Mattermost vulnerabilities

Mattermost Plugin MSTeams versions <2.1.0 and Mattermost Server versions 10.5.x <=10.5.1 with the MS Teams plugin enabled fail to perform constant-time comparison on the MSTeams plugin webhook secret. This allows an attacker to retrieve the webhook secret via a timing attack during webhook secret comparison.

Mattermost versions 10.5.x <= 10.5.1, 10.4.x <= 10.4.3, and 9.11.x <= 9.11.9 fail to check the "Allow Users to View Archived Channels" configuration when fetching channel metadata of a post from archived channels. Authenticated users can access such information when a channel is archived.

Mattermost versions 10.5.x <= 10.5.1 and 9.11.x <= 9.11.9 fail to enforce MFA checks in the PUT /api/v4/users/user-id/mfa endpoint when the requesting user differs from the target user ID. This allows users with the edit_other_users permission to activate or deactivate MFA for other users, even if those users have not set up MFA.

Mattermost versions 10.5.x <= 10.5.1, 10.4.x <= 10.4.3, and 9.11.x <= 9.11.9 fail to prevent Wrangler posts from triggering AI responses. A user without access to the AI bot can activate it by attaching the activate_ai override property to a post via the Wrangler plugin, provided both the AI and Wrangler plugins are enabled.

Mattermost versions 10.5.x <= 10.5.1, 10.4.x <= 10.4.3, and 9.11.x <= 9.11.9 fail to invalidate the cache when a user account is converted to a bot, allowing an attacker to log in to the bot exactly once using normal credentials.

Mattermost versions 10.5.x <= 10.5.1, 9.11.x <= 9.11.9 fail to check if a file has been deleted when creating a bookmark which allows an attacker who knows the IDs of deleted files to obtain metadata of the files via bookmark creation.

Mattermost versions 10.5.x <= 10.5.1, 10.4.x <= 10.4.3, and 9.11.x <= 9.11.9 fail to restrict certain operations on system admins to only other system admins. This allows delegated granular administration users with the "Edit Other Users" permission to perform unauthorized modifications to system administrators.

Mattermost versions 9.11.x <= 9.11.8 fail to enforce proper access controls on the /api/v4/audits endpoint. This allows users with delegated granular administration roles who lack access to Compliance Monitoring to retrieve User Activity Logs.

Mattermost versions 10.4.x <= 10.4.2, 10.3.x <= 10.3.3, 9.11.x <= 9.11.8 fail to enforce channel conversion restrictions. Members with permission to convert public channels to private can also convert private channels to public.

Mattermost versions 10.1.x <= 10.1.3, 10.4.x <= 10.4.1, 9.11.x <= 9.11.7, 10.3.x <= 10.3.2, 10.2.x <= 10.2.2 fail to restrict channel export of archived channels when the "Allow users to view archived channels" is disabled, which allows a user to export channel contents when they shouldn't have access to it.

Mattermost versions 9.11.x <= 9.11.6 and 10.4.x <= 10.4.1 fail to invalidate all active sessions when converting a user to a bot. This allows the converted user to escalate their privileges depending on the permissions granted to the bot.

Mattermost versions 10.2.x <= 10.2.0, 9.11.x <= 9.11.5, 10.0.x <= 10.0.3, and 10.1.x <= 10.1.3 fail to properly handle posts with attachments containing fields that cannot be cast to a String. An attacker can cause the webapp to crash by creating and sending such a post to a channel.

Mattermost versions 10.2.x <= 10.2.0, 9.11.x <= 9.11.5, 10.0.x <= 10.0.3, and 10.1.x <= 10.1.3 fail to properly validate post props, allowing a malicious authenticated user to cause a crash via a crafted post.

Mattermost versions 10.2.x <= 10.2.0, 9.11.x <= 9.11.5, 10.0.x <= 10.0.3, and 10.1.x <= 10.1.3 fail to properly validate post props, allowing a malicious authenticated user to cause a crash via a malicious post.

Mattermost versions 10.2.x <= 10.2.0, 9.11.x <= 9.11.5, 10.0.x <= 10.0.3, 10.1.x <= 10.1.3 fail to properly validate the style of proto supplied to an action's style in post.props.attachments, which allows an attacker to crash the frontend via crafted malicious input.

Mattermost versions 9.11.x <= 9.11.5 fail to enforce invite permissions, allowing team admins without invite permission to invite users by updating the "allow_open_invite" field and making their team public.

Mattermost versions 10.x <= 10.2 fail to accurately reflect missing settings, causing confusion for admins regarding a Calls security-sensitive configuration via incorrect UI reporting.

Mattermost versions 10.2.0, 9.11.x <= 9.11.5, 10.0.x <= 10.0.3, and 10.1.x <= 10.1.3 fail to properly validate post types, allowing attackers to deny service to users with the sysconsole_read_plugins permission by creating a post with the custom_pl_notification type and specific props.

Mattermost versions 9.10.x <= 9.10.2, 9.11.x <= 9.11.1, 9.5.x <= 9.5.9 fail to sanitize user inputs in the frontend that are used for redirection which allows for a one-click client-side path traversal that is leading to CSRF in Playbooks.

Mattermost versions 9.10.x <= 9.10.2, 9.11.x <= 9.11.1, and 9.5.x <= 9.5.9 fail to check that the origin of the message in an integration action matches the original post metadata. An authenticated user can delete an arbitrary post.

Mattermost versions 9.5.x <= 9.5.9 fail to properly filter the channel data when ElasticSearch is enabled, which allows a user to get private channel names by using cmd+K/ctrl+K.

