Mattermost
Monthly
Authenticated SAML users can join any team - including invite-only teams - on affected Mattermost servers because the application fails to verify the integrity of the SAML RelayState POST parameter, allowing the team_id or invite_id fields inside it to be forged. Exploitation requires the target instance to have SAML single sign-on configured and enabled, and the attacker must already hold valid SAML credentials for that instance (CVSS 3.1: AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N, 7.1); no victim interaction is needed. Impact is bounded to unauthorized team membership rather than administrative takeover. No public exploit code has been identified at time of analysis and the issue is not in CISA KEV, so this is a moderate-priority, authentication-gated authorization flaw rather than a mass-exploitation emergency; no EPSS score was provided in the available intelligence.
OAuth Dynamic Client Registration redirect URI validation bypass in Mattermost 11.7.x (through 11.7.7), 11.8.x (through 11.8.4) and 11.9.0 lets a remote unauthenticated attacker register an OAuth client whose attacker-controlled callback host evades the configured redirect URI allowlist, so authorization responses can be sent to a host the attacker controls. The CVSS vector (AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N, score 9.3) confirms no authentication is needed to register the client, but a legitimate user must still be induced to complete the OAuth authorization flow for the malicious client, which makes the attack non-automatable per SSVC (Exploitation: none, Automatable: no) despite a total technical impact rating. No public exploit code was identified at time of analysis, the issue is not in CISA KEV, and EPSS is low at 0.28% (roughly 20th percentile); the practical risk is a serious but not urgent credential/interception exposure confined to deployments that expose OAuth with Dynamic Client Registration.
Missing authorization in Mattermost's playbook run creation allows authenticated channel members to add arbitrary users to restricted channels by abusing the run owner field. Affected versions span three active release trains (11.9.x, 11.8.x, 11.7.x) and the LTS branch (10.11.x). An attacker with only channel-member access can silently bypass channel membership-management permissions to grant themselves or others access to content they are not authorized to view, producing a confidentiality exposure rated C:H in the CVSS vector. No public exploit code or CISA KEV listing has been identified at time of analysis.
SSRF vulnerabilities in AWX notification backends (webhook, Mattermost, Rocket.Chat, and Grafana) allow an authenticated organization notification administrator to cause the AWX control node to issue outbound HTTP requests to internal, loopback, or RFC-1918 addresses that are not externally reachable. Beyond basic SSRF, the webhook backend compounds the risk by following HTTP redirects and replaying configured Basic Authentication credentials to the redirect destination regardless of host change, enabling credential exfiltration to attacker-controlled endpoints; the Grafana backend similarly exposes its API key by forwarding the Authorization header verbatim to any configured target URL. No public exploit has been identified at time of analysis, but the Changed scope and high confidentiality impact in the CVSS vector reflect significant real-world risk given the network position AWX control nodes typically occupy.
Incorrect authorization in Mattermost's Boards component across versions 11.7.x through 11.7.6, 10.11.x through 10.11.21, and 11.8.x through 11.8.3 enables privilege escalation within board management. Board editors and non-guest team members can supply arbitrary values in BoardMember.Scheme* fields through the boards member API or archive-import endpoint, effectively granting board admin rights to any user without server-side enforcement. No public exploit has been identified at time of analysis, and the vulnerability is not listed in the CISA KEV catalog.
Denial of service in linkify-it (npm) through v5.0.0 lets remote unauthenticated attackers wedge a rendering worker by submitting tens of KB of repeated email/link-like text. The core public API LinkifyIt.prototype.match runs an O(N²) scan loop that re-slices the input and re-runs unanchored fuzzy regex searches once per match, so 64 KB of "a@b.com" burns ~2.5 s of single-threaded CPU and 128 KB ~10 s. The flaw is inherited by markdown-it (~21.6M weekly npm downloads) whenever linkify:true is set, exposing forums, chat, wikis and AI chat UIs; publicly available exploit code (a PoC in the GHSA advisory) exists, but there is no evidence of active exploitation.
Credential leakage in Mattermost Desktop App versions up to 6.1 and 5.5.13.0 allows authenticated server users to harvest NTLM credentials from other users by embedding images that resolve to attacker-controlled external web servers. The client fails to enforce a strict domain allow list before forwarding Windows NTLM authentication challenges, so any post in a server without the image proxy enabled becomes a credential capture vector. No public exploit identified at time of analysis and EPSS is low (0.18%), but the scope-change CVSS of 7.7 reflects cross-user impact.
Arbitrary file write in Mattermost via path traversal affects versions 11.6.x ≤ 11.6.1, 11.5.x ≤ 11.5.4, and 10.11.x ≤ 10.11.15/10.11.16 when shared channels with federated peers are in use. An attacker who controls a federated Mattermost server can supply crafted FileInfo.Name values during file sync to write files to arbitrary locations in the target server's filestore. No public exploit identified at time of analysis and the issue is not listed in CISA KEV.
Privilege escalation in Mattermost server (11.6.x, 11.5.x, and 10.11.x branches) allows a low-privileged user holding group-link permissions to promote themselves or other group members to team or channel administrator by setting the scheme_admin flag through group syncable link and patch API endpoints. The flaw stems from missing role-management authorization checks, and with a CVSS of 8.8 (network, low complexity, low privileges) it enables tenant-wide takeover of collaboration workspaces; no public exploit identified at time of analysis.
Privilege escalation in Mattermost collaboration platform allows authenticated users holding delegated user-management permissions to modify built-in system role permissions via the role patch API, bypassing a required system-level permission check. Affects Mattermost 10.11.x through 10.11.16, 11.5.x through 11.5.4, and 11.6.x through 11.6.1. No public exploit identified at time of analysis; EPSS is very low (0.03%) and the SSVC framework reports no observed exploitation.
Arbitrary file write in Mattermost Plugins (versions ≤1.1.5) lets an administrator of a remote, federated Mattermost server plant files at attacker-chosen paths inside the target server's filestore by supplying a malicious, unsanitized filename through the shared-channel attachment sync protocol. The flaw stems from CWE-22 path traversal in the export-path construction logic and carries CVSS 8.0 with a changed scope, reflecting that a compromised or hostile federation peer can affect resources beyond the plugin's intended boundary. There is no public exploit identified at time of analysis, and CISA's SSVC framework records exploitation status as 'none' but technical impact as 'total'.
Broken object-level authorization in the Mattermost Boards feature lets an authenticated low-privileged user retrieve and download files owned by other users or teams by supplying valid file IDs in crafted Boards API requests. Affected self-hosted builds span the 10.11.x, 11.4.x, 11.5.x and 11.6.x branches. There is no public exploit identified at time of analysis and EPSS is very low (0.03%), but the flaw is a straightforward IDOR yielding high-confidentiality impact across team/tenant boundaries.
Denial of service in Mattermost server (versions 11.6.0, 11.5.0-11.5.3, 11.4.0-11.4.4, and 10.11.0-10.11.14) allows remote attackers to crash the server process by sending a crafted msgpack-encoded binary WebSocket frame to the public endpoint. The flaw stems from missing validation of frame sizes before memory allocation, enabling a full service outage for all users. No public exploit identified at time of analysis, and the CVSS 7.5 score reflects the unauthenticated network-reachable nature of the attack with high availability impact.
Denial of service in Mattermost self-hosted server (versions 11.6.0, 11.5.x ≤11.5.3, 11.4.x ≤11.4.4, and 10.11.x ≤10.11.14) allows remote unauthenticated attackers to exhaust server resources by sending oversized HTTP requests to plugin endpoints, which fail to enforce request body size limits. There is no public exploit identified at time of analysis, and the EPSS score is very low (0.04%, 11th percentile), but the flaw is remotely reachable without authentication and a vendor patch is available. Impact is limited to availability - no data disclosure or integrity loss.
Privilege escalation to full administrative control in Mattermost self-hosted server (versions 11.6.0 and earlier in the 11.6.x line, 11.5.3 and earlier, 11.4.4 and earlier, and 10.11.14 and earlier) allows a low-privileged authenticated user to abuse missing path-traversal validation on integration action URLs to invoke arbitrary internal APIs using the system administrator's Mattermost auth token. Because the request is executed with the admin token, the attacker effectively gains total control over the instance despite starting as an ordinary user. There is no public exploit identified at time of analysis, and the EPSS score is very low (0.03%), but the vendor-assigned CVSS of 9.9 reflects the severe privilege-crossing impact.
Mattermost versions up to 11.5.1 expose sensitive credentials in plaintext within support packets due to insufficient sanitization of configuration fields. System administrators or anyone with access to support packets can obtain database passwords, API keys, and other sensitive credentials by downloading support packets from the System Console. The vulnerability affects multiple version branches (10.11.x, 11.4.x, 11.5.x) and poses significant risk for credential theft and lateral movement.
Information disclosure in Mattermost Calls plugin versions 11.5.x <= 11.5.1, 10.11.x <= 10.11.13, 11.4.x <= 11.4.3 exposes TURN server credentials through support packets. Administrators with support packet access can extract plaintext credentials from exported plugin configurations, potentially compromising the WebRTC infrastructure used for voice/video calls. The vulnerability requires high privileges (admin) but affects confidentiality across trust boundaries (CVSS Scope:Changed).
Authorization bypass in Mattermost Plugin Legal Hold versions <=1.1.4 allows authenticated attackers to manipulate legal hold data without proper permission validation. After failed authorization checks, the plugin continues processing requests instead of terminating them, enabling low-privileged authenticated users to access, create, download, and delete sensitive legal hold data through direct API calls. This represents a critical failure in access control enforcement for compliance-critical data. EPSS data not available; no confirmed active exploitation (CISA KEV) or public exploit code identified at time of analysis.
Mattermost's mmctl command-line administration tool fails to sanitize ANSI and OSC escape sequences embedded in user-generated post content, enabling authenticated low-privilege attackers to inject malicious terminal control codes when administrators export or query messages. Exploitation allows screen manipulation, fake prompt injection, and clipboard hijacking against administrators running mmctl commands, potentially leading to secondary code execution if administrators are tricked into running injected commands. CISA SSVC framework indicates no current exploitation, non-automatable attack requiring high complexity and user interaction, but with total technical impact potential.
Mattermost 10.11.x through 11.3.x fails to validate password length, allowing unauthenticated attackers to trigger denial of service by submitting multi-megabyte passwords during login attempts that consume excessive CPU and memory resources. The vulnerability affects all versions up to 10.11.10, 11.2.2, and 11.3.0, with no patch currently available.
A sensitive information disclosure vulnerability in Mattermost Plugins versions 2.0.3.0 and earlier fails to properly mask sensitive configuration values in support packets, allowing attackers with high privileges to extract original plugin settings from exported configuration data. The vulnerability requires authenticated access with high privileges (CVSS 7.6) and enables attackers to obtain sensitive configuration data that should be masked, potentially exposing API keys, credentials, or other sensitive plugin configurations. No active exploitation or proof-of-concept has been reported, and the vulnerability requires significant access privileges to exploit.
Authenticated Mattermost users can degrade message post-processing latency for every member of the channels they share by storing an oversized list of custom mention keywords (notify_props.mention_keys) on their own profile, which the server then matches against each post. Because the matching routine scales quadratically and multibyte/Unicode keywords add per-character cost, and neither the number nor the size of stored keywords is capped, each post the attacker's channel peers send or receive is processed far more expensively on the attacker's behalf. Impact is confined to availability degradation (CVSS 4.3, AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L; CWE-770); no data exposure or crash is involved, valid authentication plus at least one shared channel is required, and no public exploit has been identified at time of analysis.
Information disclosure in Mattermost release lines 11.7.x, 11.8.x, 11.9.x and 11.10.x (up to 11.7.10, 11.8.5, 11.9.1 and 11.10.1 respectively) allows an authenticated user to learn the channel ID of a private channel that another user is actively viewing. The user status API endpoints return an unsanitized active-channel field, so any provisioned account on the same server - with no membership in the target private channel, which is precisely the flaw - can query another user's status and observe which private channel that user is currently reading. The exposure is limited to the channel identifier itself, not its contents, name or membership, but it still reveals the existence of private channels and correlates named users with sensitive collaboration spaces. Rated CVSS 4.3 (AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N), this is a low-to-moderate urgency issue rather than an emergency, and no public exploit has been identified at time of analysis.
