Daw10

**Name of the Vulnerable Software and Affected Versions** Mattermost version 11.6.0 Mattermost version 11.5.3 Mattermost version 11.4.4 Mattermost version 10.11.14 **Description** An issue exists where the system fails to filter nil elements from outgoing webhook attachment payloads before processing. This allows an authenticated user to cause a denial of service, resulting in server process termination, by sending a crafted webhook callback response that contains a null attachment entry. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Mattermost version 11.6.0 Mattermost version 11.5.3 Mattermost version 11.4.4 Mattermost version 10.11.14 **Description** An issue exists where the system fails to archive the channel before removing persistent notifications. This allows an authenticated user to cause a server crash by timing the creation of a persistent notification message to occur between the server deleting existing persistent notifications and the archiving of the channel, resulting in a denial of service. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Mattermost version 11.6.0 Mattermost version 11.5.3 Mattermost version 11.4.4 Mattermost version 10.11.14 **Description** An authenticated user can perform path traversal in the integration action URL. This occurs because the software fails to properly validate the integration URL, allowing the user to call an arbitrary API using the system admin Mattermost authentication token. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Mattermost versions 11.5.0 through 11.5.1 Mattermost versions 10.11.0 through 10.11.13 Mattermost versions 11.4.0 through 11.4.3 **Description** An issue exists during shared channel membership sync where the system fails to validate if a remote cluster has access to a channel before processing membership removal requests. This allows a malicious remote cluster to remove any user from any channel, including private channels, by sending crafted membership sync messages targeting channels the remote cluster is not authorized to access. **Recommendations** Update Mattermost versions 11.5.0 through 11.5.1 to a version newer than 11.5.1. Update Mattermost versions 10.11.0 through 10.11.13 to a version newer than 10.11.13. Update Mattermost versions 11.4.0 through 11.4.3 to a version newer than 11.4.3.

**Name of the Vulnerable Software and Affected Versions** Mattermost versions 11.5.x through 11.5.1 **Description** An issue exists where channel membership is not verified during the processing of AI-assisted message rewrites. This allows an authenticated attacker to read the content of threads in private channels and direct messages they are not authorized to access by sending a crafted request to the 'post rewrite' endpoint. **Recommendations** Update Mattermost to a version later than 11.5.1.

**Name of the Vulnerable Software and Affected Versions** Mattermost Plugins versions prior to 11.5 **Description** The Gitlab plugin fails to properly check for permissions when processing commands. This allows standard users to uninstall instances or configure webhook connections by using the "/gitlab instance {option}" and "/gitlab webhook {option}" commands. **Recommendations** Update to a version later than 11.5. As a temporary workaround, restrict the use of the "/gitlab instance" and "/gitlab webhook" commands.

**Name of the Vulnerable Software and Affected Versions** Mattermost versions 11.5.0 through 11.5.1 Mattermost versions 10.11.0 through 10.11.13 **Description** Insufficient token rotation validation occurs during remote cluster invite confirmation. An authenticated attacker can bypass token rotation and reuse the original invite token by sending a crafted invite confirmation where the `RefreshedToken` matches the original token. **Recommendations** Update versions 11.5.0 through 11.5.1 to a version newer than 11.5.1. Update versions 10.11.0 through 10.11.13 to a version newer than 10.11.13.

**Name of the Vulnerable Software and Affected Versions** Mattermost versions 10.11.x through 10.11.12 **Description** Improper validation of user ownership within the Connected Workspaces feature allows a malicious remote server to change the displayed status of local users via the Connected Workspaces API. **Recommendations** Update to a version later than 10.11.12.

**Name of the Vulnerable Software and Affected Versions** Mattermost versions 10.11.0 through 10.11.10 Mattermost versions 11.2.0 through 11.2.2 Mattermost versions 11.3.0 through 11.3.1 Mattermost versions 11.4.0 **Description** The software does not properly restrict team-level access when processing membership synchronization from a remote cluster. This allows a malicious remote cluster to grant a user access to an entire private team instead of only the shared channel. This is achieved by sending crafted membership synchronization messages that trigger team membership assignment. **Recommendations** Update Mattermost to a version later than 10.11.10. Update Mattermost to a version later than 11.2.2. Update Mattermost to a version later than 11.3.1. Update Mattermost to a version later than 11.4.0.

