Mattermost vulnerabilities

Mattermost fails to properly sanitize the user object when updating the username, resulting in the password hash being included in the response body.

Mattermost versions 11.0.x <= 11.0.2, 10.12.x <= 10.12.1, 10.11.x <= 10.11.4, and 10.5.x <= 10.5.12 fail to verify that the token used during code exchange originates from the same authentication flow. This allows an authenticated user to perform account takeover via a crafted email address when switching authentication methods and sending a request to /users/login/sso/code-exchange. It requires ExperimentalEnableAuthenticationTransfer enabled (default) and RequireEmailVerification disabled (default).

Mattermost versions 10.12.x <= 10.12.1, 10.11.x <= 10.11.4, 10.5.x <= 10.5.12, and 11.0.x <= 11.0.3 fail to properly validate OAuth state tokens during OpenID Connect authentication. This allows an authenticated attacker with team creation privileges to take over a user account via manipulation of authentication data in the OAuth completion flow. It requires email verification disabled (default), OAuth/OpenID Connect enabled, and the attacker controlling two SSO users, one of whom never logged into Mattermost.

Mattermost versions 10.5.x <= 10.5.5, 9.11.x <= 9.11.15, 10.8.x <= 10.8.0, 10.7.x <= 10.7.2, 10.6.x <= 10.6.5 fail to sanitize filenames in the archive extractor. An authenticated user can write files to arbitrary filesystem locations by uploading archives with path traversal sequences in filenames, potentially leading to remote code execution. The vulnerability affects instances with FileSettings.EnableFileAttachments = true and FileSettings.ExtractContent = true, which are enabled by default.

In Mattermost versions 10.4.x <= 10.4.1, 9.11.x <= 9.11.7, 10.3.x <= 10.3.2 and 10.2.x <= 10.2.2, board blocks are not properly validated during board import. An attacker can read any arbitrary file on the system by importing and exporting a specially crafted import archive in Boards.

In Mattermost versions 10.4.x <= 10.4.1, 9.11.x <= 9.11.7, 10.3.x <= 10.3.2 and 10.2.x <= 10.2.2, input is not properly validated when patching and duplicating a board. A user can read any arbitrary file on the system by duplicating a specially crafted block in Boards.

Mattermost versions 11.9.x <= 11.9.1, 11.8.x <= 11.8.5, and 11.7.x <= 11.7.10 fail to validate the target post ID in the Agents plugin's mention reminder component. An authenticated user who can post in a channel visible to a system administrator can cause the administrator's browser to send an unintended API request, resulting in replacement of an installed plugin and code execution on the server, via a crafted post containing a forged mention reminder that the administrator clicks.

Mattermost versions 11.7.x <= 11.7.10 fail to restrict which built-in roles can be assigned to a team member via the API, which allows a team admin to grant a team member permissions beyond those permitted by the configured permission scheme via the {{update-team-member-roles}} REST API. Mattermost Advisory ID: MMSA-2026-00734.

Mattermost versions 11.9.x <= 11.9.1, 11.8.x <= 11.8.5, 11.7.x <= 11.7.10, and 11.10.x <= 11.10.1 fail to bound the volume of text extracted from an uploaded PDF. An authenticated user can exhaust server memory and cause a denial of service via a crafted PDF whose compressed content stream expands into a very large amount of text.

Mattermost versions 11.9.x <= 11.9.1, 11.8.x <= 11.8.5, 11.7.x <= 11.7.10, and 11.10.x <= 11.10.1 fail to apply allocation limits to byte-string decode paths in the WebSocket msgpack decoder. An authenticated remote attacker can cause excessive server memory allocation via a crafted binary WebSocket frame declaring a Bin32 payload length of up to 4,294,967,295 bytes.

Mattermost versions 11.7.x <= 11.7.10 fail to apply outbound internal-connection filtering to the OpenID discovery endpoint request. This allows a System Administrator to determine whether internal addresses and ports are reachable from the server via an unauthenticated login request that triggers the discovery fetch.

Mattermost versions 11.7.x <= 11.7.10 fail to validate reserved system post types on the scheduled post creation and publication paths. This allows an authenticated channel member to publish messages rendering as trusted system events via the scheduled post endpoint.