Mattermost versions 9.11.X <= 9.11.1 and 9.5.x <= 9.5.9 incorrectly issues two sessions when using desktop SSO — one in the browser and one in the desktop app with incorrect settings.

Mattermost versions 9.11.x <= 9.11.0 and 9.5.x <= 9.5.8 fail to validate that the message of the permalink post is a string, allowing an attacker to send a non-string value as the message of a permalink post and crash the frontend.

Mattermost versions 9.9.x <= 9.9.0 and 9.5.x <= 9.5.6 fail to validate the source of sync messages and only allow the correct remote IDs, which allows a malicious remote to set arbitrary RemoteId values for synced users and therefore claim that a user was synced from another remote.

Mattermost versions 9.9.x <= 9.9.0, 9.5.x <= 9.5.6, 9.7.x <= 9.7.5, and 9.8.x <= 9.8.1 fail to disallow the modification of local channels by a remote when shared channels are enabled. A malicious remote can make an arbitrary local channel read-only.

Mattermost versions 9.9.x <= 9.9.0, 9.5.x <= 9.5.6, 9.7.x <= 9.7.5, and 9.8.x <= 9.8.1 fail to properly validate synced posts when shared channels are enabled. A malicious remote can create, update, or delete arbitrary posts in arbitrary channels.

Mattermost versions 9.9.x <= 9.9.0 and 9.5.x <= 9.5.6 fail to properly restrict channel creation, allowing a malicious remote to create arbitrary channels when shared channels are enabled.

Mattermost versions 8.1.x before 8.1.9, 9.2.x before 9.2.5, 9.3.0, and 9.4.x before 9.4.2 fail to limit the number of role names requested from the API, allowing an authenticated attacker to cause the server to run out of memory and crash by issuing an unusually large HTTP request.

A race condition in Mattermost versions 8.1.x before 8.1.9, and 9.4.x before 9.4.2 allows an authenticated attacker to gain unauthorized access to individual posts' contents via carefully timed post creation while another user deletes posts.

Mattermost versions 8.1.x before 8.1.9, 9.2.x before 9.2.5, and 9.3.0 fail to sanitize metadata on posts containing permalinks under specific conditions, allowing an authenticated attacker to access the contents of individual posts in channels they are not a member of.

Mattermost fails to check the 'invite_guest' permission when inviting guests of other teams to a team, allowing a member with permissions to add other members but not to add guests to add a guest to a team as long as the guest was already a guest in another team of the server.

Mattermost fails to properly restrict access to files attached to posts in an archived channel. Members can access files of archived channels even if the “Allow users to view archived channels” option is disabled.

Mattermost fails to check if compliance export is enabled when fetching posts of public channels, allowing a user who is not a member of the public channel to fetch the posts, which will not be audited in the compliance export.

This CVE ID was rejected by its CNA. Further investigation showed that it was not a security issue.

Mattermost fails to check whether a custom emoji reaction exists and does not limit the number of custom emojis added to a post. An attacker can send a huge amount of non-existent custom emojis to crash a user's mobile app and overload the server when clients retrieve the post.

Mattermost fails to check required permissions in the POST /api/v4/channels/stats/member_count API, resulting in channel member counts being leaked to a user without permissions.

Mattermost fails to update the permissions of the current session for a user who was just demoted to guest. As a result, freshly demoted guests can change group names.

Mattermost fails to scope the WebSocket response about notified users to each user separately. As a result, the WebSocket broadcasts information about who was notified about a post to everyone else in the channel.

Mattermost fails to properly verify permissions for viewing archived public channels. A member of one team can obtain details about another team's archived public channels via the GET /api/v4/teams/<team-id>/channels/deleted endpoint.

Mattermost version 8.1.6 and earlier fails to sanitize channel mention data in posts, which allows an attacker to inject markup in the web client.

Mattermost groups calls in the /metrics endpoint by id and reports that id in the response. Since this id is the channelID, the public /metrics endpoint is revealing channelIDs.

Mattermost webapp fails to validate route parameters in /<TEAM_NAME>/channels/<CHANNEL_NAME>, allowing an attacker to perform a client-side path traversal. This may enable access to unauthorized paths.

Mattermost fails to perform proper authorization in the /plugins/focalboard/api/v2/users endpoint, allowing an attacker who is a guest user and knows the ID of another user to obtain their information (e.g., name, surname, nickname) via Mattermost Boards.

Mattermost fails to limit the log size of server logs, allowing an attacker to send specially crafted requests to different endpoints and potentially overflow the log.

Mattermost fails to limit the amount of data extracted from compressed archives during board import in Mattermost Boards, allowing an attacker to consume excessive resources, possibly leading to Denial of Service, by importing a board using a specially crafted zip (zip bomb).

Mattermost fails to properly check a redirect URL parameter, allowing an open redirect when the user clicked "Back to Mattermost" after providing an invalid custom URL scheme in /oauth/{service}/mobile_login?redirect_to=.

Mattermost fails to properly validate the "Show Full Name" option in some Mattermost Boards endpoints. A member can obtain another user's full name even if the option was disabled.

Mattermost fails to check whether the “Allow users to view archived channels” setting is enabled during permalink previews display. As a result, members can view permalink previews of archived channels even if the setting is disabled.

Mattermost fails to use innerText / textContent when setting the channel name in the webapp during autocomplete, allowing an attacker to inject HTML to a victim's page by creating a channel name that is valid HTML. No XSS is possible though.

Mattermost fails to check if hardened mode is enabled when overriding the username and/or the icon when posting a post. If settings allowed integrations to override the username and profile picture when posting, a member could also override the username and icon when making a post even if the Hardened Mode setting was enabled.