Mattermost vulnerabilities

Mattermost versions 11.9.x <= 11.9.1, 11.8.x <= 11.8.5, 11.7.x <= 11.7.10, 11.10.x <= 11.10.1 fail to enforce a request body size limit during CSRF validation of plugin requests which allows an authenticated user to exhaust server memory and cause a denial of service via a large request body sent to a plugin endpoint.

Mattermost versions 11.9.x <= 11.9.1, 11.8.x <= 11.8.5, 11.7.x <= 11.7.10, 11.10.x <= 11.10.1 fail to apply the internal-connection filter to OAuth endpoint requests, which allows a System Administrator to make the server issue requests to internal network addresses and read the responses via the configured OAuth token and userinfo endpoints.

Mattermost versions 11.9.x <= 11.9.1, 11.8.x <= 11.8.5, 11.7.x <= 11.7.10, and 11.10.x <= 11.10.1 fail to limit the length of the post ID array accepted by the bulk reactions endpoint, allowing an authenticated user to cause excessive database load via a crafted request to {{POST /api/v4/posts/ids/reactions}}. Advisory ID: MMSA-2026-00771.

Mattermost versions 11.9.x <= 11.9.0, 11.8.x <= 11.8.4, 11.7.x <= 11.7.7, 10.11.x <= 10.11.22 fail to sanitize Team objects returned by the data retention teams endpoint. An authenticated user with only the read-only Data Retention Policy permission can obtain a private team's secret invite_id and email and join the team without authorization via GET /api/v4/data_retention/policies/{policy_id}/teams.

Mattermost versions 11.9.x <= 11.9.0, 11.8.x <= 11.8.4, 11.7.x <= 11.7.7 failed to validate Dynamic Client Registration redirect URIs by URL component (matching glob patterns against the raw URI string instead) which allows a remote unauthenticated attacker to register an OAuth client with an attacker-controlled callback host that bypasses the configured redirect URI allowlist via a crafted redirect URI that places an allowlisted host/path suffix inside the query string. Mattermost Advisory ID: MMSA-2026-00700

Mattermost versions 11.9.x <= 11.9.0, 11.8.x <= 11.8.4, 11.7.x <= 11.7.8, and 10.11.x <= 10.11.22 fail to limit nesting depth in the server-side Markdown parser, allowing an authenticated attacker to cause denial of service (CPU exhaustion) via a crafted post with deeply nested blockquotes or list items.

Mattermost versions <=11.9, 11.0.9, 11.4.8, 11.7.7, and 10.22.11.0 fail to recover from handler panics, allowing an authenticated user to crash the plugin via a post-action request with an unexpected field type.

Mattermost versions 11.9.x <= 11.9.0, 11.8.x <= 11.8.4, and 11.7.x <= 11.7.7 fail to enforce authorization boundaries on the access control policy update endpoint, allowing a channel or team administrator to detach a system-assigned ABAC parent policy via a crafted PUT /api/v4/access_control_policies request with an empty imports list.

Mattermost versions 11.9.x <= 11.9.0, 11.8.x <= 11.8.4, 11.7.x <= 11.7.7, 10.11.x <= 10.11.22 fail to validate channel member-management permission during playbook run creation, allowing an authenticated channel member to add an arbitrary user to a restricted channel via the run owner field. Mattermost Advisory ID: MMSA-2026-00677

Mattermost versions 11.9.x <= 11.9.0, 11.8.x <= 11.8.4, 11.7.x <= 11.7.7, 10.11.x <= 10.11.22 fail to limit the size of unpacked SDP messages compressed with zlib. An attacker can send many SDP messages that unpack to a large size, causing denial of service or server crash.

Mattermost versions 11.9.x <= 11.9.0, 11.8.x <= 11.8.4, 11.7.x <= 11.7.7, 10.11.x <= 10.11.22 fail to limit the amount of memory allocated when decoding uploaded image files. An authenticated user can cause excessive server memory consumption and potential denial of service by uploading a specially crafted image as a profile picture, channel file attachment, team icon, or custom brand image.