Mattermost versions <=11.9, 11.1.9, 11.5.8, 11.10.7.0 fail to validate Zoom chat line length before slicing, which allows an authenticated attacker to crash the Agents plugin by summarizing a Zoom chat transcription containing short continuation lines.

Mattermost versions 11.7.x <= 11.7.11 fail to validate null elements when decoding playbook import conditions. An authenticated attacker can send a crafted import request containing a null condition, crashing the Playbooks plugin instance-wide.

Mattermost versions 11.10.x <= 11.10.0, 11.7.x <= 11.7.9, 11.9.x <= 11.9.1, 11.8.x <= 11.8.5 fail to strip action integration secrets from post payloads before broadcasting post-deletion WebSocket events and returning thread API responses. An authenticated channel member can obtain server-side webhook URLs and authentication context from interactive-message posts via the post_deleted WebSocket event or the threads REST API.

Mattermost versions 11.9.x <= 11.9.1, 11.8.x <= 11.8.5, 11.7.x <= 11.7.10, 11.10.x <= 11.10.1 fail to sanitize authentication tokens before writing them to server log entries. An attacker with access to server logs can obtain valid session tokens or OAuth access tokens and impersonate authenticated users.

Mattermost versions 11.10.x <= 11.10.0, 11.7.x <= 11.7.9, 11.9.x <= 11.9.1, 11.8.x <= 11.8.5 fail to reject OAuth application sessions in the account type switch endpoint. An attacker with a valid OAuth bearer token for a target user can permanently take over that user's SSO-backed account by setting an attacker-controlled password and detaching the account from its identity provider.

Mattermost versions 11.10.x <= 11.10.0, 11.7.x <= 11.7.9, 11.9.x <= 11.9.1, 11.8.x <= 11.8.5 fail to restrict Slack import account binding to system administrator-initiated imports. An authenticated attacker with team admin privileges can force-add existing Mattermost users to their team and forge posts attributed to those users' identities.

Mattermost versions 11.10.x <= 11.10.0, 11.7.x <= 11.7.9, 11.9.x <= 11.9.1, 11.8.x <= 11.8.5 fail to validate user's permissions before other validations, allowing non-content reviewers to infer a post's flagged status via direct API call.

Mattermost versions 11.10.x <= 11.10.0, 11.7.x <= 11.7.9, 11.9.x <= 11.9.1, 11.8.x <= 11.8.5 fail to properly restrict private teams from public team search results. An authenticated user without permission to list private teams can disclose the ID, name, and display name of private teams via a modified team search request.

Mattermost versions 11.10.x <= 11.10.0, 11.7.x <= 11.7.9, 11.9.x <= 11.9.1, 11.8.x <= 11.8.5 fail to validate the invited recipient's email address when redeeming team and guest invitation tokens. An authenticated attacker can join a team or gain unauthorized access to private channels via a forwarded or leaked invitation link.

Mattermost versions 11.10.x <= 11.10.0, 11.7.x <= 11.7.9, 11.9.x <= 11.9.1, 11.8.x <= 11.8.5 fail to verify the integrity of the SAML RelayState POST parameter. This allows an authenticated SAML user to join any team, including invite-only teams, via forging the team_id or invite_id fields in the RelayState.

Mattermost versions 11.10.x <= 11.10.0, 11.7.x <= 11.7.9, 11.9.x <= 11.9.1, and 11.8.x <= 11.8.5 fail to limit the size of remote image responses buffered in memory during local image proxy direct fetches. A remote attacker can cause memory exhaustion on the server via a crafted oversized image response.

Mattermost versions 11.10.x <= 11.10.0, 11.9.x <= 11.9.1, 11.8.x <= 11.8.5, and 11.7.x <= 11.7.10 fail to cap the number and size of mention keys stored in a user's notification properties and to bound the quadratic multibyte-keyword matching performed for each post. An authenticated user can degrade post-processing latency and consume excessive CPU on behalf of other members of any shared channel by storing an oversized notify_props.mention_keys list on their own profile.

Mattermost versions 11.9.x <= 11.9.1, 11.8.x <= 11.8.5, 11.7.x <= 11.7.10, and 11.10.x <= 11.10.1 fail to sanitize the active channel field returned by the user status API endpoints. An authenticated user can learn the channel ID of a private channel another user is actively viewing via the status endpoints without being a member of that channel.