Mattermost 11.7.x through 11.10.x fails to invalidate the stored AD/LDAP bind password whenever other connection settings - such as the directory server address - are changed in the System Console, so the previously saved plaintext credential is carried over to the new configuration. An authenticated System Console administrator (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N, base 4.9) can then trigger the LDAP Test Connection / diagnostics feature, which transmits that retained plaintext bind password to the configured server address, potentially an attacker-controlled host set by the same admin. There is confirmed no CISA KEV entry and no public exploit identified at time of analysis, and no EPSS score was supplied; exploitation is gated behind high-privilege System Console access, an existing AD/LDAP integration with a stored bind password, and the deliberate admin action of pointing the connection at a hostile host, making this a genuine but moderate-priority confidentiality issue rather than an emergency.
Mattermost Server versions 11.7.x through 11.10.x can disclose the stored client secret of an outgoing OAuth connection to an attacker who holds the administrative permission to manage those connections. The platform fails to require re-entry of the stored secret during connection validation, so an authenticated high-privileged user can repoint the connection's token URL at an attacker-controlled endpoint and trigger validation, causing the secret to be sent to that endpoint (CWE-201, information disclosure). Our assessment rates this CVSS 6.5 (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N), with the practical risk tempered by the privilege prerequisite - the feature must be enabled and at least one outgoing OAuth connection with a stored secret must already exist; no public exploit was identified at time of analysis and there is no KEV listing. Exploitation is remote, requires no victim interaction, and yields confidentiality impact only (no integrity or availability impact).
Authenticated users on Mattermost Server 11.7.x through 11.10.0 can quarantine posts inside direct and group messages they are not participants of by issuing a direct API call to the post-quarantine endpoint, because the server performs no DM/GM membership or authorization check before processing the request (CWE-862, Missing Authorization). The flaw is remotely reachable over the network but requires a valid low-privileged account (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L per the assessed vector), and the realistic impact is improper manipulation of the moderation/quarantine state of DM and GM posts rather than disclosure of message contents or full data compromise. There is no public exploit identified at time of analysis and no confirmed active exploitation (no CISA KEV entry); this is a moderate-severity authorization weakness that Mattermost tracks under advisory MMSA-2026-00756.
Authenticated guest accounts on Mattermost 11.7.x through 11.7.9, 11.8.x through 11.8.5, 11.9.x through 11.9.1, and 11.10.0 can be escalated to team or channel administrator by abusing the member roles API endpoint, which fails to validate a crafted combination of guest and admin scheme roles. The flaw requires only a valid guest login and network reachability to the API, so any server that provisions guest accounts is exposed, though no public exploit code or confirmed active exploitation has been identified at time of analysis. Vendor advisory MMSA-2026-00752 tracks the issue, and Mattermost has published it on its security updates page.
Mattermost servers running 11.7.x through 11.7.9, 11.8.x through 11.8.5, 11.9.x through 11.9.1, and 11.10.x through 11.10.0 fail to restrict Slack import account binding to system-administrator-initiated imports, so an authenticated attacker holding team admin privileges can force-add existing Mattermost users to their own team and then forge posts attributed to those users' identities. The attacker only needs to be an authenticated insider with the team-admin role and to supply a crafted Slack export archive containing the target users' email addresses; no victim interaction is required (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N, base score 4.3). Impact is confined to integrity - unauthorized team membership and identity-forged content - with no confidentiality loss or availability impact, and there is no public exploit identified at time of analysis and no CISA KEV listing, making this a moderate-priority insider-abuse issue rather than an urgent remote-code-execution or data-breach emergency.
Memory exhaustion in Mattermost (versions 11.10.x through 11.10.0, 11.7.x through 11.7.9, 11.8.x through 11.8.5, and 11.9.x through 11.9.1) allows an authenticated, low-privilege user to drive the server to buffer an arbitrarily large remote image response in memory by making the local image proxy perform a direct fetch from an attacker-controlled endpoint, degrading or crashing the instance. The defect is a missing size limit on the buffered response (CWE-770), and impact is confined to availability - there is no confidentiality or integrity loss, and no data disclosure or modification occurs. Rated CVSS 6.5 (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H); exploitation requires a valid low-privilege account and a configuration in which the local image proxy performs direct remote image fetches, and no public exploit identified at time of analysis, though a structured advisory (MMSA-2026-00726) is published.
Private team metadata in Mattermost Server can be enumerated by any authenticated user who lacks the permission to list private teams, because the team search functionality fails to exclude private teams from public search results. An attacker with a valid low-privileged account can send a modified team-search request and retrieve the ID, name, and display name of private teams they are not authorized to see. The issue affects Mattermost 11.7.x through 11.7.9, 11.8.x through 11.8.5, 11.9.x through 11.9.1, and 11.10.x through 11.10.0, and is rated low severity (CVSS 3.1 4.3, AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N) with only metadata disclosure - no message content, membership lists, or credentials are exposed; no public exploit was identified at time of analysis.
Mattermost versions 11.10.x through 11.10.0, 11.7.x through 11.7.9, 11.9.x through 11.9.1, and 11.8.x through 11.8.5 fail to validate the invited recipient's email address when redeeming team or guest invitation tokens, enabling an authenticated user who obtains a forwarded or leaked invite link to join a team or access private channels without authorization. The flaw is rated CVSS 5.0 (moderate severity) and requires an attacker with an existing authenticated account plus a valid, unredeemed invitation token originally issued to a different email address; no victim user interaction is needed. No public exploit code or confirmed active exploitation has been identified at time of analysis, and the vendor advisory is MMSA-2026-00747.
Account takeover in Mattermost 11.7.x through 11.10.0 lets an authenticated attacker who already holds a valid OAuth bearer token for a specific target user permanently hijack that user's SSO-backed account: the POST /api/v4/users/login/switch endpoint fails to reject OAuth application sessions, so the attacker can switch the account to password authentication, set an attacker-controlled password, and detach the account from its identity provider (CWE-863 Incorrect Authorization; CVSS 4.4, CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:H/A:N). Exploitation is heavily constrained - the victim must have an identity-provider-backed account, the attacker must obtain a victim-scoped OAuth token (typically by getting the user to authorize a malicious OAuth application), attack complexity is assessed as high, and deployments without SSO or OAuth applications are not exposed. No public exploit identified at time of analysis, and there is no confirmed active exploitation (Mattermost advisory MMSA-2026-00758).
Flagged-post review status in Mattermost can be inferred by authenticated users who lack content-reviewer permissions, because the affected API performs other validations before checking the caller's permissions, producing a distinguishable response for flagged versus unflagged posts. The issue affects 11.10.x through 11.10.0, 11.9.x through 11.9.1, 11.8.x through 11.8.5, and 11.7.x through 11.7.9 (advisory MMSA-2026-00754), and exploitation requires a valid account on a deployment that actually uses the post-flagging/moderation feature, with attacker access limited to a single binary signal and no exposure of post content or reviewer details. Rated CVSS 4.3 (AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N); no public exploit identified at time of analysis, and this is a genuinely low real-world priority.
Debug-level logging in Mattermost Server can write authentication secrets - session tokens and OAuth access tokens - into server log entries without sanitization, allowing anyone who can read those logs to impersonate authenticated users. Affected releases are 11.7.x through 11.7.10, 11.8.x through 11.8.5, 11.9.x through 11.9.1, and 11.10.x through 11.10.1 (Mattermost advisory MMSA-2026-00763); the vendor scores it 4.5 (MEDIUM) under CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:N/A:N. Exploitation is prerequisite-heavy rather than opportunistic: the server must be running with debug-level logging (not the default production setting) and the attacker must already hold read access to those logs via filesystem access, a centralized log/SIEM viewer role, or a compromised log pipeline, and the assessed vector (AV:L/AC:H/PR:H/UI:N) reflects that local, high-privilege access barrier. There is no public exploit identified at time of analysis and no KEV listing; impact is confidentiality-only, as stolen tokens enable user impersonation while the flaw itself produces no direct integrity or availability loss.
Information disclosure in Mattermost (versions 11.7.x through 11.7.9, 11.8.x through 11.8.5, 11.9.x through 11.9.1, and 11.10.0) allows an authenticated member of a channel to recover the server-side webhook URLs and authentication secrets embedded in interactive-message posts. The server fails to strip action integration secrets before broadcasting the post_deleted WebSocket event and before returning thread API responses, so a channel member who deletes or observes deletion of an interactive-message post - or simply reads the threads REST API - can harvest credentials intended to stay server-side. Exploitation requires a valid authenticated account with membership in a channel that actually uses interactive message/action integrations, and there is no public exploit identified at time of analysis; the issue is a moderate-severity confidentiality exposure rather than an urgent emergency, with an assessed CVSS of 6.5 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N).
Authenticated users of any privilege level on Red Hat Ansible Automation Platform 2 automation-controller deployments can extract other tenants' notification secrets-PagerDuty service keys and Slack, Mattermost, RocketChat, and generic Webhook bearer-token URLs-by abusing the API filter backend as a boolean count-oracle. The attack requires only a low-privilege account (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N, base 6.5), is network-reachable and low in complexity, and yields high confidentiality impact with no integrity or availability effect. Impact is greatest in multi-tenant installations where recovered secrets break organization isolation and permit notification-channel impersonation; exploitation is inherently slow, requiring many iterative requests that may be visible in API logs. No public exploit code has been identified at time of analysis, and the flaw is not listed as confirmed actively exploited (CISA KEV).
Memory exhaustion denial of service in Mattermost 11.7.x through 11.10.x allows an authenticated user to send oversized request bodies to plugin endpoints because the CSRF-validation path fails to enforce a request body size limit. The affected ranges are 11.7.x up to and including 11.7.10, 11.8.x up to and including 11.8.5, 11.9.x up to and including 11.9.1, and 11.10.x up to and including 11.10.1. This is an availability-only issue rated CVSS 6.5, with authentication required (PR:L) and no public exploit identified at time of analysis.
Server-side request forgery in Mattermost (11.7.x through 11.7.10, 11.8.x through 11.8.5, 11.9.x through 11.9.1, and 11.10.x through 11.10.1) allows an authenticated System Administrator to set the OAuth token or userinfo endpoint to an internal network address, causing the Mattermost server to issue that request because the platform's internal-connection filter is not applied to OAuth endpoint traffic, and then read the internal response back through the configured OAuth flow. Impact is bounded: the attacker must already hold the highly-trusted System Administrator role (CVSS PR:H), confidentiality and integrity effects are Low with no availability impact, and the flaw only matters where the Mattermost server has network reachability to sensitive internal services. There is no public exploit identified at time of analysis, no CISA KEV listing, and the vendor CVSS of 5.5 (Medium) is well-calibrated - this is a genuinely low-priority issue despite the CWE-918 classification. The assessment vector CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N matches the vendor.
Server-side request forgery in Novu prior to 3.18.0 allows an authenticated user to make the notification worker issue attacker-directed POST requests to internal or otherwise restricted network services by supplying a chat webhook URL through subscriber credentials.webhookUrl, channel endpoint.url, event payload.webhookUrl, or event overrides.webhookUrl. The Slack, Discord, Mattermost, Microsoft Teams, Grafana On-Call, Ryver, Rocket.Chat, GetStream, and Zulip chat providers pass that URL straight into raw HTTP requests in send-message-chat.usecase.ts without the normalizeOutboundHttpUrl, assertSafeOutboundUrl, or DNS-pinned safeOutboundJsonRequest guards that protect Novu's generic webhook providers, resulting in a largely blind, POST-only SSRF whose impact is bounded to interactions or actions offered by the reached internal service (CVSS 5.3; assessed CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N). Exploitation requires a valid authenticated account and worker-level network reachability to the intended target; no public exploit code has been identified at time of analysis and there is no confirmation of active exploitation (CISA KEV). The issue is fixed in version 3.18.0.
Authenticated Mattermost users can drive excessive database load by submitting an oversized post ID array to the bulk reactions endpoint POST /api/v4/posts/ids/reactions, because Mattermost does not enforce a server-side length cap on that array (CWE-770). The flaw affects 11.7.x through 11.7.10, 11.8.x through 11.8.5, 11.9.x through 11.9.1, and 11.10.x through 11.10.1, requires only a valid account with API access (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L, 4.3), and has availability-only impact, meaning a single crafted request causes transient load rather than a persistent outage. There is no public exploit identified at time of analysis and no CISA KEV listing, so this is a low-to-moderate operational risk rather than a critical priority.