Mattermost versions 11.9.x <= 11.9.0, 11.8.x <= 11.8.4, 11.7.x <= 11.7.7, 10.11.x <= 10.11.22 fail to enforce the board-creation permission. An unauthorized authenticated user can create boards via the board duplicate, boards-and-blocks, and archive-import endpoints.

Mattermost versions 11.9.x <= 11.9.0, 11.8.x <= 11.8.4, 11.7.x <= 11.7.7, 10.11.x <= 10.11.22 fail to enforce board creation permissions when importing archive files. An authenticated non-guest team member can create Open or Private boards despite administrator restrictions by importing a crafted .boardarchive file.

Mattermost versions 11.9.x <= 11.9.0, 11.8.x <= 11.8.4, 11.7.x <= 11.7.7, 10.11.x <= 10.11.22 fail to validate the type of `fields.properties` on block creation. An authenticated user with editor access to a board can crash the Boards plugin worker and trigger a denial of service via a child block whose `fields.properties` is a non-object value.

Mattermost versions 11.9.x <= 11.9.0, 11.8.x <= 11.8.4, 11.7.x <= 11.7.7, 10.11.x <= 10.11.22 fail to parse Markdown autolinks with unmatched trailing closing parentheses in linear time. An authenticated user with permission to create posts can cause excessive server CPU consumption and degrade availability for other users via specially crafted post or message attachment content.

Mattermost versions 11.9.x <= 11.9.0, 11.8.x <= 11.8.4, 11.7.x <= 11.7.7, 10.11.x <= 10.11.22 fail to properly enforce the limit of concurrent files being processed and handled failed files. A user with permission to upload files can spawn more goroutines than intended and block the indexing of other files by constantly uploading heavy files to the server.

Mattermost versions 11.9.x <= 11.9.0, 11.8.x <= 11.8.4, 11.7.x <= 11.7.7, 10.11.x <= 10.11.22 fail to validate null entries in Microsoft Graph webhook notification payloads. An unauthenticated attacker can crash the Microsoft Calendar plugin process and deny calendar integration service to all users on the instance via a crafted POST request to the public webhook endpoint.

Mattermost versions 11.9.x <= 11.9.0, 11.8.x <= 11.8.4, 11.7.x <= 11.7.7, and 10.11.x <= 10.11.22 fail to validate channel action ownership. This allows channel managers to update actions in other channels via the channel action update endpoint.

Mattermost versions 10.11.x <= 10.11.20 and 11.7.x <= 11.7.5 fail to remove thread membership records when a user is removed from or leaves a team, allowing a previously removed user who is later re-invited to view private channel thread root post content and metadata via the team threads API.

Mattermost versions 11.7.x <= 11.7.6, 10.11.x <= 10.11.21, 11.8.x <= 11.8.3 fail to enforce PermissionManageBoardRoles on the channelId field of the batch endpoint, which allows an authenticated board editor to relink any board they can edit to an arbitrary channel via a crafted PATCH request.

Mattermost versions 11.7.x <= 11.7.6, 10.11.x <= 10.11.21, and 11.8.x <= 11.8.3 fail to validate BoardMember.Scheme* fields server-side on insert and archive-import paths, allowing a board editor or non-guest team member to grant board admin to arbitrary users.

Mattermost versions 11.7.x <= 11.7.6, 10.11.x <= 10.11.21, and 11.8.x <= 11.8.3 fail to validate WebSocket command field types, allowing an authenticated user to crash the plugin process and deny service to all Boards users via a custom_focalboard_SUBSCRIBE_TEAM message with a non-string teamId.

Mattermost versions 11.8.x <= 11.8.2, 11.7.x <= 11.7.6, 10.11.x <= 10.11.21 fail to restrict channel member role assignment to channel-scoped roles, which allows a channel administrator to gain additional channel permissions via the channel member roles API.