Mattermost versions 11.9.x <= 11.9.1, 11.8.x <= 11.8.5, 11.7.x <= 11.7.10, and 11.10.x <= 11.10.1 fail to invalidate the stored AD/LDAP bind password when other connection settings (such as the server address) are changed. A System Console administrator can disclose the plaintext bind password to an attacker-controlled server via the Test Connection / diagnostics feature.

Mattermost versions 11.9.x <= 11.9.1, 11.8.x <= 11.8.5, 11.7.x <= 11.7.10, and 11.10.x <= 11.10.1 fail to require re-entry of the stored client secret when validating an outgoing OAuth connection. An authenticated user with permission to manage outgoing OAuth connections can obtain the secret by pointing the token URL at an attacker-controlled endpoint and triggering validation.

Mattermost versions 11.10.x <= 11.10.0, 11.7.x <= 11.7.9, 11.9.x <= 11.9.1, and 11.8.x <= 11.8.5 fail to enforce DM/GM check on the server side. An authenticated user can quarantine a post belonging to a DM or GM via a direct API call.

Mattermost versions 11.10.x <= 11.10.0, 11.7.x <= 11.7.9, 11.9.x <= 11.9.1, and 11.8.x <= 11.8.5 fail to validate the combination of guest and admin scheme roles. An authenticated attacker can escalate a guest account to team or channel admin via a crafted PUT request to the member roles API endpoint.

Mattermost versions 11.9.x <= 11.9.1, 11.8.x <= 11.8.5, 11.7.x <= 11.7.10, 11.10.x <= 11.10.1 fail to enforce a request body size limit during CSRF validation of plugin requests which allows an authenticated user to exhaust server memory and cause a denial of service via a large request body sent to a plugin endpoint.

Mattermost versions 11.9.x <= 11.9.1, 11.8.x <= 11.8.5, 11.7.x <= 11.7.10, 11.10.x <= 11.10.1 fail to apply the internal-connection filter to OAuth endpoint requests, which allows a System Administrator to make the server issue requests to internal network addresses and read the responses via the configured OAuth token and userinfo endpoints.

Mattermost versions 11.9.x <= 11.9.1, 11.8.x <= 11.8.5, 11.7.x <= 11.7.10, and 11.10.x <= 11.10.1 fail to limit the length of the post ID array accepted by the bulk reactions endpoint, allowing an authenticated user to cause excessive database load via a crafted request to {{POST /api/v4/posts/ids/reactions}}. Advisory ID: MMSA-2026-00771.

Mattermost versions 11.9.x <= 11.9.0, 11.8.x <= 11.8.4, 11.7.x <= 11.7.7, 10.11.x <= 10.11.22 fail to sanitize Team objects returned by the data retention teams endpoint. An authenticated user with only the read-only Data Retention Policy permission can obtain a private team's secret invite_id and email and join the team without authorization via GET /api/v4/data_retention/policies/{policy_id}/teams.

Mattermost versions 11.9.x <= 11.9.0, 11.8.x <= 11.8.4, 11.7.x <= 11.7.7 failed to validate Dynamic Client Registration redirect URIs by URL component (matching glob patterns against the raw URI string instead) which allows a remote unauthenticated attacker to register an OAuth client with an attacker-controlled callback host that bypasses the configured redirect URI allowlist via a crafted redirect URI that places an allowlisted host/path suffix inside the query string. Mattermost Advisory ID: MMSA-2026-00700

Mattermost versions 11.9.x <= 11.9.0, 11.8.x <= 11.8.4, 11.7.x <= 11.7.8, and 10.11.x <= 10.11.22 fail to limit nesting depth in the server-side Markdown parser, allowing an authenticated attacker to cause denial of service (CPU exhaustion) via a crafted post with deeply nested blockquotes or list items.

Mattermost versions <=11.9, 11.0.9, 11.4.8, 11.7.7, and 10.22.11.0 fail to recover from handler panics, allowing an authenticated user to crash the plugin via a post-action request with an unexpected field type.

Mattermost versions 11.9.x <= 11.9.0, 11.8.x <= 11.8.4, and 11.7.x <= 11.7.7 fail to enforce authorization boundaries on the access control policy update endpoint, allowing a channel or team administrator to detach a system-assigned ABAC parent policy via a crafted PUT /api/v4/access_control_policies request with an empty imports list.

