github.com/mattermost/mattermost/server/v8 vulnerabilities

Browse known CVEs and advisories by package and ecosystem. Severity tells you the worst case. What determines real risk is whether the vulnerable code actually runs in your applications.

Browse by ecosystem

npm PyPI Maven Go RubyGems Cargo NuGet Composer pub Swift GitHub Actions

CVE-IDSeverityPackage summary

CVE-2025-1412Lowgithub.com/mattermost/mattermost/server/v8: Mattermost fails to invalidate all active sessions when converting a user to a bot CVE-2025-20051Criticalgithub.com/mattermost/mattermost/server/v8: Mattermost allows reading arbitrary files CVE-2025-20621Mediumgithub.com/mattermost/mattermost/server/v8: Mattermost webapp crash via a crafted post CVE-2025-20088Mediumgithub.com/mattermost/mattermost/server/v8: Mattermost fails to properly validate post props CVE-2025-20086Mediumgithub.com/mattermost/mattermost/server/v8: Mattermost fails to properly validate post props CVE-2025-21088Mediumgithub.com/mattermost/mattermost/server/v8: Mattermost Incorrect Type Conversion or Cast CVE-2025-22449Lowgithub.com/mattermost/mattermost/server/v8: Mattermost Incorrect Authorization vulnerability CVE-2025-20033Mediumgithub.com/mattermost/mattermost/server/v8: Mattermost Improper Validation of Specified Type of Input vulnerability CVE-2025-22445Lowgithub.com/mattermost/mattermost/server/v8: Mattermost has Improper Check for Unusual or Exceptional Conditions CVE-2024-54682Mediumgithub.com/mattermost/mattermost/server/v8: Mattermost Data Amplification vulnerability CVE-2024-54083Mediumgithub.com/mattermost/mattermost/server/v8: Mattermost Improper Validation of Specified Type of Input vulnerability CVE-2024-48872Mediumgithub.com/mattermost/mattermost/server/v8: Mattermost Race Condition vulnerability CVE-2024-47401Mediumgithub.com/mattermost/mattermost/server/v8: Mattermost Server vulnerable to application crash from attacker-generated large response CVE-2024-50052Mediumgithub.com/mattermost/mattermost/server/v8: Mattermost server allows authenticated user to delete arbitrary post CVE-2024-46872Mediumgithub.com/mattermost/mattermost/server/v8: Mattermost Server Path Traversal vulnerability that leads to Cross-Site Request Forgery CVE-2024-10241Mediumgithub.com/mattermost/mattermost/server/v8: Mattermost Server allows user to get private channel names CVE-2024-10214Lowgithub.com/mattermost/mattermost/server/v8: Mattermost incorrectly issues two sessions when using desktop SSO CVE-2024-47003Mediumgithub.com/mattermost/mattermost/server/v8: Mattermost fails to strip `embeds` from `metadata` when broadcasting `posted` events CVE-2024-43780Mediumgithub.com/mattermost/mattermost/server/v8: Mattermost allows guest user with read access to upload files to a channel CVE-2024-42497Highgithub.com/mattermost/mattermost/server/v8: Mattermost allows user with systems manager role with read-only access to teams to perform write…CVE-2024-40884Mediumgithub.com/mattermost/mattermost/server/v8: Mattermost allows team admin user without "Add Team Members" permission to disable invite URL CVE-2024-39836Mediumgithub.com/mattermost/mattermost/server/v8: Mattermost allows remote/synthetic users to create sessions, reset passwords CVE-2024-32939Mediumgithub.com/mattermost/mattermost/server/v8: Mattermost doesn't redact remote users' original email addresses CVE-2024-40886Mediumgithub.com/mattermost/mattermost/server/v8: Mattermost Cross-Site Request Forgery vulnerability CVE-2024-8071Mediumgithub.com/mattermost/mattermost/server/v8: Mattermost doesn't restrict which roles can promote a user as system admin

Stop the waste.
Protect your environment with Kodem.

Get a personalized demo

Get a personalized demo