Mattermost versions 11.7.x <= 11.7.6, 10.11.x <= 10.11.21, 11.8.x <= 11.8.3 fail to validate that users have read access to a channel before linking a board to it, which allows an authenticated attacker to discover the membership of private channels on the same team via creating, patching, importing, or bulk-creating boards with an arbitrary channelId.

Mattermost versions 11.7.x <= 11.7.6, 10.11.x <= 10.11.21 fail to enforce run-state validation on write operations for finished playbook runs, which allows a run participant to modify status, checklists, retrospective content, ownership, and participants on completed runs via REST and GraphQL API requests.

Mattermost versions 11.7.x <= 11.7.6, 10.11.x <= 10.11.21 fail to restrict OAuth deauthorization and personal access token management endpoints to direct user sessions, which allowed an OAuth app with a delegated user token to revoke the user's authorizations or tokens for other integrations via account-management endpoints.

Mattermost versions 11.7.x <= 11.7.6, 10.11.x <= 10.11.21 fail to prevent guest users from receiving Board Admin privileges during board archive import, which allows a board member to escalate a guest user to Board Admin via importing a crafted .boardarchive file.

Mattermost versions 11.7.x <= 11.7.6, 11.8.x <= 11.8.3 fail to re-validate that each target channel still belongs to the requesting admin's team when calling the policy unassign endpoint. This allows an authenticated team administrator to remove ABAC policy assignments from channels outside their team after a channel has been moved to another team.

Mattermost versions 11.7.x <= 11.7.6, 10.11.x <= 10.11.21, 11.8.x <= 11.8.3 fail to reconcile SchemeAdmin flags with a user's current role, which allows a user demoted to System Guest to retain Board Admin privileges and perform admin-only operations via the Boards REST API or UI.

Mattermost versions 11.9.x <= 11.9.0, 11.8.x <= 11.8.4, 11.7.x <= 11.7.7, 10.11.x <= 10.11.22 fail to limit decompressed content size and enforce the configured maximum file size in the Boards archive import handler. An authenticated user can cause memory exhaustion or unbounded disk consumption via a crafted .boardarchive file uploaded to the import endpoint.

Mattermost fails to verify file deletion path, allowing an admin with SAML system-console write permissions to delete arbitrary files outside the config directory via the remove file endpoint.

Mattermost versions 11.6.x through 11.6.5, 10.11.x through 10.11.20, 11.8.x through 11.8.1, 11.7.x through 11.7.4 fail to limit the number of frames and enforce the file size cap on animated GIF uploads. An authenticated attacker can cause a denial of service via a crafted animated GIF uploaded as a custom emoji.

Mattermost versions 11.8.x through 11.8.0, 11.7.x through 11.7.3, 11.6.x through 11.6.5, 10.11.x through 10.11.20 fail to bound the time and resource consumption of server-side document content extraction. An authenticated user with file-upload permission can degrade file uploads for all users by repeatedly uploading small documents that are cheap to upload but expensive to extract, saturating the shared extraction worker pool.

A vulnerability in Mattermost versions 11.7.x <= 11.7.2, 11.6.x <= 11.6.4, and 10.11.x <= 10.11.19 fails to check the manage_shared_channels permission in the /share-channel autocomplete handler. This allows an authenticated user without that permission to enumerate configured remote cluster connection metadata via slash command autocomplete.

A vulnerability in Mattermost allows a user with the User Manager role to obtain invite links for private teams via the scheme teams endpoint. Lack of proper sanitization of team objects enables joining or sharing access to those teams.

A vulnerability in Mattermost allows an authenticated user with team access to modify metric settings in another user's playbook via a crafted import or update request with a foreign metric ID. Affected versions are 11.7.x <= 11.7.1, 11.6.x <= 11.6.4, and 10.11.x <= 10.11.19.

A vulnerability in Mattermost allows a user with webhook management permissions to create posts or direct messages attributed to another user. The issue stems from missing validation that the assigned incoming webhook user has access to the target team or channel.

