github.com/mattermost/mattermost-server vulnerabilities

CVEs whose affected-version data names the github.com/mattermost/mattermost-server package (go). Each record lists the affected and patched versions; check a specific version with the dependency checker or POST /api/sbom.

github.com/mattermost/mattermost-server vulnerabilities

Mattermost has an Incorrect Authorization issue

Mattermost doesn't authenticate Atlassian Connect installed callbacks, allowing a remote unauthenticated attacker to inject a rogue share…

Mattermost doesn't validate channel ownership of an existing subscription before applying edits

Mattermost doesn't invalidate cached authentication state for active WebSocket connections during global session revocation

Mattermost doesn't enforce bot-specific permission checks on the user active status endpoint

Mattermost doesn't enforce administrator authorization on the {{setDefaultInstance}} call within the {{/gitlab connect}} command handler

Mattermost doesn't restrict role_updated websocket event broadcasts to members of the affected team or channel

Mattermost doesn't require system-level permission when patching protected default system roles

Mattermost doesn't enforce PermissionInviteUser when setting AllowOpenInvite or AllowedDomains during team creation

Mattermost doesn't sanitize the Remote Cluster API response on PATCH operations

Mattermost doesn't sanitize FileInfo.Name received from federated peers during shared channel file sync

Mattermost doesn't require role-management authorization when setting the scheme_admin flag on group syncable link and patch endpoints

Mattermost doesn't validate that a username returned during bot registration belongs to a bot account

Mattermost Fails to Restrict Certain Operations on System Admins