Mattermost vulnerabilities

Mattermost versions 11.3.x <= 11.3.0, 11.2.x <= 11.2.2, 10.11.x <= 10.11.10 fail to canonicalize IPv4-mapped IPv6 addresses before reserved IP validation, allowing an attacker to perform SSRF attacks against internal services via IPv4-mapped IPv6 literals such as [::ffff:127.0.0.1].

Mattermost versions 11.3.x <= 11.3.0, 11.2.x <= 11.2.2, and 10.11.x <= 10.11.10 failed to properly enforce read permissions in search API endpoints. Guest users without read permissions could access posts and files in channels via search API requests.

Mattermost versions 10.11.x <= 10.11.10 fail to validate the user's authentication method when processing an account auth type switch. An authenticated attacker can change the account password without confirmation by falsely claiming a different auth provider.

Mattermost versions 11.3.x <= 11.3.0, 11.2.x <= 11.2.2, 10.11.x <= 10.11.10 fail to use consistent error responses when handling the /mute command. An authenticated team member can enumerate private channels they are not authorized to know about via differing error messages for nonexistent versus private channels.

Mattermost versions 11.3.x <= 11.3.0, 11.2.x <= 11.2.2, 10.11.x <= 10.11.10 fail to validate team-specific upload_file permissions, allowing a guest user to post files in channels where they lack upload_file permission by uploading files in a team where they have permission and reusing the file metadata in a POST request to a different team.

Mattermost versions 11.3.x <= 11.3.0 fail to preserve the redacted state of burn-on-read posts during deletion, allowing channel members to access unrevealed burn-on-read message contents via the WebSocket post deletion event. Advisory ID: MMSA-2026-00579.

Mattermost versions 11.3.x <= 11.3.0, 11.2.x <= 11.2.2, 10.11.x <= 10.11.10 fail to filter invite IDs based on user permissions, allowing regular users to bypass access control restrictions and register unauthorized accounts via leaked invite IDs during team creation.

Mattermost versions 11.3.x <= 11.3.0, 11.2.x <= 11.2.2, and 10.11.x <= 10.11.10 fail to properly validate team membership when searching channels, allowing a removed team member to enumerate all public channels within a private team via the channel search API endpoint.

Mattermost versions 11.3.x <= 11.3.0, 11.2.x <= 11.2.2, and 10.11.x <= 10.11.10 fail to sanitize client-supplied post metadata. An authenticated attacker can spoof permalink embeds impersonating other users via crafted PUT requests to the post update API endpoint.

Mattermost versions 11.3.x <= 11.3.0, 11.2.x <= 11.2.2, 10.11.x <= 10.11.10 fail to limit the size of responses from integration action endpoints. An authenticated attacker can cause server memory exhaustion and denial of service via a malicious integration server returning an arbitrarily large response when a user clicks an interactive message button.

Mattermost versions 11.3.x <= 11.3.0, 11.2.x <= 11.2.2, and 10.11.x <= 10.11.10 fail to bound memory allocation when processing PSD image files, allowing an authenticated attacker to cause server memory exhaustion and denial of service by uploading a specially crafted PSD file.

Mattermost versions 11.3.x <= 11.3.0, 11.2.x <= 11.2.2, 10.11.x <= 10.11.10 fail to properly validate User-Agent header tokens. An authenticated attacker can cause a request panic via a specially crafted User-Agent header.

Mattermost versions 11.3.x <= 11.3.0, 11.2.x <= 11.2.2, and 10.11.x <= 10.11.10 fail to bound memory allocation when processing DOC files. An authenticated attacker can upload a specially crafted DOC file to exhaust server memory.

Mattermost versions 11.3.x <= 11.3.0, 11.2.x <= 11.2.2, and 10.11.x <= 10.11.10 fail to properly handle very long passwords. An attacker can overload server CPU and memory by executing login attempts with multi-megabyte passwords.

Mattermost versions 10.11.x <= 10.11.9 fail to enforce invite permissions when updating team settings. Team administrators without proper permissions can bypass restrictions and add users to their team via API requests.

Mattermost versions 11.1.x <= 11.1.2, 10.11.x <= 10.11.9, and 11.2.x <= 11.2.1 fail to properly validate team membership when processing channel mentions. This allows authenticated users to determine the existence of teams and their URL names by posting channel shortlinks and observing the channel_mentions property in the API response. Advisory ID: MMSA-2025-00563.

Mattermost versions 11.1.x <= 11.1.2, 10.11.x <= 10.11.9, and 11.2.x <= 11.2.1 fail to sanitize sensitive data in WebSocket messages. This allows authenticated users to exfiltrate password hashes and MFA secrets via profile nickname updates or email verification events. Advisory ID: MMSA-2025-00560.

Mattermost versions 11.1.x <= 11.1.2, 10.11.x <= 10.11.9, and 11.2.x <= 11.2.1 fail to properly validate login method restrictions. An authenticated user can bypass SSO-only login requirements via userID-based authentication.

