 9.5.3, and 8.1.x before 8.1.12 fail to fully validate role changes which allows an attacker authentiEPSS 0.5%CVE-2023-27264HIGHIDOR: Updating a playbook via the Playbooks APIEPSS 0.5%CVE-2024-4195LOWMattermost versions 9.6.0, 9.5.x before 9.5.3, and 8.1.x before 8.1.12 fail to fully validate role changes, which allows an attacker authentEPSS 0.5%CVE-2025-41395MEDIUMWebapp DoS via malicious retrospective post in PlaybooksEPSS 0.5%CVE-2023-27263MEDIUMIDOR: Accessing playbook runs via the Playbooks Runs APIEPSS 0.5%CVE-2023-5195MEDIUMA team member can soft delete other teams that they are not part ofEPSS 0.5%CVE-2023-5876LOWRegex DoS from a malicious server enrolled in DesktopEPSS 0.5%CVE-2025-36530MEDIUMImport Path Traversal Enables Unauthorized Unsigned Plugin InstallationEPSS 0.5%CVE-2025-20621MEDIUMWebapp crash via object that can't be cast to String in Attachment FieldEPSS 0.5%CVE-2023-2281LOWArchiving a team broadcasts unsanitized data over WebSocketsEPSS 0.5%CVE-2023-2515MEDIUMPrivilege escalation to system admin via personal access tokensEPSS 0.5%CVE-2023-2797LOWPath traversal in GitHub plugin's code preview featureEPSS 0.5%