Go Package Vulnerabilities

Open in search

Vulnerabilities associated with github.com/mattermost/mattermost-server/v6.

Packages

Clear package

Showing 25 vulnerabilities on this page for github.com/mattermost/mattermost-server/v6

Signals CISA KEV Ransomware Nuclei
VulnerabilityTitle and contextCVSSEPSSPoCsSignals

Guest user can discover archived public channels

Mattermost versions <11 fail to properly restrict access to archived channel search API which allows guest users to discover archived public channels via the `/api/v4/teams/{team_id}/channels/search_archived` endpoint

CWE-863Nov 14, 2025
CVSS4.3v3.1EPSS0.192%PoCs0SignalsSTIX

Cross-team channel membership access

Mattermost versions 10.11.x <= 10.11.3, 10.5.x <= 10.5.11 fail to properly validate team membership permissions in the Add Channel Member API which allows users from one team to access user metadata and channel membership information from other teams via the API endpoint

CWE-863Nov 13, 2025
CVSS3.1v3.1EPSS0.181%PoCs0SignalsSTIX

Nil pointer dereference in bulk import crashes server

Mattermost versions 10.8.x <= 10.8.3, 10.5.x <= 10.5.8, 9.11.x <= 9.11.17, 10.10.x <= 10.10.0, 10.9.x <= 10.9.3 fail to validate import data which allows a system admin to crash the server via the bulk import feature.

CWE-1287CWE-476Aug 21, 2025
CVSS4.9v3.1EPSS0.321%PoCs0SignalsSTIX

Team invite ID leaked to team admin with no member invite privileges

Mattermost versions 10.8.x <= 10.8.3, 10.5.x <= 10.5.8, 9.11.x <= 9.11.17, 10.9.x <= 10.9.2 fail to sanitize the team invite ID in the POST /api/v4/teams/:teamId/restore endpoint which allows an team admin with no member invite privileges to get the team’s invite id.

CWE-306Aug 21, 2025
CVSS4.3v3.1EPSS0.215%PoCs0SignalsSTIX

Mattermost Shared Channel Upload Type Validation Bypass

Mattermost versions 10.8.x <= 10.8.3, 10.5.x <= 10.5.8, 9.11.x <= 9.11.17, 10.9.x <= 10.9.2, 10.10.x <= 10.10.0 fail to validate upload types in remote cluster upload sessions which allows a system admin to upload non-attachment file types via shared channels that could potentially be placed in arbitrary filesystem directories.

CWE-434Aug 21, 2025
CVSS6.8v3.1EPSS0.301%PoCs0SignalsSTIX

Path Traversal in Template Upload Allows Uploading Files Outside Target Directory

Mattermost versions 10.8.x <= 10.8.3, 10.5.x <= 10.5.8, 9.11.x <= 9.11.17, 10.9.x <= 10.9.2 fails to sanitize path traversal sequences in template file destination paths, which allows a system admin to perform path traversal attacks via malicious path components, potentially enabling malicious file placement outside intended directories.

CWE-22Aug 21, 2025
CVSS6.8v3.1EPSS0.407%PoCs0SignalsSTIX

Channel and Team Membership APIs inadvertently allow loss of Member privileges.

Mattermost versions 10.5.x <= 10.5.8, 9.11.x <= 9.11.17 fail to properly validate authorization for team scheme role modifications which allows Team Admins to demote Team Members to Guests via the PUT /api/v4/teams/team-id/members/user-id/schemeRoles API endpoint.

CWE-863Aug 21, 2025
CVSS3.8v3.1EPSS0.203%PoCs0SignalsSTIX

Import Path Traversal Enables Unauthorized Unsigned Plugin Installation

Mattermost versions 10.9.x <= 10.9.1, 10.8.x <= 10.8.3, 10.5.x <= 10.5.8, 9.11.x <= 9.11.17 fail to properly validate file paths during plugin import operations which allows restricted admin users to install unauthorized custom plugins via path traversal in the import functionality, bypassing plugin signature enforcement and marketplace restrictions.

CWE-22Aug 21, 2025
CVSS6.8v3.1EPSS0.494%PoCs0SignalsSTIX

Malicious remote can create arbitrary channels

Mattermost versions 9.9.x <= 9.9.0, 9.5.x <= 9.5.6 fail to properly restrict channel creation which allows a malicious remote to create arbitrary channels, when shared channels were enabled.

CWE-284Aug 1, 2024
CVSS3.8v3.1EPSS0.283%PoCs0SignalsSTIX

Resource Exhaustion via the Invitation Feature

Resource Exhaustion in Mattermost Server versions 8.1.x before 8.1.10 fails to limit the size of the payload that can be read and parsed allowing an attacker to send a very large email payload and crash the server.

CWE-400CWE-770Mar 15, 2024
CVSS3.1v3.1EPSS0.507%PoCs0SignalsSTIX

Details of archived public channels are leaked to members of another team

Mattermost fails to properly verify the permissions needed for viewing archived public channels,  allowing a member of one team to get details about the archived public channels of another team via the GET /api/v4/teams/<team-id>/channels/deleted endpoint.