Mattermost versions 10.8.x <= 10.8.3, 10.5.x <= 10.5.8, 9.11.x <= 9.11.17, 10.10.x <= 10.10.0, 10.9.x <= 10.9.3 fail to validate import data, allowing a system admin to crash the server via the bulk import feature.

Mattermost versions 10.8.x <= 10.8.3, 10.5.x <= 10.5.8, 10.10.x <= 10.10.0, 10.9.x <= 10.9.3 fail to sanitize file names, allowing users with file upload permission to overwrite file attachment thumbnails via path traversal in file streaming APIs.

Mattermost versions 10.8.x <= 10.8.3, 10.5.x <= 10.5.8, 9.11.x <= 9.11.17, 10.9.x <= 10.9.2 fail to sanitize path traversal sequences in template file destination paths. A system admin can perform path traversal attacks via malicious path components, potentially enabling malicious file placement outside intended directories.

Mattermost versions 10.5.x <= 10.5.8, 9.11.x <= 9.11.17 fail to properly validate authorization for team scheme role modifications which allows Team Admins to demote Team Members to Guests via the PUT /api/v4/teams/team-id/members/user-id/schemeRoles API endpoint.

Mattermost versions 10.5.x <= 10.5.8 fail to validate access controls at time of access, allowing a user to read a thread via AI posts.

Mattermost versions 10.8.x <= 10.8.3, 10.5.x <= 10.5.8, 9.11.x <= 9.11.17, 10.9.x <= 10.9.2, and 10.10.x <= 10.10.0 fail to validate upload types in remote cluster upload sessions. A system admin can upload non-attachment file types via shared channels that could potentially be placed in arbitrary filesystem directories.

Mattermost versions 10.8.x <= 10.8.3, 10.5.x <= 10.5.8, 9.11.x <= 9.11.17, and 10.9.x <= 10.9.2 fail to sanitize the team invite ID in the POST /api/v4/teams/:teamId/restore endpoint. This allows a team admin without member invite privileges to obtain the team's invite ID.

Mattermost Server versions 10.5.x <= 10.5.9 utilizing the Agents plugin fail to reject empty request bodies which allows users to trick users into clicking malicious links via post actions.

Mattermost versions 10.9.x <= 10.9.1, 10.8.x <= 10.8.3, 10.5.x <= 10.5.8, and 9.11.x <= 9.11.17 fail to properly validate file paths during plugin import operations. This allows restricted admin users to install unauthorized custom plugins via path traversal, bypassing plugin signature enforcement and marketplace restrictions.

Mattermost versions 10.5.x <= 10.5.7, 9.11.x <= 9.11.16 fail to negotiate a new token when accepting the invite which allows a user that intercepts both invite and password to send synchronization payloads to the server that originally created the invite via the REST API.

Mattermost versions 10.8.x <= 10.8.1, 10.7.x <= 10.7.3, 10.5.x <= 10.5.7, 9.11.x <= 9.11.16 fail to sanitize input paths of file attachments in the bulk import JSONL file, which allows a system admin to read arbitrary system files via path traversal.

Mattermost versions 10.5.x <= 10.5.6, 10.8.x <= 10.8.1, 10.7.x <= 10.7.3, and 9.11.x <= 9.11.16 fail to verify authorization when retrieving cached posts by PendingPostID. An authenticated user can read posts in private channels they don't have access to by guessing the PendingPostID of recently created posts.

Mattermost versions 10.5.x <= 10.5.5, 9.11.x <= 9.11.15, 10.8.x <= 10.8.0, 10.7.x <= 10.7.2, 10.6.x <= 10.6.5 fail to properly validate channel membership when retrieving playbook run metadata. Authenticated users who are playbook members but not channel members can access information about linked private channels.

Mattermost versions 10.5.x <= 10.5.5, 9.11.x <= 9.11.15, 10.8.x <= 10.8.0, 10.7.x <= 10.7.2, 10.6.x <= 10.6.5 fail to properly enforce channel member management permissions when adding participants to playbook runs. Authenticated users with member-level permissions can bypass system admin restrictions.

Mattermost versions 10.5.x <= 10.5.5, 9.11.x <= 9.11.15, 10.8.x <= 10.8.0, 10.7.x <= 10.7.2, and 10.6.x <= 10.6.5 fail to properly retrieve requestorInfo from the playbooks handler for guest users. This allows an attacker to access the playbook run.

Mattermost versions 10.5.x <= 10.5.5, 9.11.x <= 9.11.15, 10.8.x <= 10.8.0, 10.7.x <= 10.7.2, 10.6.x <= 10.6.5 fail to properly enforce channel member management permissions in playbook runs, allowing authenticated users without the 'Manage Channel Members' permission to add or remove users from public and private channels by manipulating playbook run participants when the run is linked to a channel.

