Vulnerabilidades do Mattermost Mattermost Server

CVE-2025-55074 Baixa · 3.5 18/11/2025

Channel member objects leak read status

Mattermost versions 10.11.x <= 10.11.3, 10.5.x <= 10.5.11 fail to enforce access permissions on the Agents plugin which allows other users to determine when users had read channels via channel member objects

CVE-2025-11794 Média · 4.9 CWE-200 14/11/2025

Password hash and MFA secret returned in user email verification endpoint

Mattermost versions 10.11.x <= 10.11.3, 10.5.x <= 10.5.11, 10.12.x <= 10.12.0 fail to sanitize user data which allows system administrators to access password hashes and MFA secrets via the POST /api/v4/users/{user_id}/email/verify/member endpoint

CVE-2025-55073 Média · 5.3 CWE-306 14/11/2025

MS Teams plugin OAuth allows editing arbitrary posts

Mattermost versions 10.11.x <= 10.11.3, 10.5.x <= 10.5.11, 10.12.x <= 10.12.0 fail to validate the relationship between the post being updated and the MSTeams plugin OAuth flow which allows an attacker to edit arbitrary posts via a crafted MSTeams plugin OAuth redirect URL.

CVE-2025-55070 Alta · 7.5 CWE-306 14/11/2025

Lack of MFA enforcement in WebSocket connections

Mattermost versions <11 fail to enforce multi-factor authentication on WebSocket connections which allows unauthenticated users to access sensitive information via WebSocket events

CVE-2025-41436 Média · 4.3 CWE-863 14/11/2025

Unauthorized access to archived channel content via threads interface

Mattermost versions <11.0 fail to properly enforce the "Allow users to view archived channels" setting which allows regular users to access archived channel content and files via the "Open in Channel" functionality from followed threads

CVE-2025-11776 Média · 4.3 CWE-863 14/11/2025

Guest user can discover archived public channels

Mattermost versions <11 fail to properly restrict access to archived channel search API which allows guest users to discover archived public channels via the `/api/v4/teams/{team_id}/channels/search_archived` endpoint

CVE-2025-11777 Média · 4.3 CWE-863 13/11/2025

Cross-team channel membership access

Mattermost versions 10.11.x <= 10.11.3, 10.5.x <= 10.5.11 fail to properly validate team membership permissions in the Add Channel Member API which allows users from one team to access user metadata and channel membership information from other teams via the API endpoint

CVE-2025-58075 Alta · 8.1 CWE-862 16/10/2025

Arbitrary Mattermost Team can be joined by manipulating the SAML RelayState

Mattermost versions 10.11.x <= 10.11.1, 10.10.x <= 10.10.2, 10.5.x <= 10.5.10 fail to verify a user has permission to join a Mattermost team using the original invite token which allows any attacked to join any team on a Mattermost server regardless of restrictions via manipulating the RelayState

CVE-2025-58073 Alta · 8.1 CWE-862 16/10/2025

Arbitrary Mattermost Team can be joined by manipulating the OAuth state

Mattermost versions 10.11.x <= 10.11.1, 10.10.x <= 10.10.2, 10.5.x <= 10.5.10 fail to verify a user has permission to join a Mattermost team using the original invite token which allows any attacked to join any team on a Mattermost server regardless of restrictions via manipulating the OAuth state.

CVE-2025-54499 Baixa · 3.7 CWE-208 16/10/2025

Insecure string comparison enables timing attacks

Mattermost versions 10.5.x <= 10.5.10, 10.11.x <= 10.11.2 fail to use constant-time comparison for sensitive string comparisons which allows attackers to exploit timing oracles to perform byte-by-byte brute force attacks via response time analysis on Cloud API keys and OAuth client secrets

CVE-2025-41410 Média · 5.4 CWE-862 16/10/2025

Slack import bypasses email verification for team access controls

Mattermost versions 10.10.x <= 10.10.2, 10.5.x <= 10.5.10, 10.11.x <= 10.11.2 fail to validate email ownership during Slack import process which allows attackers to create verified user accounts with arbitrary email domains via malicious Slack import data to bypass email-based team access restrictions

CVE-2025-10545 Média · 4.3 CWE-863 16/10/2025

Guest user can add unauthorized team users to private channels

Mattermost versions 10.5.x <= 10.5.10, 10.11.x <= 10.11.2 fail to properly validate guest user permissions when adding channel members which allows guest users to add any team members to their private channels via the `/api/v4/channels/{channel_id}/members` endpoint

CVE-2025-41443 Média · 4.3 CWE-862 16/10/2025

Guest user can discover active public channels

Mattermost versions 10.5.x <= 10.5.12, 10.11.x <= 10.11.2 fail to properly validate guest user permissions when accessing channel information which allows guest users to discover active public channels and their metadata via the `/api/v4/teams/{team_id}/channels/ids` endpoint