IPC sender-origin spoofing in the Mattermost Desktop App (versions up to and including 6.2.2.0) lets an attacker-controlled server view send a desktopAPI.leaveCall message that tears down an active call belonging to a different, trusted server connected in the same client. Exploitation is unauthenticated from the attacker's perspective (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L, score 3.8 Low) but requires the victim to be running a multi-server configuration with a live call on one server while another connected server is malicious, compromised, or grants the attacker script access; single-server clients and users with no call in progress are unaffected. Impact is limited to call disruption - no data exposure, no code execution - and no public exploit identified at time of analysis; this is a low-priority, low-impact issue.
Mattermost Desktop App versions up to and including 6.2.2.0 fail to validate the URL scheme when deciding whether a link points to an internal server resource, so a network-positioned attacker who can intercept and downgrade the connection can make the client open a plugin popout window over an insecure (non-TLS) connection. Exploitation is narrow: it requires a man-in-the-middle position capable of forcing the scheme downgrade, an authenticated user of the affected client (PR:L per the CVSS vector), and that user clicking a crafted internal link (UI:R), which is why the vendor and independent scoring both land in the low range (vendor 2.6; independently assessed AV:A/AC:H). There is no indication of active exploitation and no public exploit code identified at time of analysis; the realistic impact is limited to integrity of the content rendered in the popout window, with no confidentiality or availability effect.
Insufficient origin validation in the Mattermost Desktop App (versions up to and including 6.2.2.0) lets server-rendered content from an untrusted or compromised Mattermost server reach local or private network resources, giving the attacker a limited information-disclosure window. Exploitation is not remote-only: the victim must be running the desktop client and actively connect to and view content from an attacker-controlled server (CVSS 4.7, AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:N/A:N), and only confidentiality is affected - there is no integrity or availability impact. Mattermost credits game0v3r under its responsible disclosure policy (MMSA-2026-00698); there is no confirmed active exploitation (not in CISA KEV) and no public exploit identified at time of analysis, so overall risk is moderate and low priority.
Mattermost's data retention teams API endpoint fails to sanitize returned Team objects, exposing private teams' secret `invite_id` and email fields to any authenticated user holding only the read-only Data Retention Policy permission. An attacker exploiting CVE-2026-91181 can call `GET /api/v4/data_retention/policies/{policy_id}/teams`, harvest the `invite_id` of private teams they have no membership in, and use it to join those teams without authorization - effectively achieving lateral movement across private channels and communications. No public exploit code has been identified and the vulnerability is not listed in CISA KEV at time of analysis.
Mattermost's access control policy update endpoint fails to enforce role-based authorization boundaries, enabling a channel or team administrator to detach a system-assigned ABAC parent policy by issuing a crafted PUT /api/v4/access_control_policies request with an empty imports list. Affected are Mattermost versions 11.9.0, 11.8.x through 11.8.4, and 11.7.x through 11.7.7, per vendor advisory MMSA-2026-00724. No public exploit identified at time of analysis, and SSVC assessment confirms no known exploitation with partial technical impact.
Plugin handler panic recovery failure in Mattermost allows authenticated users to crash installed plugins by sending a post-action request containing a field with an unexpected type. Affected versions span multiple maintained release branches (≤11.9, 11.0.9, 11.4.8, 11.7.7, 10.22.11.0) as disclosed under MMSA-2026-00701. No public exploit code or active exploitation has been identified; impact is bounded to plugin availability disruption with no confidentiality or integrity exposure.
Mattermost's server-side Markdown parser across versions 10.11.x through 11.9.0 fails to enforce a nesting depth limit, allowing any authenticated user to cause CPU resource exhaustion by posting a message containing pathologically deep blockquote or list item nesting. The vulnerability is classified CWE-407 (Inefficient Algorithmic Complexity), producing a denial-of-service condition that degrades availability for all users of the affected instance. With a vendor-confirmed CVSS of 4.3 (Medium), no active exploitation, and SSVC marking it non-automatable, this represents a moderate insider or compromised-account risk rather than an urgent external threat. No public exploit code or CISA KEV listing identified at time of analysis.
The Microsoft Calendar plugin in Mattermost fails to validate null entries in incoming Microsoft Graph webhook payloads, enabling any unauthenticated remote attacker to crash the plugin process by sending a single crafted POST request to the public webhook endpoint. Affected are Mattermost versions 11.9.0, 11.8.x through 11.8.4, 11.7.x through 11.7.7, and 10.11.x through 10.11.22. No public exploit code or active exploitation has been identified; however, SSVC classifies this as automatable, meaning the denial-of-service condition can be triggered reliably and at scale without special tooling.
The Boards plugin in Mattermost fails to validate the data type of `fields.properties` during block creation, enabling any authenticated user holding editor-level access on a board to crash the Boards plugin worker via a malformed child block. Four release branches are affected (10.11.x, 11.7.x, 11.8.x, 11.9.x). No public exploit has been identified, SSVC rates exploitation as none and the attack as non-automatable, and the CVSS 4.3 Medium score is consistent with a bounded, privilege-gated availability impact.
Mattermost's Playbooks plugin can be crashed by an authenticated user via a malformed REST request that references a property field belonging to a different run than specified. Affected versions span the 10.11.x, 11.7.x, 11.8.x, and 11.9.x release branches, per vendor advisory MMSA-2026-00684. No active exploitation has been identified, and impact is scoped to availability loss of the Playbooks plugin rather than the core Mattermost server.
Mattermost server crashes or becomes unavailable when an authenticated user sends multiple SDP messages compressed with zlib that decompress to arbitrarily large sizes, exploiting the absence of any decompressed-size cap. Affected are all Mattermost instances running versions 11.9.0, 11.8.4 and earlier in the 11.8.x line, 11.7.7 and earlier in the 11.7.x line, and 10.11.22 and earlier in the 10.11.x line. No public exploit code has been identified at time of analysis, and the CVE has not been added to the CISA KEV catalog.
Unbounded memory allocation during image decoding in Mattermost 10.11.x through 11.9.x allows any authenticated user to trigger a denial-of-service condition against the server. By uploading a specially crafted image - such as a decompression bomb - through any of several upload surfaces (profile picture, channel file attachment, team icon, or custom brand image), an attacker can cause the Mattermost server process to exhaust available memory. No public exploit code or active exploitation has been identified at time of analysis; the vendor addressed this under advisory MMSA-2026-00719.
Missing channel action ownership validation in Mattermost allows an authenticated channel manager to overwrite workflow automation actions belonging to channels outside their management scope via the channel action update API endpoint. Affected releases span four active branches: 10.11.x through 10.11.22, 11.7.x through 11.7.7, 11.8.x through 11.8.4, and 11.9.0. No public exploit code has been identified and CISA has not listed this in KEV; the SSVC assessment records exploitation as none with non-automatable attack mechanics.
Board-creation permission enforcement is absent from three Mattermost Boards API endpoints-board duplicate, boards-and-blocks, and archive-import-allowing any authenticated user who has been denied board-creation rights to circumvent that restriction and create boards in the workspace. Affected are Mattermost versions 11.9.0, 11.8.x through 11.8.4, 11.7.x through 11.7.7, and 10.11.x through 10.11.22, as confirmed by advisory MMSA-2026-00715. No public exploit code has been identified and this CVE does not appear in the CISA KEV catalog; real-world impact is limited to unauthorized board creation with no confidentiality or availability consequence.
Mattermost's server-side Markdown autolink parser processes autolinks with unmatched trailing closing parentheses in superlinear time, enabling any authenticated user with post-creation rights to cause excessive CPU consumption and degrade availability for all users on the instance. Affected release trains are 11.9.x through 11.9.0, 11.8.x through 11.8.4, 11.7.x through 11.7.7, and 10.11.x through 10.11.22 across both cloud and self-hosted deployments. No public exploit code has been identified at time of analysis, and this CVE is not listed in CISA KEV, but the low exploitation barrier - any authenticated account - means insider threat or compromised-account scenarios are the primary realistic risk.
Resource exhaustion in Mattermost's file processing pipeline allows any authenticated user with file upload permissions to spawn unbounded goroutines by continuously uploading large files, degrading or blocking the file indexing service for all other users. Affected versions span the 10.11.x, 11.7.x, 11.8.x, and 11.9.x release trains. The vulnerability stems from two compounding defects: absence of a concurrent-file-processing cap and improper handling of failed file ingestion, together enabling goroutine accumulation in Mattermost's Go runtime. No public exploit code exists and no active exploitation has been identified at time of analysis.
Permission enforcement failure in Mattermost Boards allows authenticated non-guest team members to create Open or Private boards in defiance of administrator-imposed restrictions by importing a crafted .boardarchive file. The import code path omits the authorization check enforced by the direct board creation pathway, making administrative board creation controls bypassable by any authenticated non-guest user with import access. Affected versions span the 10.11.x, 11.7.x, 11.8.x, and 11.9.x release trains; no active exploitation has been identified and no public exploit code is known at time of analysis.
Incorrect authorization in Mattermost Boards allows an authenticated board editor to relink any editable board to an arbitrary channel by exploiting a missing PermissionManageBoardRoles check on the channelId field of the batch endpoint. Affected are Mattermost versions 11.7.x through 11.7.6, 10.11.x through 10.11.21, and 11.8.x through 11.8.3 (advisory MMSA-2026-00686). No public exploit code or CISA KEV listing has been identified at time of analysis, but the low attack complexity and network accessibility make this straightforward to execute for any authenticated board editor.
Denial of service in Mattermost's Boards (focalboard) plugin allows any authenticated user to crash the plugin process and disrupt Boards availability for all users on the instance by sending a single malformed WebSocket message. The root cause is absent input validation on the teamId field type in custom_focalboard_SUBSCRIBE_TEAM WebSocket commands, classified under CWE-704 (Incorrect Type Conversion). Affected versions span 11.7.x through 11.7.6, 10.11.x through 10.11.21, and 11.8.x through 11.8.3; no public exploit has been identified at time of analysis.
Mattermost Desktop App versions through 6.2.2.0 expose the pre-auth server secret in plaintext within generated diagnostics reports, specifically in the Server Connectivity Step-3 output section. A local attacker who obtains a copy of a user's diagnostics report or log files - whether through filesystem access or social engineering - can extract this secret and use it to authenticate against the configured Mattermost server as a pre-authorized client. No active exploitation has been confirmed (not in CISA KEV) and no public exploit code has been identified at the time of analysis; the risk is realistic primarily in shared-workstation or insider-threat scenarios.
Incomplete cleanup of thread membership records in Mattermost allows a re-invited user to read private channel thread root post content and metadata they should no longer have access to. Affected are all Mattermost deployments on versions 10.11.x through 10.11.20 and 11.7.x through 11.7.5. An authenticated user who was previously removed from or left a team, and is subsequently re-invited, can exploit stale membership records via the team threads API to access residual private channel thread data. No public exploit identified at time of analysis, and this vulnerability is not listed in the CISA KEV catalog.
Unauthorized message injection in the Mattermost GitLab Plugin (<=11.8) allows authenticated users to post bot-authored messages containing arbitrary URLs into restricted channels by exploiting two missing authorization checks: channel permission verification on the caller-supplied `post_id` parameter, and GitLab instance validation of the `web_url` parameter. Exploitation targets the `createIssue` and `attachCommentToIssue` API endpoints without requiring elevated privileges. No active exploitation is confirmed by CISA KEV and no public exploit code has been identified at time of analysis, but the low attack complexity and authenticated-only prerequisite make this a realistic internal threat in any Mattermost deployment running the GitLab integration.
Privilege escalation in Mattermost's channel administration API allows authenticated channel administrators to assign non-channel-scoped roles to channel members, exceeding their intended authorization boundary. Three active release lines are affected: 10.11.x through 10.11.21, 11.7.x through 11.7.6, and 11.8.x through 11.8.2. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in the CISA KEV catalog.
Private channel membership disclosure in Mattermost's Boards feature allows any authenticated team member to enumerate who belongs to private channels they are not authorized to view. Affected across three concurrently maintained release trains - 11.7.x through 11.7.6, 10.11.x through 10.11.21, and 11.8.x through 11.8.3 - the flaw is exploitable by any valid team account via standard board management API calls. No public exploit or active exploitation has been identified at time of analysis; the CVSS score of 4.3 (PR:L, C:L) accurately reflects the limited but real confidentiality impact, particularly meaningful in regulated environments where private channel membership itself is sensitive.
