Winfunc

**Nome do Software Vulnerável e Versões Afetadas** Mattermost versões 11.6.x até 11.6.1 Mattermost versões 11.5.x até 11.5.4 Mattermost versões 10.11.x até 10.11.15 **Description** A sanitização insuficiente da resposta da API do Remote Cluster durante operações PATCH permite que usuários autenticados com a permissão `manage secure connections` obtenham tokens de autenticação do cluster remoto. Isso ocorre quando uma requisição PATCH é enviada para o endpoint do cluster remoto. **Recommendations** Atualize as versões 11.6.x até 11.6.1 para uma versão mais recente. Atualize as versões 11.5.x até 11.5.4 para uma versão mais recente. Atualize as versões 10.11.x até 10.11.15 para uma versão mais recente.

**Nome do Software Vulnerável e Versões Afetadas** Mattermost versões anteriores a 11.6.2 Mattermost versões anteriores a 11.5.5 Mattermost versões anteriores a 10.11.17 **Description** Ocorre a falta de autorização de gerenciamento de funções ao definir a flag `scheme admin` nos endpoints de link e patch de sincronização de grupo. Isso permite que um usuário com permissões de link de grupo escale seus próprios privilégios e os de membros do grupo para administrador de equipe ou de canal por meio de requisições de API manipuladas. **Recommendations** Atualize para a versão 11.6.2 ou posterior. Atualize para a versão 11.5.5 ou posterior. Atualize para a versão 10.11.17 ou posterior.

**Name of the Vulnerable Software and Affected Versions** Mattermost versions 10.11.x through 10.11.11 Mattermost versions 11.2.x through 11.2.3 Mattermost versions 11.3.x through 11.3.1 Mattermost versions 11.4.x through 11.4.0 **Description** The software fails to properly set permissions on downloaded bulk exports. This allows other local users on the server to read the contents of the exported data. **Recommendations** Update Mattermost versions prior to 10.11.12. Update Mattermost versions prior to 11.2.4. Update Mattermost versions prior to 11.3.2. Update Mattermost versions prior to 11.4.1.

**Name of the Vulnerable Software and Affected Versions** Mattermost versions 10.11.x through 10.11.10 Mattermost versions 11.2.x through 11.2.2 Mattermost versions 11.3.x through 11.3.1 Mattermost versions 11.4.x through 11.4.0 **Description** The software does not properly sanitize user-controlled post content in the terminal output of `mmctl` commands. This allows attackers to manipulate administrator terminals through crafted messages containing ANSI and OSC escape sequences. These sequences can enable screen manipulation, display fake prompts, and hijack the clipboard. The Mattermost Advisory ID for this issue is MMSA-2026-00599. **Recommendations** Update Mattermost to a version beyond 10.11.10. Update Mattermost to a version beyond 11.2.2. Update Mattermost to a version beyond 11.3.1. Update Mattermost to a version beyond 11.4.0.

**Name of the Vulnerable Software and Affected Versions** Mattermost versions 10.11.x through 10.11.11 Mattermost versions 11.2.x through 11.2.3 Mattermost versions 11.3.x through 11.3.1 Mattermost versions 11.4.x through 11.4.0 **Description** The software does not properly validate the size of decompressed archive entries when extracting files. This allows authenticated users who have file upload permissions to cause a denial of service by uploading specially crafted zip archives. These archives contain highly compressed entries, known as zip bombs, which can exhaust server memory. **Recommendations** Update Mattermost to a version later than 10.11.11. Update Mattermost to a version later than 11.2.3. Update Mattermost to a version later than 11.3.1. Update Mattermost to a version later than 11.4.0.

**Name of the Vulnerable Software and Affected Versions** Mattermost versions 10.11.x through 10.11.10 Mattermost versions 11.2.x through 11.2.2 Mattermost versions 11.3.x through 11.3.1 Mattermost versions 11.4.x through 11.4.0 **Description** The application fails to enforce view restrictions when retrieving group member IDs. This allows authenticated guest users to enumerate user IDs outside of their permitted visibility scope through the group retrieval **API endpoint**. The `group retrieval` endpoint allows unauthorized access to user IDs. **Recommendations** Mattermost versions 10.11.x through 10.11.10 should be updated. Mattermost versions 11.2.x through 11.2.2 should be updated. Mattermost versions 11.3.x through 11.3.1 should be updated. Mattermost versions 11.4.x through 11.4.0 should be updated.

**Name of the Vulnerable Software and Affected Versions** Mattermost versions 10.11.x through 10.11.10 Mattermost versions 11.2.x through 11.2.2 Mattermost versions 11.3.x through 11.3.0 **Description** The software does not properly validate User-Agent header tokens. This allows an authenticated attacker to cause a request panic by using a specially crafted User-Agent header. The `User-Agent` header is the target of this issue. **Recommendations** Update Mattermost to a version later than 10.11.10. Update Mattermost to a version later than 11.2.2. Update Mattermost to a version later than 11.3.0.

**Name of the Vulnerable Software and Affected Versions** Mattermost versions 10.11.x through 10.11.10 Mattermost versions 11.2.x through 11.2.2 Mattermost versions 11.3.x through 11.3.0 **Description** The software does not properly normalize IPv4-mapped IPv6 addresses before validating reserved IP addresses. This allows an attacker to perform Server-Side Request Forgery (SSRF) attacks against internal services using IPv4-mapped IPv6 literals, such as `[::ffff:127.0.0.1]`. SSRF is a web security flaw that allows an attacker to cause the server to make HTTP requests to an arbitrary domain of the attacker's choosing. **Recommendations** Update Mattermost to a version beyond 10.11.10. Update Mattermost to a version beyond 11.2.2. Update Mattermost to a version beyond 11.3.0.

**Name of the Vulnerable Software and Affected Versions** Mattermost versions 11.3.0 and earlier Mattermost versions 11.2.2 and earlier Mattermost versions 10.11.10 and earlier **Description** The software does not correctly manage very long passwords. This allows an attacker to exhaust server resources, specifically CPU and memory, by repeatedly attempting to log in with excessively large passwords. The issue is present in the `github.com/mattermost/mattermost-server` module prior to version `v5.3.2-0.20260129164748-7201f42d955f`. **Recommendations** Update Mattermost to a version later than 11.3.0. Update Mattermost to a version later than 11.2.2. Update Mattermost to a version later than 10.11.10. Update the `github.com/mattermost/mattermost-server` module to version `v5.3.2-0.20260129164748-7201f42d955f` or later.

**Name of the Vulnerable Software and Affected Versions** Mattermost versions 10.11.0 through 10.11.10 Mattermost versions 11.2.0 through 11.2.2 Mattermost versions 11.3.0 **Description** Mattermost does not consistently handle error responses when processing the `/mute` command. This allows an authenticated team member to identify private channels they are not authorized to access by observing differing error messages for nonexistent versus private channels. The issue occurs due to inconsistent error messaging when attempting to mute a user in a channel they are not a member of. **Recommendations** Mattermost versions 10.11.0 through 10.11.10 should be updated. Mattermost versions 11.2.0 through 11.2.2 should be updated. Mattermost version 11.3.0 should be updated.