**Name of the Vulnerable Software and Affected Versions** Mattermost versions 10.11.x through 10.11.9 Mattermost versions 11.1.x through 11.1.2 Mattermost versions 11.2.x through 11.2.1 **Description** The software does not properly sanitize sensitive data within WebSocket messages. This allows authenticated users to obtain password hashes and multi-factor authentication secrets by exploiting profile nickname updates or email verification events. **Recommendations** Update Mattermost to a version later than 10.11.9. Update Mattermost to a version later than 11.1.2. Update Mattermost to a version later than 11.2.1.

**Name of the Vulnerable Software and Affected Versions** Mattermost versions 10.11.x through 10.11.9 Mattermost versions 11.1.x through 11.1.2 Mattermost versions 11.2.x through 11.2.1 **Description** The software does not properly validate login method restrictions. This allows an authenticated user to bypass Single Sign-On (SSO)-only login requirements by using userID-based authentication. The Mattermost Advisory ID for this issue is MMSA-2025-00548. **Recommendations** Update Mattermost to a version later than 10.11.9. Update Mattermost to a version later than 11.1.2. Update Mattermost to a version later than 11.2.1.

**Name of the Vulnerable Software and Affected Versions** Mattermost versions 11.1.x through 11.1.2 Mattermost versions 10.11.x through 10.11.9 Mattermost versions 11.2.x through 11.2.1 Mattermost Plugin Zoom versions through 1.11.0 **Description** The Mattermost application and its Zoom plugin do not properly verify user authorization when handling requests. Specifically, the system fails to validate the authenticated user when processing requests to the `/plugins/zoom/api/v1/channel-preference` API endpoint. This allows any authenticated user to modify Zoom meeting restrictions for any channel by sending specially crafted API requests. The vulnerable function is not explicitly mentioned. **Recommendations** Update Mattermost to a version later than 11.1.2. Update Mattermost to a version later than 10.11.9. Update Mattermost to a version later than 11.2.1. Update the Mattermost Zoom Plugin to a version later than 1.11.0.

**Name of the Vulnerable Software and Affected Versions** Mattermost versions 11.1.x through 11.1.2 Mattermost versions 10.11.x through 10.11.9 Mattermost versions 11.2.x through 11.2.1 Mattermost Plugin Zoom versions through 1.11.0 **Description** The software does not properly validate user identity and post ownership. This allows unauthorized users to initiate Zoom meetings as any user and modify posts through direct API calls with manipulated user IDs and post data. The issue affects the `/api/v1/askPMI` endpoint. The `user id` and `post data` are vulnerable parameters used in the API calls. **Recommendations** Update Mattermost to a version later than 11.1.2. Update Mattermost to a version later than 10.11.9. Update Mattermost to a version later than 11.2.1. Update Mattermost Plugin Zoom to a version later than 1.11.0.

**Name of the Vulnerable Software and Affected Versions** Mattermost versions 10.11.x through 10.11.10 **Description** Mattermost does not properly validate a user's authentication method when processing an account authentication type switch. This allows an authenticated attacker to change an account password without confirmation by falsely claiming a different authentication provider. The issue is present in the `github.com/mattermost/mattermost-server` module before version `v5.3.2-0.20260127144908-ced9a56e3988`. **Recommendations** Update Mattermost to a version later than 10.11.10. Update the `github.com/mattermost/mattermost-server` module to version `v5.3.2-0.20260127144908-ced9a56e3988` or later.