Mattermost's Playbooks feature in versions 11.7.x through 11.7.6 and 10.11.x through 10.11.21 omits run-state enforcement on API write operations, allowing any authenticated run participant to alter completed playbook runs via REST and GraphQL endpoints. An attacker with low privileges can overwrite status, checklists, retrospective content, ownership, and participant lists on runs that should be immutable once finished, undermining post-incident audit integrity. No public exploit has been identified at time of analysis, and the vulnerability is not listed in the CISA KEV catalog.
Incorrect authorization in Mattermost's OAuth and personal access token management endpoints allows an OAuth application holding a delegated user token to call account-management endpoints beyond its intended scope, revoking the victim user's authorizations or tokens for unrelated integrations. Affected are Mattermost 11.7.0 through 11.7.6 and 10.11.0 through 10.11.21. No public exploit code has been identified and this vulnerability is not listed in the CISA KEV catalog, though the low-complexity, network-accessible nature of the flaw makes it straightforward to abuse for any actor who has legitimately obtained an OAuth delegated token.
Privilege escalation in Mattermost's Boards feature allows a low-privileged board member to elevate a guest user to Board Admin by importing a specially crafted .boardarchive file. Affected are Mattermost versions 10.11.0 through 10.11.21 and 11.7.0 through 11.7.6. No public exploit or KEV listing has been identified, but the low attack complexity and the insider-threat profile make this a meaningful risk in multi-tenant or externally-collaborative Mattermost deployments.
Incorrect authorization in Mattermost's ABAC policy unassign API endpoint allows an authenticated team administrator to remove attribute-based access control policy assignments from channels that no longer belong to their team. Affected releases are Mattermost 11.7.0 through 11.7.6 and 11.8.0 through 11.8.3, tracked as MMSA-2026-00718 (ENISA EUVD-2026-60212). The exploit window opens when a channel is migrated between teams and the endpoint fails to re-verify team membership before executing the unassignment, letting a malicious admin modify access-control policy state beyond their administrative boundary.
Privilege retention in Mattermost Boards allows a user demoted to System Guest to continue exercising Board Admin privileges via the Boards REST API or UI. Affected are Mattermost versions 11.7.0-11.7.6, 10.11.0-10.11.21, and 11.8.0-11.8.3, where the SchemeAdmin flag is not reconciled against the user's current role during or after demotion. An authenticated attacker in this state can invoke admin-only Boards operations - including modifying board permissions and settings - without detection by role-based access checks. No public exploit code is identified and no CISA KEV listing is present at time of analysis.
Memory exhaustion and unbounded disk consumption in Mattermost's Boards archive import handler expose self-hosted deployments to authenticated denial-of-service. Affected versions span the 10.11.x, 11.7.x, 11.8.x, and 11.9.x release trains, all of which fail to enforce decompressed content size limits or respect the configured maximum file size when processing .boardarchive uploads. Any authenticated user with access to the Boards import endpoint can trigger this condition; no public exploit has been identified at time of analysis and the vulnerability does not appear in CISA KEV.
Path traversal in Mattermost allows an admin user with SAML system-console write permissions to delete arbitrary files outside the intended directory, causing high availability impact. Affected versions include 10.11.x through 10.11.20, 11.6.x through 11.6.5, 11.7.x through 11.7.3, and 11.8.0. No public exploit is identified at time of analysis, but the required high privileges limit the immediate risk.
Denial of service vulnerability in Mattermost allows authenticated users to exhaust server resources by uploading crafted animated GIFs as custom emoji. Affects versions 10.11.x, 11.6.x, 11.7.x, and 11.8.x up to certain patch levels. No active exploitation or public exploit is known, but patches are available from the vendor.
Denial of service in Mattermost 10.11.x through 11.8.x allows authenticated users with file-upload permission to degrade file-upload performance for all users by exploiting unbounded resource consumption during server-side document extraction. Attackers can repeatedly upload small documents that are expensive to extract, saturating the extraction worker pool and causing service degradation. No active exploitation or public exploit code is reported, but the low attack complexity and minimal privileges make this an accessible DoS vector.
Improper null checking in Mattermost Desktop App versions ≤6.2, 5.5.13, and 6.0.2.0 enables any authenticated channel member to crash the Desktop App of all other members in the same channel by posting a crafted link containing an embedded image served without expected HTTP headers. The crash is client-side and can be made persistent if the malicious message remains in the channel, forcing repeated crashes each time an affected client reconnects. No public exploit has been identified at time of analysis, but the low-privilege attack vector and trivial reproduction make this a realistic insider or compromised-account threat in collaborative environments.
Mattermost Desktop App across the 5.x and 6.x release branches can be crashed by a malicious server operator through unvalidated inter-process payloads sent from the Mattermost Web App to the Desktop App. The root cause is the absence of payload validation in the Web-to-Desktop communication channel, enabling a server owner to send a malformed method payload that causes uncontrolled processing and application termination on the connected client. No public exploit code has been identified at time of analysis and the vulnerability is not listed in the CISA KEV catalog; however, the network-accessible path and low-complexity exploitation make this a credible denial-of-service threat for organizations running self-hosted Mattermost deployments with untrusted or compromised server administrators.
Insecure Direct Object Reference (IDOR) in Mattermost's Playbooks feature permits any authenticated team member to overwrite another user's playbook metric configuration by supplying a foreign metric ID in a crafted import or update request. Affected branches are 11.7.x through 11.7.1, 11.6.x through 11.6.4, and 10.11.x through 10.11.19, where the server authorizes metric writes based on team membership alone rather than verifying that the referenced metric ID belongs to the playbook being saved. No public exploit code has been identified and this vulnerability does not appear in CISA KEV at time of analysis.
Insufficient sanitization of team objects in Mattermost's scheme teams API endpoint allows an authenticated user holding the User Manager role to extract invite links for private teams from API responses and use those links to join or redistribute access to those teams. Affected versions are 11.7.x through 11.7.2 and 10.11.x through 10.11.19. No public exploit identified at time of analysis and exploitation has not been confirmed by CISA KEV, but the low attack complexity (AC:L) means a malicious User Manager could reliably reproduce this without trial and error.
Missing authorization in Mattermost's /share-channel slash command autocomplete handler allows any authenticated user to enumerate remote cluster connection metadata, regardless of whether they hold the manage_shared_channels permission. Affects three active release lines (11.7.x, 11.6.x, 10.11.x) and is classified under CWE-862 (Missing Authorization). No public exploit identified at time of analysis, and the vulnerability is not listed in CISA KEV; exploitation is constrained to authenticated users, limiting realistic blast radius to insider threat or compromised-account scenarios.
Deactivated guest accounts in Mattermost 11.6.x through 11.6.4 and 11.7.x through 11.7.2 can regain platform access using magic-link tokens issued before deactivation, because the magic-link login path omits an account-status check during session creation. This directly undermines guest account revocation as an access control mechanism - administrators who deactivate a guest account expecting immediate exclusion will find the control is defeatable while any pre-issued token remains valid. No public exploit code has been identified at time of analysis, and this vulnerability is not listed in the CISA KEV catalog.
Catastrophic regex backtracking in Mattermost's client-side markdown parser can be triggered by an authenticated user posting a specially crafted message attachment, causing a denial-of-service condition for every user rendering that channel. Affected builds span versions 11.7.x through 11.7.2, 11.6.x through 11.6.4, and 10.11.x through 10.11.19. No public exploit has been identified at time of analysis and this vulnerability is not listed in CISA KEV, though the low exploitation complexity (AC:L, PR:L) lowers the bar for any authenticated insider or compromised account.
Incorrect authorization in Mattermost's interactive post action handler allows authenticated users to trigger post actions in private channels they are not members of. The flaw stems from action cookies failing to bind to the specific channel of the target post - a cookie obtained from any accessible channel can be reused against posts in restricted private channels. Affected are Mattermost versions 11.7.x through 11.7.2, 11.6.x through 11.6.4, and 10.11.x through 10.11.19; no public exploit has been identified and the vulnerability is not listed in CISA KEV.
Mattermost's channel patch API fails to enforce authorization on the group_constrained flag, permitting any authenticated low-privilege member of a group message or direct message channel to remove all participants from the conversation. All three supported release lines are affected: 11.7.x through 11.7.2, 11.6.x through 11.6.4, and 10.11.x through 10.11.19. No public exploit code has been identified at time of analysis; however, the low attack complexity and minimal privilege requirement make this straightforward to abuse on any reachable Mattermost deployment.
Incoming webhook impersonation in Mattermost allows a requester holding webhook management permissions to post content attributed to arbitrary users in teams or channels those users do not belong to. Affected deployments span three active release branches: 11.7.x through 11.7.2, 11.6.x through 11.6.4, and 10.11.x through 10.11.19. No public exploit code exists and the vulnerability is not listed in CISA KEV; the CVSS score of 4.9 correctly reflects that exploitation is constrained by the High privilege requirement, limiting realistic risk to insider threats or compromised privileged accounts.
Post ownership verification is absent in Mattermost's shared channel inbound sync handler, allowing an authenticated remote cluster to forge sync messages that modify or delete posts authored by local users or other federated remotes. Affected versions span the 10.11.x, 11.6.x, and 11.7.x release trains up to and including 10.11.19, 11.6.4, and 11.7.2 respectively. No public exploit has been identified and CISA KEV confirmation is absent, but the integrity impact is direct and the attack complexity is low once federation trust is established.
Mattermost fails to invalidate OAuth refresh tokens when a user account is deactivated, enabling former users - or any attacker who possesses a valid refresh token - to continue minting functional access tokens against the OAuth refresh token grant endpoint indefinitely after access revocation should have taken effect. All three actively maintained release branches are affected (10.11.x, 11.6.x, 11.7.x), making this a cross-branch session-persistence flaw with high confidentiality and integrity impact on any workspace relying on OAuth-integrated access control. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in CISA KEV, though the attack path requires minimal skill for any party already holding a refresh token.
Credential exposure in Mattermost Plugins (all branches ≤11.6, fixed in 10.18.11, 11.3.6, and 11.6.5.0) leaks valid or partially reconstructable OpenAI API keys into mattermost.log when the OpenAI API returns authentication failure responses. Any user with privileged read access to server logs or downloadable support packets can recover the key and authenticate to the victim organization's OpenAI account. No public exploit code or CISA KEV listing exists at time of analysis, but the CVSS Scope:Changed rating reflects that successful exploitation grants unauthorized access to an external, out-of-scope resource - the OpenAI account - with full confidentiality impact.
Server-side request forgery in the Mattermost Agents plugin MCP server (stdio mode) allows a low-privileged local attacker to make the server fetch arbitrary internal URLs submitted as file attachment references in post creation requests, enabling exfiltration of data from RFC 1918-addressed services on the internal network. Affected are Mattermost deployments running versions 10.11.x ≤ 10.11.18, 11.5.x ≤ 11.5.6, and 11.6.x ≤ 11.6.3 with the Agents plugin's MCP server active in stdio mode. No public exploit code or CISA KEV listing is present in the available data; exploitation is constrained to attackers who already have local access to the stdio MCP interface.
Markdown image rendering restrictions in Mattermost are bypassed specifically for AI bot tool result posts, enabling authenticated attackers to exfiltrate data to attacker-controlled infrastructure. Affected are Mattermost versions 10.11.x through 10.11.18, 11.5.x through 11.5.6, and 11.6.x through 11.6.3. When a victim's client renders an AI bot tool result post containing injected markdown image syntax, the client issues an outbound request to the attacker's server, leaking request metadata such as session tokens or channel context. No public exploit code exists and this vulnerability is not listed in the CISA KEV catalog at time of analysis.
Path traversal in Mattermost's Go server module allows authenticated remote attackers to redirect API calls to unintended endpoints by embedding path traversal components (e.g., '../') within crafted ID parameters. The affected library is github.com/mattermost/mattermost/server/public versions prior to v0.1.22, which fails to sanitize path parameters before constructing API route paths. Exploitation yields limited confidentiality and integrity impact (CVSS 5.4 Medium); no public exploit code and no CISA KEV listing have been identified at time of analysis.
Missing authorization in the Mattermost Google Drive plugin's file creation endpoint (all versions before 1.1.0) allows authenticated Mattermost users with a linked Google account to share Drive files into private channels they are not a member of, and to infer the existence and membership of those private channels. The root cause is CWE-862 (Missing Authorization): the endpoint processes the target channel ID supplied by the caller without verifying the caller belongs to that channel. No public exploit has been identified at time of analysis, and the vulnerability has not been added to the CISA KEV catalog.
