Mattermost vulnerabilities

Mattermost versions 11.6.x <= 11.6.1, 11.5.x <= 11.5.4, and 10.11.x <= 10.11.16 fail to require role-management authorization when setting the scheme_admin flag on group syncable link and patch endpoints, allowing a user with group-link permissions to escalate themselves and group members to team or channel admin via crafted API requests.

Mattermost versions 11.6.x <= 11.6.1, 11.5.x <= 11.5.4, and 10.11.x <= 10.11.15 fail to sanitize the Remote Cluster API response on PATCH operations. This allows authenticated users with the {{manage_secure_connections}} permission to obtain remote cluster authentication tokens via a PATCH request to the remote cluster endpoint.

Mattermost versions 11.6.x <= 11.6.1, 11.5.x <= 11.5.4, and 10.11.x <= 10.11.16 have a vulnerability that allows improper processing of the FileInfo.Name received from federated peers. An attacker controlling a federated server can exploit this vulnerability to write files to arbitrary locations within the target server's filestore via path traversal sequences in the filename field.

Mattermost versions 11.6.x <= 11.6.1, 11.5.x <= 11.5.4, and 10.11.x <= 10.11.16 fail to require system-level permission when patching protected default system roles. This allows authenticated users with delegated user-management permissions to escalate privileges by altering built-in role permissions via the role patch API.

Mattermost versions 11.6.x <= 11.6.1, 11.5.x <= 11.5.4, and 10.11.x <= 10.11.16 fail to enforce proper permissions when creating teams, allowing authenticated users with PermissionCreateTeam but without PermissionInviteUser to modify team invite settings.

Mattermost versions 11.6.x <= 11.6.1, 11.5.x <= 11.5.4, and 10.11.x <= 10.11.16 fail to validate that a username returned during bot registration belongs to a bot account. This allows an unprivileged attacker to intercept private messages sent by plugins via direct message channels by pre-registering a user account with a predictable plugin bot username.

Mattermost versions 11.6.x <= 11.6.1, 11.5.x <= 11.5.4, and 10.11.x <= 10.11.15 and 10.11.x <= 10.11.16 fail to restrict 'role_updated' websocket event broadcasts to members of the affected team or channel. This allows an authenticated attacker with guest-level access to observe permission scheme change notifications for private teams they are not a member of.

In Mattermost versions 11.6.0, 11.5.x <= 11.5.3, 11.4.x <= 11.4.4, 10.11.x <= 10.11.14, nil elements are not filtered from outgoing webhook attachment payloads before processing. An authenticated user can cause a denial of service (server process termination) via a crafted webhook callback response containing a null attachment entry.

Mattermost versions 11.6.0, 11.5.x up to 11.5.3, 11.4.x up to 11.4.4, and 10.11.x up to 10.11.14 fail to validate the OAuth token scope on the callback, allowing an authenticated user to gain access to private repositories by modifying the scope parameter in the GitHub authorization URL.

Mattermost versions 11.6.x <= 11.6.0, 11.5.x <= 11.5.2, 11.5.x <= 11.5.3, 11.4.x <= 11.4.4, 10.11.x <= 10.11.14 fail to validate the TIFF IFD offset in the image header before allocating memory, allowing authenticated users with file upload or posting permissions to cause a denial of service (server OOM) via uploading a crafted TIFF file or posting a URL that serves one.

Mattermost versions 11.6.x <= 11.6.0, 11.5.x <= 11.5.3, 11.4.x <= 11.4.4, 10.11.x <= 10.11.14 fail to properly validate msgpack-encoded WebSocket frames before memory allocation, allowing an unauthenticated remote attacker to crash the server process and cause a full service outage via a crafted binary WebSocket message.

Mattermost versions 11.6.x <= 11.6.0, 11.5.x <= 11.5.3, 11.4.x <= 11.4.4, 10.11.x <= 10.11.14 fail to enforce request body size limits on plugin HTTP endpoints, allowing an attacker to cause a denial of service via crafted oversized HTTP requests.

Mattermost versions 11.6.x <= 11.6.0, 11.5.x <= 11.5.3, 11.4.x <= 11.4.4, 10.11.x <= 10.11.14 fail to validate user-supplied input in API request handlers, allowing an authenticated attacker to crash the plugin process via a crafted HTTP request to the PR details endpoint.

Mattermost versions 11.6.x <= 11.6.0, 11.5.x <= 11.5.3, 11.4.x <= 11.4.4, 10.11.x <= 10.11.14 fail to archive the channel before removing persistent notifications, allowing an authenticated user to crash the server by timing the creation of a persistent notification message between the server deleting existing persistent notifications and archiving the channel.