A vulnerability in Mattermost allows a deactivated guest user to obtain an active session using a magic-link token issued before deactivation. The issue affects versions 11.7.x up to 11.7.2 and 11.6.x up to 11.6.4.

A vulnerability in Mattermost versions 11.7.x <= 11.7.2, 11.6.x <= 11.6.4, and 10.11.x <= 10.11.19 fails to invalidate OAuth refresh tokens upon user account deactivation. This allows a deactivated user or an attacker with a valid refresh token to obtain new functional access tokens via the OAuth refresh token grant endpoint.

A vulnerability in Mattermost allows an authenticated attacker to perform a Denial of Service (DoS) attack on all users in a channel. The issue stems from missing validation of the length and content of message attachment field values, causing catastrophic backtracking in the client-side Markdown parser.

A vulnerability in Mattermost allows an authenticated user without access to a private channel to trigger interactive post actions on posts in that channel. The issue stems from a failure to verify that the channel referenced in an action cookie matches the channel of the target post.

A vulnerability in Mattermost allows an authenticated remote cluster to modify or delete posts authored by local users or other remote clusters in shared channels. The issue is due to missing post ownership verification in the shared channel inbound sync handler.

A vulnerability in Mattermost allows an ordinary group or direct message member to remove all participants from a conversation via the channel patch API. This affects versions 11.7.x <= 11.7.2, 11.6.x <= 11.6.4, and 10.11.x <= 10.11.19, where the group_constrained flag is not properly restricted to public and private channels that support group synchronization.

A vulnerability in the Mattermost Agents plugin MCP server allows an attacker with access to the MCP server in stdio mode to perform server-side request forgery (SSRF) by supplying internal URLs as file attachments in post creation requests. Affected versions are 10.11.x <= 10.11.18, 11.6.x <= 11.6.3, and 11.5.x <= 11.5.6.

A vulnerability in Mattermost allows an authenticated attacker to exfiltrate data by injecting Markdown image syntax into AI bot tool result posts. Markdown image rendering restrictions are not properly applied to AI bot tool result posts, enabling data leakage to an attacker-controlled server when rendered by a victim's client.

Mattermost versions 11.7.x <= 11.7.0, 11.6.x <= 11.6.2, 11.5.x <= 11.5.5, and 10.11.x <= 10.11.17 fail to invalidate cached authentication state for active WebSocket connections during global session revocation. This allows a user with an existing WebSocket connection to remain authenticated and continue receiving real-time events until the cached session expires or the client reconnects.

Mattermost versions 11.7.x up to 11.7.0 and 10.11.x up to 10.11.17 fail to enforce bot-specific permission checks on the user active status endpoint. This allows a User Manager with user management write access but no Integrations access to deactivate bot accounts via the PUT /api/v4/users/{id}/active API endpoint.

Mattermost versions 11.7.x <= 11.7.0, 11.6.x <= 11.6.2, 11.5.x <= 11.5.5, and 10.11.x <= 10.11.17 fail to authenticate Atlassian Connect installed callbacks, allowing a remote unauthenticated attacker to inject a rogue sharedSecret and disrupt the Jira integration.

Mattermost versions 11.7.x <= 11.7.0, 11.6.x <= 11.6.2, 11.5.x <= 11.5.5, and 10.11.x <= 10.11.17 fail to validate channel ownership of an existing subscription before applying edits. This allows an authenticated attacker to hijack subscriptions from channels they have no access to via a crafted PUT request to the subscription edit endpoint.

Mattermost versions 11.7.x <= 11.7.0, 11.6.x <= 11.6.2, 11.5.x <= 11.5.5, and 10.11.x <= 10.11.17 fail to enforce administrator authorization on the {{setDefaultInstance}} call within the {{/gitlab connect}} command handler, allowing any authenticated user to overwrite the global default GitLab instance configuration via the {{/gitlab connect <instance-name>}} slash command.