Authenticated SAML users can join any team - including invite-only teams - on affected Mattermost servers because the application fails to verify the integrity of the SAML RelayState POST parameter, allowing the team_id or invite_id fields inside it to be forged. Exploitation requires the target instance to have SAML single sign-on configured and enabled, and the attacker must already hold valid SAML credentials for that instance (CVSS 3.1: AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N, 7.1); no victim interaction is needed. Impact is bounded to unauthorized team membership rather than administrative takeover. No public exploit code has been identified at time of analysis and the issue is not in CISA KEV, so this is a moderate-priority, authentication-gated authorization flaw rather than a mass-exploitation emergency; no EPSS score was provided in the available intelligence.
OAuth Dynamic Client Registration redirect URI validation bypass in Mattermost 11.7.x (through 11.7.7), 11.8.x (through 11.8.4) and 11.9.0 lets a remote unauthenticated attacker register an OAuth client whose attacker-controlled callback host evades the configured redirect URI allowlist, so authorization responses can be sent to a host the attacker controls. The CVSS vector (AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N, score 9.3) confirms no authentication is needed to register the client, but a legitimate user must still be induced to complete the OAuth authorization flow for the malicious client, which makes the attack non-automatable per SSVC (Exploitation: none, Automatable: no) despite a total technical impact rating. No public exploit code was identified at time of analysis, the issue is not in CISA KEV, and EPSS is low at 0.28% (roughly 20th percentile); the practical risk is a serious but not urgent credential/interception exposure confined to deployments that expose OAuth with Dynamic Client Registration.
Missing authorization in Mattermost's playbook run creation allows authenticated channel members to add arbitrary users to restricted channels by abusing the run owner field. Affected versions span three active release trains (11.9.x, 11.8.x, 11.7.x) and the LTS branch (10.11.x). An attacker with only channel-member access can silently bypass channel membership-management permissions to grant themselves or others access to content they are not authorized to view, producing a confidentiality exposure rated C:H in the CVSS vector. No public exploit code or CISA KEV listing has been identified at time of analysis.
SSRF vulnerabilities in AWX notification backends (webhook, Mattermost, Rocket.Chat, and Grafana) allow an authenticated organization notification administrator to cause the AWX control node to issue outbound HTTP requests to internal, loopback, or RFC-1918 addresses that are not externally reachable. Beyond basic SSRF, the webhook backend compounds the risk by following HTTP redirects and replaying configured Basic Authentication credentials to the redirect destination regardless of host change, enabling credential exfiltration to attacker-controlled endpoints; the Grafana backend similarly exposes its API key by forwarding the Authorization header verbatim to any configured target URL. No public exploit has been identified at time of analysis, but the Changed scope and high confidentiality impact in the CVSS vector reflect significant real-world risk given the network position AWX control nodes typically occupy.
Incorrect authorization in Mattermost's Boards component across versions 11.7.x through 11.7.6, 10.11.x through 10.11.21, and 11.8.x through 11.8.3 enables privilege escalation within board management. Board editors and non-guest team members can supply arbitrary values in BoardMember.Scheme* fields through the boards member API or archive-import endpoint, effectively granting board admin rights to any user without server-side enforcement. No public exploit has been identified at time of analysis, and the vulnerability is not listed in the CISA KEV catalog.
Denial of service in linkify-it (npm) through v5.0.0 lets remote unauthenticated attackers wedge a rendering worker by submitting tens of KB of repeated email/link-like text. The core public API LinkifyIt.prototype.match runs an O(N²) scan loop that re-slices the input and re-runs unanchored fuzzy regex searches once per match, so 64 KB of "a@b.com" burns ~2.5 s of single-threaded CPU and 128 KB ~10 s. The flaw is inherited by markdown-it (~21.6M weekly npm downloads) whenever linkify:true is set, exposing forums, chat, wikis and AI chat UIs; publicly available exploit code (a PoC in the GHSA advisory) exists, but there is no evidence of active exploitation.
Credential leakage in Mattermost Desktop App versions up to 6.1 and 5.5.13.0 allows authenticated server users to harvest NTLM credentials from other users by embedding images that resolve to attacker-controlled external web servers. The client fails to enforce a strict domain allow list before forwarding Windows NTLM authentication challenges, so any post in a server without the image proxy enabled becomes a credential capture vector. No public exploit identified at time of analysis and EPSS is low (0.18%), but the scope-change CVSS of 7.7 reflects cross-user impact.
Arbitrary file write in Mattermost via path traversal affects versions 11.6.x ≤ 11.6.1, 11.5.x ≤ 11.5.4, and 10.11.x ≤ 10.11.15/10.11.16 when shared channels with federated peers are in use. An attacker who controls a federated Mattermost server can supply crafted FileInfo.Name values during file sync to write files to arbitrary locations in the target server's filestore. No public exploit identified at time of analysis and the issue is not listed in CISA KEV.
Privilege escalation in Mattermost server (11.6.x, 11.5.x, and 10.11.x branches) allows a low-privileged user holding group-link permissions to promote themselves or other group members to team or channel administrator by setting the scheme_admin flag through group syncable link and patch API endpoints. The flaw stems from missing role-management authorization checks, and with a CVSS of 8.8 (network, low complexity, low privileges) it enables tenant-wide takeover of collaboration workspaces; no public exploit identified at time of analysis.
Privilege escalation in Mattermost collaboration platform allows authenticated users holding delegated user-management permissions to modify built-in system role permissions via the role patch API, bypassing a required system-level permission check. Affects Mattermost 10.11.x through 10.11.16, 11.5.x through 11.5.4, and 11.6.x through 11.6.1. No public exploit identified at time of analysis; EPSS is very low (0.03%) and the SSVC framework reports no observed exploitation.
Arbitrary file write in Mattermost Plugins (versions ≤1.1.5) lets an administrator of a remote, federated Mattermost server plant files at attacker-chosen paths inside the target server's filestore by supplying a malicious, unsanitized filename through the shared-channel attachment sync protocol. The flaw stems from CWE-22 path traversal in the export-path construction logic and carries CVSS 8.0 with a changed scope, reflecting that a compromised or hostile federation peer can affect resources beyond the plugin's intended boundary. There is no public exploit identified at time of analysis, and CISA's SSVC framework records exploitation status as 'none' but technical impact as 'total'.
Broken object-level authorization in the Mattermost Boards feature lets an authenticated low-privileged user retrieve and download files owned by other users or teams by supplying valid file IDs in crafted Boards API requests. Affected self-hosted builds span the 10.11.x, 11.4.x, 11.5.x and 11.6.x branches. There is no public exploit identified at time of analysis and EPSS is very low (0.03%), but the flaw is a straightforward IDOR yielding high-confidentiality impact across team/tenant boundaries.
Denial of service in Mattermost server (versions 11.6.0, 11.5.0-11.5.3, 11.4.0-11.4.4, and 10.11.0-10.11.14) allows remote attackers to crash the server process by sending a crafted msgpack-encoded binary WebSocket frame to the public endpoint. The flaw stems from missing validation of frame sizes before memory allocation, enabling a full service outage for all users. No public exploit identified at time of analysis, and the CVSS 7.5 score reflects the unauthenticated network-reachable nature of the attack with high availability impact.
Denial of service in Mattermost self-hosted server (versions 11.6.0, 11.5.x ≤11.5.3, 11.4.x ≤11.4.4, and 10.11.x ≤10.11.14) allows remote unauthenticated attackers to exhaust server resources by sending oversized HTTP requests to plugin endpoints, which fail to enforce request body size limits. There is no public exploit identified at time of analysis, and the EPSS score is very low (0.04%, 11th percentile), but the flaw is remotely reachable without authentication and a vendor patch is available. Impact is limited to availability - no data disclosure or integrity loss.
Privilege escalation to full administrative control in Mattermost self-hosted server (versions 11.6.0 and earlier in the 11.6.x line, 11.5.3 and earlier, 11.4.4 and earlier, and 10.11.14 and earlier) allows a low-privileged authenticated user to abuse missing path-traversal validation on integration action URLs to invoke arbitrary internal APIs using the system administrator's Mattermost auth token. Because the request is executed with the admin token, the attacker effectively gains total control over the instance despite starting as an ordinary user. There is no public exploit identified at time of analysis, and the EPSS score is very low (0.03%), but the vendor-assigned CVSS of 9.9 reflects the severe privilege-crossing impact.
Mattermost versions up to 11.5.1 expose sensitive credentials in plaintext within support packets due to insufficient sanitization of configuration fields. System administrators or anyone with access to support packets can obtain database passwords, API keys, and other sensitive credentials by downloading support packets from the System Console. The vulnerability affects multiple version branches (10.11.x, 11.4.x, 11.5.x) and poses significant risk for credential theft and lateral movement.
Information disclosure in Mattermost Calls plugin versions 11.5.x <= 11.5.1, 10.11.x <= 10.11.13, 11.4.x <= 11.4.3 exposes TURN server credentials through support packets. Administrators with support packet access can extract plaintext credentials from exported plugin configurations, potentially compromising the WebRTC infrastructure used for voice/video calls. The vulnerability requires high privileges (admin) but affects confidentiality across trust boundaries (CVSS Scope:Changed).
Authorization bypass in Mattermost Plugin Legal Hold versions <=1.1.4 allows authenticated attackers to manipulate legal hold data without proper permission validation. After failed authorization checks, the plugin continues processing requests instead of terminating them, enabling low-privileged authenticated users to access, create, download, and delete sensitive legal hold data through direct API calls. This represents a critical failure in access control enforcement for compliance-critical data. EPSS data not available; no confirmed active exploitation (CISA KEV) or public exploit code identified at time of analysis.
Mattermost's mmctl command-line administration tool fails to sanitize ANSI and OSC escape sequences embedded in user-generated post content, enabling authenticated low-privilege attackers to inject malicious terminal control codes when administrators export or query messages. Exploitation allows screen manipulation, fake prompt injection, and clipboard hijacking against administrators running mmctl commands, potentially leading to secondary code execution if administrators are tricked into running injected commands. CISA SSVC framework indicates no current exploitation, non-automatable attack requiring high complexity and user interaction, but with total technical impact potential.
Mattermost 10.11.x through 11.3.x fails to validate password length, allowing unauthenticated attackers to trigger denial of service by submitting multi-megabyte passwords during login attempts that consume excessive CPU and memory resources. The vulnerability affects all versions up to 10.11.10, 11.2.2, and 11.3.0, with no patch currently available.
A sensitive information disclosure vulnerability in Mattermost Plugins versions 2.0.3.0 and earlier fails to properly mask sensitive configuration values in support packets, allowing attackers with high privileges to extract original plugin settings from exported configuration data. The vulnerability requires authenticated access with high privileges (CVSS 7.6) and enables attackers to obtain sensitive configuration data that should be masked, potentially exposing API keys, credentials, or other sensitive plugin configurations. No active exploitation or proof-of-concept has been reported, and the vulnerability requires significant access privileges to exploit.
Authenticated Mattermost users can degrade message post-processing latency for every member of the channels they share by storing an oversized list of custom mention keywords (notify_props.mention_keys) on their own profile, which the server then matches against each post. Because the matching routine scales quadratically and multibyte/Unicode keywords add per-character cost, and neither the number nor the size of stored keywords is capped, each post the attacker's channel peers send or receive is processed far more expensively on the attacker's behalf. Impact is confined to availability degradation (CVSS 4.3, AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L; CWE-770); no data exposure or crash is involved, valid authentication plus at least one shared channel is required, and no public exploit has been identified at time of analysis.
Information disclosure in Mattermost release lines 11.7.x, 11.8.x, 11.9.x and 11.10.x (up to 11.7.10, 11.8.5, 11.9.1 and 11.10.1 respectively) allows an authenticated user to learn the channel ID of a private channel that another user is actively viewing. The user status API endpoints return an unsanitized active-channel field, so any provisioned account on the same server - with no membership in the target private channel, which is precisely the flaw - can query another user's status and observe which private channel that user is currently reading. The exposure is limited to the channel identifier itself, not its contents, name or membership, but it still reveals the existence of private channels and correlates named users with sensitive collaboration spaces. Rated CVSS 4.3 (AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N), this is a low-to-moderate urgency issue rather than an emergency, and no public exploit has been identified at time of analysis.