Mattermost versions 11.6.x <= 11.6.0, 11.5.x <= 11.5.3, 11.4.x <= 11.4.4, 10.11.x <= 10.11.14 fail to sanitize team member data when returned via API to users without elevated permissions which allows a user without permissions to get data about team members roles via invoking various team API endpoints.

Mattermost versions 11.6.x <= 11.6.0, 11.5.x <= 11.5.3, 11.4.x <= 11.4.4, 10.11.x <= 10.11.14 fail to validate file ownership and access control, allowing an authenticated user to access and download files belonging to other users or teams via crafted Boards API requests using valid file IDs.

Mattermost versions 11.6.x through 11.6.0, 11.5.x through 11.5.3, 11.4.x through 11.4.4, and 10.11.x through 10.11.14 fail to properly validate integration URLs for path traversal. This allows a malicious authenticated user to call arbitrary APIs using the system admin's Mattermost auth token via path traversal in the integration action URL.

Mattermost versions 11.5.x <= 11.5.1 fail to validate team-level run_create permission against the target team when creating a playbook run, allowing an authenticated team member to create runs in teams where they lack permission by specifying a different team ID in the API request.

Mattermost versions 10.11.x <= 10.11.5, 11.0.x <= 11.0.4, 10.12.x <= 10.12.2 fail to invalidate remote cluster invite tokens when using the legacy (version 1) protocol or when the confirming party does not provide a refreshed token. This allows an attacker who has obtained an invite token to authenticate as the remote cluster and perform limited actions on shared channels even after the invitation has been legitimately confirmed.

Mattermost versions 11.0.x through 11.0.4, 10.12.x through 10.12.2, and 10.11.x through 10.11.6 fail to validate the UTF-8 format of the WebSocket request field, allowing an attacker to crash the Calls plugin by sending a malformed request.

Mattermost versions 10.11.x up to 10.11.4 fail to validate redirect URLs on the /error page. An attacker can redirect a victim to a malicious site via a crafted link opened in a new tab.

Mattermost versions 11.0.x <= 11.0.4, 10.12.x <= 10.12.2, 10.11.x <= 10.11.6 and Mattermost Calls <= 1.10.0 fail to implement CSRF protection on the Calls widget page. An authenticated attacker can initiate calls and inject messages into channels or direct messages via a malicious webpage or crafted link.

Mattermost versions 10.11.x <= 10.11.6 and Mattermost GitHub plugin versions <=2.4.0 fail to validate plugin bot identity in reaction forwarding. This allows attackers to hijack the GitHub reaction feature to make users add reactions to arbitrary GitHub objects via crafted notification posts.

Mattermost fails to restrict which parameters' values it takes from the request during signup, allowing an attacker to register users as inactive. This blocks them from later accessing Mattermost without the system admin activating their accounts.

Mattermost fails to sanitize post metadata during audit logging, resulting in permalinks contents being logged.

Mattermost fails to properly validate the requesting user permissions when updating a system admin, allowing a user manager to update a system admin's details such as email, first name and last name.

Mattermost fails to check if the requesting user is a guest, allowing guests to view, join, edit, export, and archive public playbooks.

Mattermost fails to delete the attachments when deleting a message in a thread, allowing a simple user to still access and download the attachment of a deleted message.

Mattermost fails to properly validate a gif image file, allowing an attacker to consume a significant amount of server resources, making the server unresponsive for an extended period of time.

Mattermost fails to properly validate markdown, allowing an attacker to crash the server via a specially crafted markdown input.

Mattermost fails to invalidate previously generated password reset tokens when a new reset token is created.

Mattermost fails to properly show information in the UI, allowing a system admin to modify a board state. This allows any user with a valid sharing link to join the board with editor access, without the UI showing the updated permissions.

Mattermost fails to disable public Boards after the 'Enable Publicly-Shared Boards' configuration option is disabled, resulting in previously-shared public Boards to remain accessible.

Mattermost fails to properly check the authorization of POST /api/v4/teams when passing a team override scheme ID in the request. This allows an authenticated attacker with knowledge of a Team Override Scheme ID to create a new team with said team override scheme.

Mattermost fails to verify channel membership when linking a board to a channel, allowing a low-privileged authenticated user to link a Board to a private channel they don't have access to.

Mattermost fails to properly validate the origin of a websocket connection, allowing a MITM attacker to access the websocket APIs.

Mattermost fails to properly restrict requests to localhost/intranet during the interactive dialog, which could allow an attacker to perform a limited blind SSRF.