Vulnerabilities > Mattermost > Mattermost Server > Medium

DATE CVE VULNERABILITY TITLE RISK
2025-03-21 CVE-2025-24920 Incorrect Authorization vulnerability in Mattermost Server
Mattermost versions 10.4.x <= 10.4.2, 10.3.x <= 10.3.3, 9.11.x <= 9.11.8, 10.5.x <= 10.5.0 fail to restrict bookmark creation and updates in archived channels, which allows authenticated users created or update bookmarked in archived channels
network
low complexity
mattermost CWE-863
4.3
2025-03-21 CVE-2025-27933 Incorrect Authorization vulnerability in Mattermost Server
Mattermost versions 10.4.x <= 10.4.2, 10.3.x <= 10.3.3, 9.11.x <= 9.11.8 fail to fail to enforce channel conversion restrictions, which allows members with permission to convert public channels to private ones to also convert private ones to public
network
low complexity
mattermost CWE-863
4.3
2025-03-21 CVE-2025-30179 Incorrect Authorization vulnerability in Mattermost Server
Mattermost versions 10.4.x <= 10.4.2, 10.3.x <= 10.3.3, 9.11.x <= 9.11.8 fail to enforce MFA on certain search APIs, which allows authenticated attackers to bypass MFA protections via user search, channel search, or team search queries.
network
low complexity
mattermost CWE-863
6.5
2024-11-09 CVE-2024-36250 Authentication Bypass by Capture-replay vulnerability in Mattermost Server
Mattermost versions 9.11.x <= 9.11.2, and 9.5.x <= 9.5.10 fail to protect the mfa code against replay attacks, which allows an attacker to reuse the MFA code within ~30 seconds
network
high complexity
mattermost CWE-294
4.8
2024-11-09 CVE-2024-42000 Incorrect Authorization vulnerability in Mattermost Server
Mattermost versions 9.10.x <= 9.10.2, 9.11.x <= 9.11.1, 9.5.x <= 9.5.9 and 10.0.x <= 10.0.0 fail to properly authorize the requests to /api/v4/channels  which allows a User or System Manager, with "Read Groups" permission but with no access for channels to retrieve details about private channels that they were not a member of by sending a request to /api/v4/channels.
network
low complexity
mattermost CWE-863
4.3
2024-11-09 CVE-2024-52032 Unspecified vulnerability in Mattermost Server
Mattermost versions 10.0.x <= 10.0.0 and 9.11.x <= 9.11.2 fail to properly query ElasticSearch when searching for the channel name in channel switcher which allows an attacker to get private channels names of channels that they are not a member of, when Elasticsearch v8 was enabled.
network
low complexity
mattermost
4.3
2024-10-29 CVE-2024-46872 Cross-Site Request Forgery (CSRF) vulnerability in Mattermost Server
Mattermost versions 9.10.x <= 9.10.2, 9.11.x <= 9.11.1, 9.5.x <= 9.5.9 fail to sanitize user inputs in the frontend that are used for redirection which allows for a one-click client-side path traversal that is leading to CSRF in Playbooks
network
low complexity
mattermost CWE-352
4.6
2024-09-26 CVE-2024-42406 Unspecified vulnerability in Mattermost Server
Mattermost versions 9.11.x <= 9.11.0, 9.10.x <= 9.10.1, 9.9.x <= 9.9.2 and 9.5.x <= 9.5.8 fail to properly authorize requests when viewing archived channels is disabled, which allows an attacker to retrieve post and file information about archived channels.
network
low complexity
mattermost
5.4
2024-09-26 CVE-2024-45843 Server-Side Request Forgery (SSRF) vulnerability in Mattermost Server
Mattermost versions 9.5.x <= 9.5.8 fail to include the metadata endpoints of Oracle Cloud and Alibaba in the SSRF denylist, which allows an attacker to possibly cause an SSRF if Mattermost was deployed in Oracle Cloud or Alibaba.
network
low complexity
mattermost CWE-918
5.4
2024-09-26 CVE-2024-47003 Unspecified vulnerability in Mattermost Server
Mattermost versions 9.11.x <= 9.11.0 and 9.5.x <= 9.5.8 fail to validate that the message of the permalink post is a string, which allows an attacker to send a non-string value as the message of a permalink post and crash the frontend.
network
low complexity
mattermost
6.5