CWE-284Jan 2, 2024
CVSS-v4.0EPSS0.359%PoCs0SignalsSTIX

Keywords that trigger mentions are leaked to other users

Mattermost fails to scope the WebSocket response around notified users to a each user separately resulting in the WebSocket broadcasting the information about who was notified about a post to everyone else in the channel.

CWE-200Jan 2, 2024
CVSS-v4.0EPSS0.459%PoCs0SignalsSTIX

Public endpoint /metrics of Calls plugin reveals channel IDs

Mattermost is grouping calls in the /metrics endpoint by id and reports that id in the response. Since this id is the channelID, the public /metrics endpoint is revealing channelIDs.

CWE-200Dec 6, 2023
CVSS5.3v3.1EPSS0.534%PoCs0SignalsSTIX

Client side path traversal due to lack of route parameters validation

Mattermost webapp fails to validate route parameters in/<TEAM_NAME>/channels/<CHANNEL_NAME> allowing an attacker to perform a client-side path traversal.

CWE-22CWE-74Dec 6, 2023
CVSS7.1v3.1EPSS0.643%PoCs0SignalsSTIX

Open redirect in /oauth/<service>/mobile_login?redirect_to=

Mattermost fails to properly check a redirect URL parameter allowing for an open redirect was possible when the user clicked "Back to Mattermost" after providing a invalid custom url scheme in /oauth/{service}/mobile_login?redirect_to=

CWE-601Nov 27, 2023
CVSS4.3v3.1EPSS0.403%PoCs0SignalsSTIX

Insecure Direct Object Reference in /plugins/focalboard/ api/v2/users of Mattermost Boards

Mattermost fails to perform proper authorization in the /plugins/focalboard/api/v2/users endpoint allowing an attacker who is a guest user and knows the ID of another user to get their information (e.g. name, surname, nickname) via Mattermost Boards.

CWE-284Nov 27, 2023
CVSS4.3v3.1EPSS0.443%PoCs0SignalsSTIX

Permalink previews displayed for posts in archived channels even if users are disallowed to view archived channels

Mattermost fails to check whether the  “Allow users to view archived channels”  setting is enabled during permalink previews display, allowing members to view permalink previews of archived channels even if the “Allow users to view archived channels” setting is disabled.

CWE-200Nov 27, 2023
CVSS4.3v3.1EPSS0.506%PoCs0SignalsSTIX

Log Flooding due to specially crafted requests in different endpoints

Mattermost fails to limit the log size of server logs allowing an attacker sending specially crafted requests to different endpoints to potentially overflow the log.

CWE-400Nov 27, 2023
CVSS4.3v3.1EPSS0.632%PoCs0SignalsSTIX

HTML injection via channel autocomplete

Mattermost fails to use  innerText / textContent when setting the channel name in the webapp during autocomplete, allowing an attacker to inject HTML to a victim's page by create a channel name that is valid HTML. No XSS is possible though.

CWE-74Nov 27, 2023
CVSS3.1v3.1EPSS0.368%PoCs0SignalsSTIX

Denial of Service via specially crafted block fields in Mattermost Boards

Mattermost fails to properly limit the characters allowed in different fields of a block in Mattermost Boards allowing a attacker to consume excessive resources, possibly leading to Denial of Service, by patching the field of a block using a specially crafted string.

CWE-400Nov 27, 2023
CVSS4.3v3.1EPSS0.723%PoCs0SignalsSTIX

Denial of Service via Board Import Zip Bomb

Mattermost fails to limit the amount of data extracted from compressed archives during board import in Mattermost Boards allowing an attacker to consume excessive resources, possibly leading to Denial of Service, by importing a board using a specially crafted zip (zip bomb).

CWE-400Nov 27, 2023
CVSS4.3v3.1EPSS0.723%PoCs0SignalsSTIX

Users full name disclosure through Mattermost Boards with Show Full Name Option disabled

Mattermost fails to properly validate the "Show Full Name" option in a few endpoints in Mattermost Boards, allowing a member to get the full name of another user even if the Show Full Name option was disabled.

CWE-200Nov 27, 2023
CVSS4.3v3.1EPSS0.506%PoCs0SignalsSTIX

Username and Icon override can be used by members when Hardened Mode is enabled

Mattermost fails to check if hardened mode is enabled when overriding the username and/or the icon when posting a post. If settings allowed integrations to override the username and profile picture when posting, a member could also override the username and icon when making a post even if the Hardened Mode setting was enabled

CWE-284Nov 27, 2023
CVSS4.3v3.1EPSS0.417%PoCs0SignalsSTIX

Denial of Service via Link Preview in /api/v4/redirect_location

Mattermost fails to properly sanitize the request to /api/v4/redirect_location allowing an attacker, sending a specially crafted request to /api/v4/redirect_location, to fill up the memory due to caching large items.

CWE-400Nov 6, 2023
CVSS5.3v3.1EPSS0.531%PoCs0SignalsSTIX

Password hash in response body after username update

Mattermost fails to properly sanitize the user object when updating the username, resulting in the password hash being included in the response body.

CWE-116CWE-200Nov 6, 2023
CVSS4.9v3.1EPSS0.51%PoCs1SignalsSTIX