Vulnerabilidades de Mattermost
CVEs publicadas que afetam produtos de Mattermost: 207 registro(s), com severidade, exploração e correções.
Mattermost 202Mattermost Server 163Mattermost Desktop 16Zoom 2Focalboard 2Legal Hold 2Mattermost Mobile 2Ms Teams 1Google Drive 1Confluence 1Mattermost Google Drive Plugin 1Github.com/mattermost/mattermost/server/public 1Mattermost Confluence Plugin 1
CVE-2025-58075
Alta · 8.1
CWE-862 16/10/2025
Arbitrary Mattermost Team can be joined by manipulating the SAML RelayState
Mattermost versions 10.11.x <= 10.11.1, 10.10.x <= 10.10.2, 10.5.x <= 10.5.10 fail to verify a user has permission to join a Mattermost team using the original invite token which allows any attacked to join any team on a Mattermost server regardless of restrictions via manipulating the RelayState
CVE-2025-58073
Alta · 8.1
CWE-862 16/10/2025
Arbitrary Mattermost Team can be joined by manipulating the OAuth state
Mattermost versions 10.11.x <= 10.11.1, 10.10.x <= 10.10.2, 10.5.x <= 10.5.10 fail to verify a user has permission to join a Mattermost team using the original invite token which allows any attacked to join any team on a Mattermost server regardless of restrictions via manipulating the OAuth state.
CVE-2025-54499
Baixa · 3.7
CWE-208 16/10/2025
Insecure string comparison enables timing attacks
Mattermost versions 10.5.x <= 10.5.10, 10.11.x <= 10.11.2 fail to use constant-time comparison for sensitive string comparisons which allows attackers to exploit timing oracles to perform byte-by-byte brute force attacks via response time analysis on Cloud API keys and OAuth client secrets
CVE-2025-41410
Média · 5.4
CWE-862 16/10/2025
Slack import bypasses email verification for team access controls
Mattermost versions 10.10.x <= 10.10.2, 10.5.x <= 10.5.10, 10.11.x <= 10.11.2 fail to validate email ownership during Slack import process which allows attackers to create verified user accounts with arbitrary email domains via malicious Slack import data to bypass email-based team access restrictions
CVE-2025-10545
Média · 4.3
CWE-863 16/10/2025
Guest user can add unauthorized team users to private channels
Mattermost versions 10.5.x <= 10.5.10, 10.11.x <= 10.11.2 fail to properly validate guest user permissions when adding channel members which allows guest users to add any team members to their private channels via the `/api/v4/channels/{channel_id}/members` endpoint
CVE-2025-41443
Média · 4.3
CWE-862 16/10/2025
Guest user can discover active public channels
Mattermost versions 10.5.x <= 10.5.12, 10.11.x <= 10.11.2 fail to properly validate guest user permissions when accessing channel information which allows guest users to discover active public channels and their metadata via the `/api/v4/teams/{team_id}/channels/ids` endpoint
CVE-2025-58084
Média · 6.5
CWE-1287 13/10/2025
Mattermost Desktop App crashes when clicking on malformed external URL
Mattermost Desktop App versions <= 5.13.0 fail to validate URLs external to the configured Mattermost servers, allowing an attacker on a server the user has configured to crash the user's application by sending the user a malformed URL.