**Name of the Vulnerable Software and Affected Versions** Mattermost versions 11.3.0 and earlier Mattermost versions 11.2.2 and earlier Mattermost versions 10.11.10 and earlier **Description** The software does not properly sanitize client-supplied post metadata. This allows an authenticated attacker to spoof permalink embeds, impersonating other users by sending crafted PUT requests to the post update API endpoint, ''/api/v1/posts/{post id}''. The vulnerable parameter is the post metadata within the PUT request. **Recommendations** Update Mattermost to a version later than 11.3.0. Update Mattermost to a version later than 11.2.2. Update Mattermost to a version later than 10.11.10.

**Name of the Vulnerable Software and Affected Versions** Mattermost versions 10.11.x through 10.11.10 Mattermost versions 11.2.x through 11.2.2 Mattermost versions 11.3.x through 11.3.0 **Description** The software does not properly restrict plugin installation on CI test instances when using default administrator credentials. This allows an unauthenticated attacker to achieve remote code execution and potentially exfiltrate sensitive configuration data, including AWS and SMTP credentials. The attacker achieves this by uploading a malicious plugin after modifying the import directory. **Recommendations** Mattermost versions 10.11.x through 10.11.10 should be updated to a newer, secure version. Mattermost versions 11.2.x through 11.2.2 should be updated to a newer, secure version. Mattermost versions 11.3.x through 11.3.0 should be updated to a newer, secure version.

**Name of the Vulnerable Software and Affected Versions** Mattermost Confluence plugin versions prior to 1.7.0 **Description** The Mattermost Confluence plugin does not properly sanitize user-controlled display names when rendering HTML templates. This allows authenticated Confluence users with malicious display names to execute arbitrary JavaScript in a victim’s browser. The issue occurs when a specially crafted OAuth2 connection link is sent and visited, rendering the attacker’s display name without proper sanitization. The vulnerable component is the HTML template rendering process. The `display name` is the vulnerable parameter. **Recommendations** Update the Mattermost Confluence plugin to version 1.7.0 or later.

**Name of the Vulnerable Software and Affected Versions** Mattermost versions 10.11.x through 10.11.5 Mattermost versions 11.0.x through 11.0.4 Mattermost versions 10.12.x through 10.12.2 **Description** The software does not invalidate invite tokens after they are used. This allows a malicious actor who has intercepted an invite token to manipulate channel memberships. Specifically, they can add or remove users from private channels by replaying the token. The attack involves the replay of invite tokens. **Recommendations** Update Mattermost to a version later than 10.11.5. Update Mattermost to a version later than 11.0.4. Update Mattermost to a version later than 10.12.2.

**Name of the Vulnerable Software and Affected Versions** Mattermost versions 10.11.x through 10.11.8 Mattermost versions 11.1.x through 11.1.1 Mattermost versions 11.0.x through 11.0.6 **Description** The software contains a flaw that does not prevent infinite re-renders when API errors occur. Authenticated users can trigger unbounded component re-render loops, leading to application-level Denial of Service (DoS). **Recommendations** Update Mattermost to a version later than 10.11.8. Update Mattermost to a version later than 11.1.1. Update Mattermost to a version later than 11.0.6.

**Name of the Vulnerable Software and Affected Versions** Mattermost versions 10.5.x through 10.5.12 Mattermost versions 10.11.x through 10.11.4 Mattermost versions 10.12.x through 10.12.1 Mattermost versions 11.0.x through 11.0.3 **Description** The Mattermost application contains a flaw in the implementation of its authentication algorithm. This issue allows an authenticated attacker with team creation or admin privileges to take over any user account by manipulating authentication data during the OAuth completion flow. The issue stems from improper validation of OAuth state tokens during OpenID Connect authentication. This requires email verification to be disabled and OAuth/OpenID Connect to be enabled. The attacker must control two users in the SSO system, with one of them never having logged into Mattermost. **Recommendations** Mattermost versions 10.5.x through 10.5.12: Update to a newer, fixed version. Mattermost versions 10.11.x through 10.11.4: Update to a newer, fixed version. Mattermost versions 10.12.x through 10.12.1: Update to a newer, fixed version. Mattermost versions 11.0.x through 11.0.3: Update to a newer, fixed version.