Mattermost 11.7.x through 11.10.x fails to invalidate the stored AD/LDAP bind password whenever other connection settings - such as the directory server address - are changed in the System Console, so the previously saved plaintext credential is carried over to the new configuration. An authenticated System Console administrator (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N, base 4.9) can then trigger the LDAP Test Connection / diagnostics feature, which transmits that retained plaintext bind password to the configured server address, potentially an attacker-controlled host set by the same admin. There is confirmed no CISA KEV entry and no public exploit identified at time of analysis, and no EPSS score was supplied; exploitation is gated behind high-privilege System Console access, an existing AD/LDAP integration with a stored bind password, and the deliberate admin action of pointing the connection at a hostile host, making this a genuine but moderate-priority confidentiality issue rather than an emergency.
Mattermost Server versions 11.7.x through 11.10.x can disclose the stored client secret of an outgoing OAuth connection to an attacker who holds the administrative permission to manage those connections. The platform fails to require re-entry of the stored secret during connection validation, so an authenticated high-privileged user can repoint the connection's token URL at an attacker-controlled endpoint and trigger validation, causing the secret to be sent to that endpoint (CWE-201, information disclosure). Our assessment rates this CVSS 6.5 (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N), with the practical risk tempered by the privilege prerequisite - the feature must be enabled and at least one outgoing OAuth connection with a stored secret must already exist; no public exploit was identified at time of analysis and there is no KEV listing. Exploitation is remote, requires no victim interaction, and yields confidentiality impact only (no integrity or availability impact).
Authenticated users on Mattermost Server 11.7.x through 11.10.0 can quarantine posts inside direct and group messages they are not participants of by issuing a direct API call to the post-quarantine endpoint, because the server performs no DM/GM membership or authorization check before processing the request (CWE-862, Missing Authorization). The flaw is remotely reachable over the network but requires a valid low-privileged account (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L per the assessed vector), and the realistic impact is improper manipulation of the moderation/quarantine state of DM and GM posts rather than disclosure of message contents or full data compromise. There is no public exploit identified at time of analysis and no confirmed active exploitation (no CISA KEV entry); this is a moderate-severity authorization weakness that Mattermost tracks under advisory MMSA-2026-00756.
Authenticated guest accounts on Mattermost 11.7.x through 11.7.9, 11.8.x through 11.8.5, 11.9.x through 11.9.1, and 11.10.0 can be escalated to team or channel administrator by abusing the member roles API endpoint, which fails to validate a crafted combination of guest and admin scheme roles. The flaw requires only a valid guest login and network reachability to the API, so any server that provisions guest accounts is exposed, though no public exploit code or confirmed active exploitation has been identified at time of analysis. Vendor advisory MMSA-2026-00752 tracks the issue, and Mattermost has published it on its security updates page.
Mattermost servers running 11.7.x through 11.7.9, 11.8.x through 11.8.5, 11.9.x through 11.9.1, and 11.10.x through 11.10.0 fail to restrict Slack import account binding to system-administrator-initiated imports, so an authenticated attacker holding team admin privileges can force-add existing Mattermost users to their own team and then forge posts attributed to those users' identities. The attacker only needs to be an authenticated insider with the team-admin role and to supply a crafted Slack export archive containing the target users' email addresses; no victim interaction is required (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N, base score 4.3). Impact is confined to integrity - unauthorized team membership and identity-forged content - with no confidentiality loss or availability impact, and there is no public exploit identified at time of analysis and no CISA KEV listing, making this a moderate-priority insider-abuse issue rather than an urgent remote-code-execution or data-breach emergency.
Memory exhaustion in Mattermost (versions 11.10.x through 11.10.0, 11.7.x through 11.7.9, 11.8.x through 11.8.5, and 11.9.x through 11.9.1) allows an authenticated, low-privilege user to drive the server to buffer an arbitrarily large remote image response in memory by making the local image proxy perform a direct fetch from an attacker-controlled endpoint, degrading or crashing the instance. The defect is a missing size limit on the buffered response (CWE-770), and impact is confined to availability - there is no confidentiality or integrity loss, and no data disclosure or modification occurs. Rated CVSS 6.5 (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H); exploitation requires a valid low-privilege account and a configuration in which the local image proxy performs direct remote image fetches, and no public exploit identified at time of analysis, though a structured advisory (MMSA-2026-00726) is published.
Private team metadata in Mattermost Server can be enumerated by any authenticated user who lacks the permission to list private teams, because the team search functionality fails to exclude private teams from public search results. An attacker with a valid low-privileged account can send a modified team-search request and retrieve the ID, name, and display name of private teams they are not authorized to see. The issue affects Mattermost 11.7.x through 11.7.9, 11.8.x through 11.8.5, 11.9.x through 11.9.1, and 11.10.x through 11.10.0, and is rated low severity (CVSS 3.1 4.3, AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N) with only metadata disclosure - no message content, membership lists, or credentials are exposed; no public exploit was identified at time of analysis.
Mattermost versions 11.10.x through 11.10.0, 11.7.x through 11.7.9, 11.9.x through 11.9.1, and 11.8.x through 11.8.5 fail to validate the invited recipient's email address when redeeming team or guest invitation tokens, enabling an authenticated user who obtains a forwarded or leaked invite link to join a team or access private channels without authorization. The flaw is rated CVSS 5.0 (moderate severity) and requires an attacker with an existing authenticated account plus a valid, unredeemed invitation token originally issued to a different email address; no victim user interaction is needed. No public exploit code or confirmed active exploitation has been identified at time of analysis, and the vendor advisory is MMSA-2026-00747.
Account takeover in Mattermost 11.7.x through 11.10.0 lets an authenticated attacker who already holds a valid OAuth bearer token for a specific target user permanently hijack that user's SSO-backed account: the POST /api/v4/users/login/switch endpoint fails to reject OAuth application sessions, so the attacker can switch the account to password authentication, set an attacker-controlled password, and detach the account from its identity provider (CWE-863 Incorrect Authorization; CVSS 4.4, CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:H/A:N). Exploitation is heavily constrained - the victim must have an identity-provider-backed account, the attacker must obtain a victim-scoped OAuth token (typically by getting the user to authorize a malicious OAuth application), attack complexity is assessed as high, and deployments without SSO or OAuth applications are not exposed. No public exploit identified at time of analysis, and there is no confirmed active exploitation (Mattermost advisory MMSA-2026-00758).
Flagged-post review status in Mattermost can be inferred by authenticated users who lack content-reviewer permissions, because the affected API performs other validations before checking the caller's permissions, producing a distinguishable response for flagged versus unflagged posts. The issue affects 11.10.x through 11.10.0, 11.9.x through 11.9.1, 11.8.x through 11.8.5, and 11.7.x through 11.7.9 (advisory MMSA-2026-00754), and exploitation requires a valid account on a deployment that actually uses the post-flagging/moderation feature, with attacker access limited to a single binary signal and no exposure of post content or reviewer details. Rated CVSS 4.3 (AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N); no public exploit identified at time of analysis, and this is a genuinely low real-world priority.
Debug-level logging in Mattermost Server can write authentication secrets - session tokens and OAuth access tokens - into server log entries without sanitization, allowing anyone who can read those logs to impersonate authenticated users. Affected releases are 11.7.x through 11.7.10, 11.8.x through 11.8.5, 11.9.x through 11.9.1, and 11.10.x through 11.10.1 (Mattermost advisory MMSA-2026-00763); the vendor scores it 4.5 (MEDIUM) under CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:N/A:N. Exploitation is prerequisite-heavy rather than opportunistic: the server must be running with debug-level logging (not the default production setting) and the attacker must already hold read access to those logs via filesystem access, a centralized log/SIEM viewer role, or a compromised log pipeline, and the assessed vector (AV:L/AC:H/PR:H/UI:N) reflects that local, high-privilege access barrier. There is no public exploit identified at time of analysis and no KEV listing; impact is confidentiality-only, as stolen tokens enable user impersonation while the flaw itself produces no direct integrity or availability loss.
Information disclosure in Mattermost (versions 11.7.x through 11.7.9, 11.8.x through 11.8.5, 11.9.x through 11.9.1, and 11.10.0) allows an authenticated member of a channel to recover the server-side webhook URLs and authentication secrets embedded in interactive-message posts. The server fails to strip action integration secrets before broadcasting the post_deleted WebSocket event and before returning thread API responses, so a channel member who deletes or observes deletion of an interactive-message post - or simply reads the threads REST API - can harvest credentials intended to stay server-side. Exploitation requires a valid authenticated account with membership in a channel that actually uses interactive message/action integrations, and there is no public exploit identified at time of analysis; the issue is a moderate-severity confidentiality exposure rather than an urgent emergency, with an assessed CVSS of 6.5 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N).
Authenticated users of any privilege level on Red Hat Ansible Automation Platform 2 automation-controller deployments can extract other tenants' notification secrets-PagerDuty service keys and Slack, Mattermost, RocketChat, and generic Webhook bearer-token URLs-by abusing the API filter backend as a boolean count-oracle. The attack requires only a low-privilege account (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N, base 6.5), is network-reachable and low in complexity, and yields high confidentiality impact with no integrity or availability effect. Impact is greatest in multi-tenant installations where recovered secrets break organization isolation and permit notification-channel impersonation; exploitation is inherently slow, requiring many iterative requests that may be visible in API logs. No public exploit code has been identified at time of analysis, and the flaw is not listed as confirmed actively exploited (CISA KEV).
Memory exhaustion denial of service in Mattermost 11.7.x through 11.10.x allows an authenticated user to send oversized request bodies to plugin endpoints because the CSRF-validation path fails to enforce a request body size limit. The affected ranges are 11.7.x up to and including 11.7.10, 11.8.x up to and including 11.8.5, 11.9.x up to and including 11.9.1, and 11.10.x up to and including 11.10.1. This is an availability-only issue rated CVSS 6.5, with authentication required (PR:L) and no public exploit identified at time of analysis.
Server-side request forgery in Mattermost (11.7.x through 11.7.10, 11.8.x through 11.8.5, 11.9.x through 11.9.1, and 11.10.x through 11.10.1) allows an authenticated System Administrator to set the OAuth token or userinfo endpoint to an internal network address, causing the Mattermost server to issue that request because the platform's internal-connection filter is not applied to OAuth endpoint traffic, and then read the internal response back through the configured OAuth flow. Impact is bounded: the attacker must already hold the highly-trusted System Administrator role (CVSS PR:H), confidentiality and integrity effects are Low with no availability impact, and the flaw only matters where the Mattermost server has network reachability to sensitive internal services. There is no public exploit identified at time of analysis, no CISA KEV listing, and the vendor CVSS of 5.5 (Medium) is well-calibrated - this is a genuinely low-priority issue despite the CWE-918 classification. The assessment vector CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N matches the vendor.
Server-side request forgery in Novu prior to 3.18.0 allows an authenticated user to make the notification worker issue attacker-directed POST requests to internal or otherwise restricted network services by supplying a chat webhook URL through subscriber credentials.webhookUrl, channel endpoint.url, event payload.webhookUrl, or event overrides.webhookUrl. The Slack, Discord, Mattermost, Microsoft Teams, Grafana On-Call, Ryver, Rocket.Chat, GetStream, and Zulip chat providers pass that URL straight into raw HTTP requests in send-message-chat.usecase.ts without the normalizeOutboundHttpUrl, assertSafeOutboundUrl, or DNS-pinned safeOutboundJsonRequest guards that protect Novu's generic webhook providers, resulting in a largely blind, POST-only SSRF whose impact is bounded to interactions or actions offered by the reached internal service (CVSS 5.3; assessed CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N). Exploitation requires a valid authenticated account and worker-level network reachability to the intended target; no public exploit code has been identified at time of analysis and there is no confirmation of active exploitation (CISA KEV). The issue is fixed in version 3.18.0.
Authenticated Mattermost users can drive excessive database load by submitting an oversized post ID array to the bulk reactions endpoint POST /api/v4/posts/ids/reactions, because Mattermost does not enforce a server-side length cap on that array (CWE-770). The flaw affects 11.7.x through 11.7.10, 11.8.x through 11.8.5, 11.9.x through 11.9.1, and 11.10.x through 11.10.1, requires only a valid account with API access (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L, 4.3), and has availability-only impact, meaning a single crafted request causes transient load rather than a persistent outage. There is no public exploit identified at time of analysis and no CISA KEV listing, so this is a low-to-moderate operational risk rather than a critical priority.
