Path traversal in Mattermost Agents plugin mention reminder allows plugin replacement via crafted post

Team admin can escalate a team member's permissions via the team member roles endpoint

Mattermost OpenID discovery endpoint request bypasses outbound connection filtering, allowing SSRF by a System Administrator

Unbounded memory consumption during PDF text extraction

Mattermost allows authenticated users to trigger excessive memory allocation via crafted msgpack binary WebSocket frames

Improper post type validation on scheduled post endpoints

Insufficient length validation when parsing Zoom chat transcriptions

Null condition in Playbooks import crashes the plugin

Mattermost Server fails to restrict Slack import account binding, allowing team admins to forge posts as existing users

Mattermost local image proxy allows server memory exhaustion via unbounded image response buffering

Private team metadata disclosure via the team search API

Mattermost invitation tokens not bound to invited email address allowing unauthorized team and private channel access

Mattermost fails to reject OAuth application sessions in account type switch, allowing account takeover via bearer token

Improper order of authorisations in Mattermost GetFile API leads to an authenticated user to determine a post’s quarantined status

Mattermost SAML RelayState forgery allows unauthorized team membership

Mattermost logs plaintext authentication tokens in debug-level server logs on failed auth attempts

Mattermost leaks interactive-message integration secrets to non-admin users via post-deletion events and thread reads

Private channel ID disclosure via user status endpoints

Missing server side validation allowed user to quarantine a DM and GM post

Uncapped mention keys in user notification properties allow CPU exhaustion during post processing

Disclosure of AD/LDAP bind password via Test Connection

Mattermost guest account privilege escalation via member roles API

Outgoing OAuth connection client secret exposure during connection validation

Mattermost server missing request body size limit on plugin routes allows denial of service by an authenticated user

Mattermost server-side request forgery via OAuth endpoints configurable by a System Administrator

Unbounded post ID array in the bulk reactions endpoint allows denial of service

Mattermost Desktop App Missing IPC Sender Validation in Calls Leave Handler

Mattermost Desktop App plugin popout scheme validation bypass

Mattermost Desktop local network access from server-rendered content

Data Retention Teams Endpoint Leaks Private Team Invite ID