Mattermost versions 10.7.x <= 10.7.1, 10.6.x <= 10.6.3, 10.5.x <= 10.5.4, and 9.11.x <= 9.11.13 fail to properly validate LDAP group ID attributes. An authenticated administrator with PermissionSysconsoleWriteUserManagementGroups can execute LDAP search filter injection via the PUT /api/v4/ldap/groups/{remote_id}/link API when objectGUID is configured as the Group ID Attribute.

Mattermost versions 10.5.x <= 10.5.4 and 9.11.x <= 9.11.13 fail to properly restrict API access to team information. Guest users can bypass permissions and view information about public teams they are not members of via a direct API call to /api/v4/teams/{team_id}.

Mattermost versions 10.7.x <= 10.7.0, 10.5.x <= 10.5.3, 9.11.x <= 9.11.12 fails to properly enforce access control restrictions for System Manager roles, allowing authenticated users with System Manager privileges to view team details they should not have access to via direct API requests to team endpoints, even when explicitly configured with 'No access' to Teams in the System Console.

Mattermost versions 10.7.x <= 10.7.0, 10.6.x <= 10.6.2, 10.5.x <= 10.5.3, 9.11.x <= 9.11.12 fail to properly invalidate personal access tokens upon user deactivation, allowing deactivated users to maintain full system access by exploiting access token validation flaws via continued usage of previously issued tokens.

Mattermost versions 10.7.x <= 10.7.0, 10.6.x <= 10.6.2, 10.5.x <= 10.5.3, 9.11.x <= 9.11.12 fail to clear Google OAuth credentials when converting user accounts to bot accounts. This allows attackers to gain unauthorized access to bot accounts via the Google OAuth signup flow.

Mattermost versions 10.7.x <= 10.7.0, 10.5.x <= 10.5.3, 9.11.x <= 9.11.12 fail to properly enforce access controls for guest users accessing channel member information. Authenticated guest users can view metadata about members of public channels via the channel members API endpoint.

Mattermost versions 10.7.x <= 10.7.0, 10.6.x <= 10.6.2, 10.5.x <= 10.5.3, 9.11.x <= 9.11.12 fail to properly validate permissions when changing team privacy settings. Team administrators without the 'invite user' permission can access and modify team invite IDs via the /api/v4/teams/:teamId/privacy endpoint.

Mattermost versions 10.5.x <= 10.5.3 and 9.11.x <= 9.11.11 fail to check the RestrictSystemAdmin setting if a user doesn't have access to ExperimentalSettings, allowing a System Manager to access ExperimentalSettings when RestrictSystemAdmin is true via System Console.

Mattermost versions 10.5.x <= 10.5.2 and 9.11.x <= 9.11.11 failed to properly verify a user's permissions when accessing groups, which allows an attacker to view group information via an API request.

Mattermost versions 10.6.x <= 10.6.1, 10.5.x <= 10.5.2, 10.4.x <= 10.4.4, 9.11.x <= 9.11.11 fail to check the correct permissions, allowing authenticated users who only have permission to invite non-guest users to a team to add guest users to that team via the API to add a single user to a team.

Mattermost versions 10.6.x <= 10.6.1, 10.5.x <= 10.5.2, 10.4.x <= 10.4.4, 9.11.x <= 9.11.11 fail to lockout LDAP users following repeated login failures, which allows attackers to lock external LDAP accounts through repeated login failures through Mattermost.

Mattermost versions 10.4.x <= 10.4.2, 10.5.x <= 10.5.0, 9.11.x <= 9.11.10 fail to properly validate permissions for the API endpoint /plugins/playbooks/api/v0/signal/keywords/ignore-thread, allowing any user or attacker to delete posts containing actions created by the Playbooks bot, even without channel access or appropriate permissions.

Mattermost versions 10.4.x <= 10.4.2, 10.5.x <= 10.5.0, 9.11.x <= 9.11.10 fail to properly validate the props used by the RetrospectivePost custom post type in the Playbooks plugin. An attacker can create a specially crafted post with maliciously crafted props.

Mattermost versions 10.4.x <= 10.4.2, 10.5.x <= 10.5.0, 9.11.x <= 9.11.10 fail to validate the uniqueness and quantity of task actions within the UpdateRunTaskActions GraphQL operation. An attacker can create task items containing an excessive number of actions triggered by specific posts.

Mattermost versions 10.5.x <= 10.5.1, 10.4.x <= 10.4.3, and 9.11.x <= 9.11.9 fail to properly enforce the 'Allow users to view/update archived channels' System Console setting. Authenticated users can view members and member information of archived channels even when this setting is disabled.

Mattermost versions 10.4.x <= 10.4.2, 10.5.x <= 10.5.0, 9.11.x <= 9.11.9 fail to restrict domains the LLM can request to contact upstream. This allows an authenticated user to exfiltrate data from an arbitrary server accessible to the victim via performing a prompt injection in the AI plugin's Jira tool.