IPC sender-origin spoofing in the Mattermost Desktop App (versions up to and including 6.2.2.0) lets an attacker-controlled server view send a desktopAPI.leaveCall message that tears down an active call belonging to a different, trusted server connected in the same client. Exploitation is unauthenticated from the attacker's perspective (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L, score 3.8 Low) but requires the victim to be running a multi-server configuration with a live call on one server while another connected server is malicious, compromised, or grants the attacker script access; single-server clients and users with no call in progress are unaffected. Impact is limited to call disruption - no data exposure, no code execution - and no public exploit identified at time of analysis; this is a low-priority, low-impact issue.
Mattermost Desktop App versions up to and including 6.2.2.0 fail to validate the URL scheme when deciding whether a link points to an internal server resource, so a network-positioned attacker who can intercept and downgrade the connection can make the client open a plugin popout window over an insecure (non-TLS) connection. Exploitation is narrow: it requires a man-in-the-middle position capable of forcing the scheme downgrade, an authenticated user of the affected client (PR:L per the CVSS vector), and that user clicking a crafted internal link (UI:R), which is why the vendor and independent scoring both land in the low range (vendor 2.6; independently assessed AV:A/AC:H). There is no indication of active exploitation and no public exploit code identified at time of analysis; the realistic impact is limited to integrity of the content rendered in the popout window, with no confidentiality or availability effect.
Insufficient origin validation in the Mattermost Desktop App (versions up to and including 6.2.2.0) lets server-rendered content from an untrusted or compromised Mattermost server reach local or private network resources, giving the attacker a limited information-disclosure window. Exploitation is not remote-only: the victim must be running the desktop client and actively connect to and view content from an attacker-controlled server (CVSS 4.7, AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:N/A:N), and only confidentiality is affected - there is no integrity or availability impact. Mattermost credits game0v3r under its responsible disclosure policy (MMSA-2026-00698); there is no confirmed active exploitation (not in CISA KEV) and no public exploit identified at time of analysis, so overall risk is moderate and low priority.
Mattermost's data retention teams API endpoint fails to sanitize returned Team objects, exposing private teams' secret `invite_id` and email fields to any authenticated user holding only the read-only Data Retention Policy permission. An attacker exploiting CVE-2026-91181 can call `GET /api/v4/data_retention/policies/{policy_id}/teams`, harvest the `invite_id` of private teams they have no membership in, and use it to join those teams without authorization - effectively achieving lateral movement across private channels and communications. No public exploit code has been identified and the vulnerability is not listed in CISA KEV at time of analysis.
Mattermost's access control policy update endpoint fails to enforce role-based authorization boundaries, enabling a channel or team administrator to detach a system-assigned ABAC parent policy by issuing a crafted PUT /api/v4/access_control_policies request with an empty imports list. Affected are Mattermost versions 11.9.0, 11.8.x through 11.8.4, and 11.7.x through 11.7.7, per vendor advisory MMSA-2026-00724. No public exploit identified at time of analysis, and SSVC assessment confirms no known exploitation with partial technical impact.
Plugin handler panic recovery failure in Mattermost allows authenticated users to crash installed plugins by sending a post-action request containing a field with an unexpected type. Affected versions span multiple maintained release branches (≤11.9, 11.0.9, 11.4.8, 11.7.7, 10.22.11.0) as disclosed under MMSA-2026-00701. No public exploit code or active exploitation has been identified; impact is bounded to plugin availability disruption with no confidentiality or integrity exposure.
Mattermost's server-side Markdown parser across versions 10.11.x through 11.9.0 fails to enforce a nesting depth limit, allowing any authenticated user to cause CPU resource exhaustion by posting a message containing pathologically deep blockquote or list item nesting. The vulnerability is classified CWE-407 (Inefficient Algorithmic Complexity), producing a denial-of-service condition that degrades availability for all users of the affected instance. With a vendor-confirmed CVSS of 4.3 (Medium), no active exploitation, and SSVC marking it non-automatable, this represents a moderate insider or compromised-account risk rather than an urgent external threat. No public exploit code or CISA KEV listing identified at time of analysis.
The Microsoft Calendar plugin in Mattermost fails to validate null entries in incoming Microsoft Graph webhook payloads, enabling any unauthenticated remote attacker to crash the plugin process by sending a single crafted POST request to the public webhook endpoint. Affected are Mattermost versions 11.9.0, 11.8.x through 11.8.4, 11.7.x through 11.7.7, and 10.11.x through 10.11.22. No public exploit code or active exploitation has been identified; however, SSVC classifies this as automatable, meaning the denial-of-service condition can be triggered reliably and at scale without special tooling.
The Boards plugin in Mattermost fails to validate the data type of `fields.properties` during block creation, enabling any authenticated user holding editor-level access on a board to crash the Boards plugin worker via a malformed child block. Four release branches are affected (10.11.x, 11.7.x, 11.8.x, 11.9.x). No public exploit has been identified, SSVC rates exploitation as none and the attack as non-automatable, and the CVSS 4.3 Medium score is consistent with a bounded, privilege-gated availability impact.
Mattermost's Playbooks plugin can be crashed by an authenticated user via a malformed REST request that references a property field belonging to a different run than specified. Affected versions span the 10.11.x, 11.7.x, 11.8.x, and 11.9.x release branches, per vendor advisory MMSA-2026-00684. No active exploitation has been identified, and impact is scoped to availability loss of the Playbooks plugin rather than the core Mattermost server.
Mattermost server crashes or becomes unavailable when an authenticated user sends multiple SDP messages compressed with zlib that decompress to arbitrarily large sizes, exploiting the absence of any decompressed-size cap. Affected are all Mattermost instances running versions 11.9.0, 11.8.4 and earlier in the 11.8.x line, 11.7.7 and earlier in the 11.7.x line, and 10.11.22 and earlier in the 10.11.x line. No public exploit code has been identified at time of analysis, and the CVE has not been added to the CISA KEV catalog.
Unbounded memory allocation during image decoding in Mattermost 10.11.x through 11.9.x allows any authenticated user to trigger a denial-of-service condition against the server. By uploading a specially crafted image - such as a decompression bomb - through any of several upload surfaces (profile picture, channel file attachment, team icon, or custom brand image), an attacker can cause the Mattermost server process to exhaust available memory. No public exploit code or active exploitation has been identified at time of analysis; the vendor addressed this under advisory MMSA-2026-00719.
Missing channel action ownership validation in Mattermost allows an authenticated channel manager to overwrite workflow automation actions belonging to channels outside their management scope via the channel action update API endpoint. Affected releases span four active branches: 10.11.x through 10.11.22, 11.7.x through 11.7.7, 11.8.x through 11.8.4, and 11.9.0. No public exploit code has been identified and CISA has not listed this in KEV; the SSVC assessment records exploitation as none with non-automatable attack mechanics.
Board-creation permission enforcement is absent from three Mattermost Boards API endpoints-board duplicate, boards-and-blocks, and archive-import-allowing any authenticated user who has been denied board-creation rights to circumvent that restriction and create boards in the workspace. Affected are Mattermost versions 11.9.0, 11.8.x through 11.8.4, 11.7.x through 11.7.7, and 10.11.x through 10.11.22, as confirmed by advisory MMSA-2026-00715. No public exploit code has been identified and this CVE does not appear in the CISA KEV catalog; real-world impact is limited to unauthorized board creation with no confidentiality or availability consequence.
Mattermost's server-side Markdown autolink parser processes autolinks with unmatched trailing closing parentheses in superlinear time, enabling any authenticated user with post-creation rights to cause excessive CPU consumption and degrade availability for all users on the instance. Affected release trains are 11.9.x through 11.9.0, 11.8.x through 11.8.4, 11.7.x through 11.7.7, and 10.11.x through 10.11.22 across both cloud and self-hosted deployments. No public exploit code has been identified at time of analysis, and this CVE is not listed in CISA KEV, but the low exploitation barrier - any authenticated account - means insider threat or compromised-account scenarios are the primary realistic risk.
Resource exhaustion in Mattermost's file processing pipeline allows any authenticated user with file upload permissions to spawn unbounded goroutines by continuously uploading large files, degrading or blocking the file indexing service for all other users. Affected versions span the 10.11.x, 11.7.x, 11.8.x, and 11.9.x release trains. The vulnerability stems from two compounding defects: absence of a concurrent-file-processing cap and improper handling of failed file ingestion, together enabling goroutine accumulation in Mattermost's Go runtime. No public exploit code exists and no active exploitation has been identified at time of analysis.
Permission enforcement failure in Mattermost Boards allows authenticated non-guest team members to create Open or Private boards in defiance of administrator-imposed restrictions by importing a crafted .boardarchive file. The import code path omits the authorization check enforced by the direct board creation pathway, making administrative board creation controls bypassable by any authenticated non-guest user with import access. Affected versions span the 10.11.x, 11.7.x, 11.8.x, and 11.9.x release trains; no active exploitation has been identified and no public exploit code is known at time of analysis.
Incorrect authorization in Mattermost Boards allows an authenticated board editor to relink any editable board to an arbitrary channel by exploiting a missing PermissionManageBoardRoles check on the channelId field of the batch endpoint. Affected are Mattermost versions 11.7.x through 11.7.6, 10.11.x through 10.11.21, and 11.8.x through 11.8.3 (advisory MMSA-2026-00686). No public exploit code or CISA KEV listing has been identified at time of analysis, but the low attack complexity and network accessibility make this straightforward to execute for any authenticated board editor.
Denial of service in Mattermost's Boards (focalboard) plugin allows any authenticated user to crash the plugin process and disrupt Boards availability for all users on the instance by sending a single malformed WebSocket message. The root cause is absent input validation on the teamId field type in custom_focalboard_SUBSCRIBE_TEAM WebSocket commands, classified under CWE-704 (Incorrect Type Conversion). Affected versions span 11.7.x through 11.7.6, 10.11.x through 10.11.21, and 11.8.x through 11.8.3; no public exploit has been identified at time of analysis.
Mattermost Desktop App versions through 6.2.2.0 expose the pre-auth server secret in plaintext within generated diagnostics reports, specifically in the Server Connectivity Step-3 output section. A local attacker who obtains a copy of a user's diagnostics report or log files - whether through filesystem access or social engineering - can extract this secret and use it to authenticate against the configured Mattermost server as a pre-authorized client. No active exploitation has been confirmed (not in CISA KEV) and no public exploit code has been identified at the time of analysis; the risk is realistic primarily in shared-workstation or insider-threat scenarios.
Incomplete cleanup of thread membership records in Mattermost allows a re-invited user to read private channel thread root post content and metadata they should no longer have access to. Affected are all Mattermost deployments on versions 10.11.x through 10.11.20 and 11.7.x through 11.7.5. An authenticated user who was previously removed from or left a team, and is subsequently re-invited, can exploit stale membership records via the team threads API to access residual private channel thread data. No public exploit identified at time of analysis, and this vulnerability is not listed in the CISA KEV catalog.
Unauthorized message injection in the Mattermost GitLab Plugin (<=11.8) allows authenticated users to post bot-authored messages containing arbitrary URLs into restricted channels by exploiting two missing authorization checks: channel permission verification on the caller-supplied `post_id` parameter, and GitLab instance validation of the `web_url` parameter. Exploitation targets the `createIssue` and `attachCommentToIssue` API endpoints without requiring elevated privileges. No active exploitation is confirmed by CISA KEV and no public exploit code has been identified at time of analysis, but the low attack complexity and authenticated-only prerequisite make this a realistic internal threat in any Mattermost deployment running the GitLab integration.
Privilege escalation in Mattermost's channel administration API allows authenticated channel administrators to assign non-channel-scoped roles to channel members, exceeding their intended authorization boundary. Three active release lines are affected: 10.11.x through 10.11.21, 11.7.x through 11.7.6, and 11.8.x through 11.8.2. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in the CISA KEV catalog.
Private channel membership disclosure in Mattermost's Boards feature allows any authenticated team member to enumerate who belongs to private channels they are not authorized to view. Affected across three concurrently maintained release trains - 11.7.x through 11.7.6, 10.11.x through 10.11.21, and 11.8.x through 11.8.3 - the flaw is exploitable by any valid team account via standard board management API calls. No public exploit or active exploitation has been identified at time of analysis; the CVSS score of 4.3 (PR:L, C:L) accurately reflects the limited but real confidentiality impact, particularly meaningful in regulated environments where private channel membership itself is sensitive.