Mattermost versions 11.9.x <= 11.9.0, 11.8.x <= 11.8.4, 11.7.x <= 11.7.7, 10.11.x <= 10.11.22 fail to validate channel member-management permission during playbook run creation, allowing an authenticated channel member to add an arbitrary user to a restricted channel via the run owner field. Mattermost Advisory ID: MMSA-2026-00677

Mattermost versions 11.9.x <= 11.9.0, 11.8.x <= 11.8.4, 11.7.x <= 11.7.7, 10.11.x <= 10.11.22 fail to limit the size of unpacked SDP messages compressed with zlib. An attacker can send many SDP messages that unpack to a large size, causing denial of service or server crash.

Mattermost versions 11.9.x <= 11.9.0, 11.8.x <= 11.8.4, 11.7.x <= 11.7.7, 10.11.x <= 10.11.22 fail to limit the amount of memory allocated when decoding uploaded image files. An authenticated user can cause excessive server memory consumption and potential denial of service by uploading a specially crafted image as a profile picture, channel file attachment, team icon, or custom brand image.

Mattermost versions 11.9.x <= 11.9.0, 11.8.x <= 11.8.4, 11.7.x <= 11.7.7, 10.11.x <= 10.11.22 fail to enforce the board-creation permission. An unauthorized authenticated user can create boards via the board duplicate, boards-and-blocks, and archive-import endpoints.

Mattermost versions 11.9.x <= 11.9.0, 11.8.x <= 11.8.4, 11.7.x <= 11.7.7, 10.11.x <= 10.11.22 fail to enforce board creation permissions when importing archive files. An authenticated non-guest team member can create Open or Private boards despite administrator restrictions by importing a crafted .boardarchive file.

Mattermost versions 11.9.x <= 11.9.0, 11.8.x <= 11.8.4, 11.7.x <= 11.7.7, 10.11.x <= 10.11.22 fail to validate the type of `fields.properties` on block creation. An authenticated user with editor access to a board can crash the Boards plugin worker and trigger a denial of service via a child block whose `fields.properties` is a non-object value.

Mattermost versions 11.9.x <= 11.9.0, 11.8.x <= 11.8.4, 11.7.x <= 11.7.7, 10.11.x <= 10.11.22 fail to parse Markdown autolinks with unmatched trailing closing parentheses in linear time. An authenticated user with permission to create posts can cause excessive server CPU consumption and degrade availability for other users via specially crafted post or message attachment content.

Mattermost versions 11.9.x <= 11.9.0, 11.8.x <= 11.8.4, 11.7.x <= 11.7.7, 10.11.x <= 10.11.22 fail to properly enforce the limit of concurrent files being processed and handled failed files. A user with permission to upload files can spawn more goroutines than intended and block the indexing of other files by constantly uploading heavy files to the server.

Mattermost versions 11.9.x <= 11.9.0, 11.8.x <= 11.8.4, 11.7.x <= 11.7.7, 10.11.x <= 10.11.22 fail to validate null entries in Microsoft Graph webhook notification payloads. An unauthenticated attacker can crash the Microsoft Calendar plugin process and deny calendar integration service to all users on the instance via a crafted POST request to the public webhook endpoint.

Mattermost versions 11.9.x <= 11.9.0, 11.8.x <= 11.8.4, 11.7.x <= 11.7.7, and 10.11.x <= 10.11.22 fail to validate channel action ownership. This allows channel managers to update actions in other channels via the channel action update endpoint.

Mattermost versions 10.11.x <= 10.11.20 and 11.7.x <= 11.7.5 fail to remove thread membership records when a user is removed from or leaves a team, allowing a previously removed user who is later re-invited to view private channel thread root post content and metadata via the team threads API.

Mattermost versions 11.7.x <= 11.7.6, 10.11.x <= 10.11.21, 11.8.x <= 11.8.3 fail to enforce PermissionManageBoardRoles on the channelId field of the batch endpoint, which allows an authenticated board editor to relink any board they can edit to an arbitrary channel via a crafted PATCH request.

Mattermost versions 11.7.x <= 11.7.6, 10.11.x <= 10.11.21, and 11.8.x <= 11.8.3 fail to validate BoardMember.Scheme* fields server-side on insert and archive-import paths, allowing a board editor or non-guest team member to grant board admin to arbitrary users.