Mattermost's Playbooks feature in versions 11.7.x through 11.7.6 and 10.11.x through 10.11.21 omits run-state enforcement on API write operations, allowing any authenticated run participant to alter completed playbook runs via REST and GraphQL endpoints. An attacker with low privileges can overwrite status, checklists, retrospective content, ownership, and participant lists on runs that should be immutable once finished, undermining post-incident audit integrity. No public exploit has been identified at time of analysis, and the vulnerability is not listed in the CISA KEV catalog.
Incorrect authorization in Mattermost's OAuth and personal access token management endpoints allows an OAuth application holding a delegated user token to call account-management endpoints beyond its intended scope, revoking the victim user's authorizations or tokens for unrelated integrations. Affected are Mattermost 11.7.0 through 11.7.6 and 10.11.0 through 10.11.21. No public exploit code has been identified and this vulnerability is not listed in the CISA KEV catalog, though the low-complexity, network-accessible nature of the flaw makes it straightforward to abuse for any actor who has legitimately obtained an OAuth delegated token.
Privilege escalation in Mattermost's Boards feature allows a low-privileged board member to elevate a guest user to Board Admin by importing a specially crafted .boardarchive file. Affected are Mattermost versions 10.11.0 through 10.11.21 and 11.7.0 through 11.7.6. No public exploit or KEV listing has been identified, but the low attack complexity and the insider-threat profile make this a meaningful risk in multi-tenant or externally-collaborative Mattermost deployments.
Incorrect authorization in Mattermost's ABAC policy unassign API endpoint allows an authenticated team administrator to remove attribute-based access control policy assignments from channels that no longer belong to their team. Affected releases are Mattermost 11.7.0 through 11.7.6 and 11.8.0 through 11.8.3, tracked as MMSA-2026-00718 (ENISA EUVD-2026-60212). The exploit window opens when a channel is migrated between teams and the endpoint fails to re-verify team membership before executing the unassignment, letting a malicious admin modify access-control policy state beyond their administrative boundary.
Privilege retention in Mattermost Boards allows a user demoted to System Guest to continue exercising Board Admin privileges via the Boards REST API or UI. Affected are Mattermost versions 11.7.0-11.7.6, 10.11.0-10.11.21, and 11.8.0-11.8.3, where the SchemeAdmin flag is not reconciled against the user's current role during or after demotion. An authenticated attacker in this state can invoke admin-only Boards operations - including modifying board permissions and settings - without detection by role-based access checks. No public exploit code is identified and no CISA KEV listing is present at time of analysis.
Memory exhaustion and unbounded disk consumption in Mattermost's Boards archive import handler expose self-hosted deployments to authenticated denial-of-service. Affected versions span the 10.11.x, 11.7.x, 11.8.x, and 11.9.x release trains, all of which fail to enforce decompressed content size limits or respect the configured maximum file size when processing .boardarchive uploads. Any authenticated user with access to the Boards import endpoint can trigger this condition; no public exploit has been identified at time of analysis and the vulnerability does not appear in CISA KEV.
Path traversal in Mattermost allows an admin user with SAML system-console write permissions to delete arbitrary files outside the intended directory, causing high availability impact. Affected versions include 10.11.x through 10.11.20, 11.6.x through 11.6.5, 11.7.x through 11.7.3, and 11.8.0. No public exploit is identified at time of analysis, but the required high privileges limit the immediate risk.
Denial of service vulnerability in Mattermost allows authenticated users to exhaust server resources by uploading crafted animated GIFs as custom emoji. Affects versions 10.11.x, 11.6.x, 11.7.x, and 11.8.x up to certain patch levels. No active exploitation or public exploit is known, but patches are available from the vendor.
Denial of service in Mattermost 10.11.x through 11.8.x allows authenticated users with file-upload permission to degrade file-upload performance for all users by exploiting unbounded resource consumption during server-side document extraction. Attackers can repeatedly upload small documents that are expensive to extract, saturating the extraction worker pool and causing service degradation. No active exploitation or public exploit code is reported, but the low attack complexity and minimal privileges make this an accessible DoS vector.
Improper null checking in Mattermost Desktop App versions ≤6.2, 5.5.13, and 6.0.2.0 enables any authenticated channel member to crash the Desktop App of all other members in the same channel by posting a crafted link containing an embedded image served without expected HTTP headers. The crash is client-side and can be made persistent if the malicious message remains in the channel, forcing repeated crashes each time an affected client reconnects. No public exploit has been identified at time of analysis, but the low-privilege attack vector and trivial reproduction make this a realistic insider or compromised-account threat in collaborative environments.
Mattermost Desktop App across the 5.x and 6.x release branches can be crashed by a malicious server operator through unvalidated inter-process payloads sent from the Mattermost Web App to the Desktop App. The root cause is the absence of payload validation in the Web-to-Desktop communication channel, enabling a server owner to send a malformed method payload that causes uncontrolled processing and application termination on the connected client. No public exploit code has been identified at time of analysis and the vulnerability is not listed in the CISA KEV catalog; however, the network-accessible path and low-complexity exploitation make this a credible denial-of-service threat for organizations running self-hosted Mattermost deployments with untrusted or compromised server administrators.
Insecure Direct Object Reference (IDOR) in Mattermost's Playbooks feature permits any authenticated team member to overwrite another user's playbook metric configuration by supplying a foreign metric ID in a crafted import or update request. Affected branches are 11.7.x through 11.7.1, 11.6.x through 11.6.4, and 10.11.x through 10.11.19, where the server authorizes metric writes based on team membership alone rather than verifying that the referenced metric ID belongs to the playbook being saved. No public exploit code has been identified and this vulnerability does not appear in CISA KEV at time of analysis.
Insufficient sanitization of team objects in Mattermost's scheme teams API endpoint allows an authenticated user holding the User Manager role to extract invite links for private teams from API responses and use those links to join or redistribute access to those teams. Affected versions are 11.7.x through 11.7.2 and 10.11.x through 10.11.19. No public exploit identified at time of analysis and exploitation has not been confirmed by CISA KEV, but the low attack complexity (AC:L) means a malicious User Manager could reliably reproduce this without trial and error.
Missing authorization in Mattermost's /share-channel slash command autocomplete handler allows any authenticated user to enumerate remote cluster connection metadata, regardless of whether they hold the manage_shared_channels permission. Affects three active release lines (11.7.x, 11.6.x, 10.11.x) and is classified under CWE-862 (Missing Authorization). No public exploit identified at time of analysis, and the vulnerability is not listed in CISA KEV; exploitation is constrained to authenticated users, limiting realistic blast radius to insider threat or compromised-account scenarios.
Deactivated guest accounts in Mattermost 11.6.x through 11.6.4 and 11.7.x through 11.7.2 can regain platform access using magic-link tokens issued before deactivation, because the magic-link login path omits an account-status check during session creation. This directly undermines guest account revocation as an access control mechanism - administrators who deactivate a guest account expecting immediate exclusion will find the control is defeatable while any pre-issued token remains valid. No public exploit code has been identified at time of analysis, and this vulnerability is not listed in the CISA KEV catalog.
Catastrophic regex backtracking in Mattermost's client-side markdown parser can be triggered by an authenticated user posting a specially crafted message attachment, causing a denial-of-service condition for every user rendering that channel. Affected builds span versions 11.7.x through 11.7.2, 11.6.x through 11.6.4, and 10.11.x through 10.11.19. No public exploit has been identified at time of analysis and this vulnerability is not listed in CISA KEV, though the low exploitation complexity (AC:L, PR:L) lowers the bar for any authenticated insider or compromised account.
Incorrect authorization in Mattermost's interactive post action handler allows authenticated users to trigger post actions in private channels they are not members of. The flaw stems from action cookies failing to bind to the specific channel of the target post - a cookie obtained from any accessible channel can be reused against posts in restricted private channels. Affected are Mattermost versions 11.7.x through 11.7.2, 11.6.x through 11.6.4, and 10.11.x through 10.11.19; no public exploit has been identified and the vulnerability is not listed in CISA KEV.
Mattermost's channel patch API fails to enforce authorization on the group_constrained flag, permitting any authenticated low-privilege member of a group message or direct message channel to remove all participants from the conversation. All three supported release lines are affected: 11.7.x through 11.7.2, 11.6.x through 11.6.4, and 10.11.x through 10.11.19. No public exploit code has been identified at time of analysis; however, the low attack complexity and minimal privilege requirement make this straightforward to abuse on any reachable Mattermost deployment.
Incoming webhook impersonation in Mattermost allows a requester holding webhook management permissions to post content attributed to arbitrary users in teams or channels those users do not belong to. Affected deployments span three active release branches: 11.7.x through 11.7.2, 11.6.x through 11.6.4, and 10.11.x through 10.11.19. No public exploit code exists and the vulnerability is not listed in CISA KEV; the CVSS score of 4.9 correctly reflects that exploitation is constrained by the High privilege requirement, limiting realistic risk to insider threats or compromised privileged accounts.
Post ownership verification is absent in Mattermost's shared channel inbound sync handler, allowing an authenticated remote cluster to forge sync messages that modify or delete posts authored by local users or other federated remotes. Affected versions span the 10.11.x, 11.6.x, and 11.7.x release trains up to and including 10.11.19, 11.6.4, and 11.7.2 respectively. No public exploit has been identified and CISA KEV confirmation is absent, but the integrity impact is direct and the attack complexity is low once federation trust is established.
Mattermost fails to invalidate OAuth refresh tokens when a user account is deactivated, enabling former users - or any attacker who possesses a valid refresh token - to continue minting functional access tokens against the OAuth refresh token grant endpoint indefinitely after access revocation should have taken effect. All three actively maintained release branches are affected (10.11.x, 11.6.x, 11.7.x), making this a cross-branch session-persistence flaw with high confidentiality and integrity impact on any workspace relying on OAuth-integrated access control. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in CISA KEV, though the attack path requires minimal skill for any party already holding a refresh token.
Credential exposure in Mattermost Plugins (all branches ≤11.6, fixed in 10.18.11, 11.3.6, and 11.6.5.0) leaks valid or partially reconstructable OpenAI API keys into mattermost.log when the OpenAI API returns authentication failure responses. Any user with privileged read access to server logs or downloadable support packets can recover the key and authenticate to the victim organization's OpenAI account. No public exploit code or CISA KEV listing exists at time of analysis, but the CVSS Scope:Changed rating reflects that successful exploitation grants unauthorized access to an external, out-of-scope resource - the OpenAI account - with full confidentiality impact.
Server-side request forgery in the Mattermost Agents plugin MCP server (stdio mode) allows a low-privileged local attacker to make the server fetch arbitrary internal URLs submitted as file attachment references in post creation requests, enabling exfiltration of data from RFC 1918-addressed services on the internal network. Affected are Mattermost deployments running versions 10.11.x ≤ 10.11.18, 11.5.x ≤ 11.5.6, and 11.6.x ≤ 11.6.3 with the Agents plugin's MCP server active in stdio mode. No public exploit code or CISA KEV listing is present in the available data; exploitation is constrained to attackers who already have local access to the stdio MCP interface.
Markdown image rendering restrictions in Mattermost are bypassed specifically for AI bot tool result posts, enabling authenticated attackers to exfiltrate data to attacker-controlled infrastructure. Affected are Mattermost versions 10.11.x through 10.11.18, 11.5.x through 11.5.6, and 11.6.x through 11.6.3. When a victim's client renders an AI bot tool result post containing injected markdown image syntax, the client issues an outbound request to the attacker's server, leaking request metadata such as session tokens or channel context. No public exploit code exists and this vulnerability is not listed in the CISA KEV catalog at time of analysis.
Path traversal in Mattermost's Go server module allows authenticated remote attackers to redirect API calls to unintended endpoints by embedding path traversal components (e.g., '../') within crafted ID parameters. The affected library is github.com/mattermost/mattermost/server/public versions prior to v0.1.22, which fails to sanitize path parameters before constructing API route paths. Exploitation yields limited confidentiality and integrity impact (CVSS 5.4 Medium); no public exploit code and no CISA KEV listing have been identified at time of analysis.
Missing authorization in the Mattermost Google Drive plugin's file creation endpoint (all versions before 1.1.0) allows authenticated Mattermost users with a linked Google account to share Drive files into private channels they are not a member of, and to infer the existence and membership of those private channels. The root cause is CWE-862 (Missing Authorization): the endpoint processes the target channel ID supplied by the caller without verifying the caller belongs to that channel. No public exploit has been identified at time of analysis, and the vulnerability has not been added to the CISA KEV catalog.