Is github.com/mattermost/mattermost safe ? github.com/mattermost/mattermost (go) has 11 known vulnerabilities, the worst rated HIGH. No single fixed version is recorded that clears every advisory, so check each one below. No malicious-package signal is recorded.
// reach 5 direct dependencies
1 carry known advisories, worst HIGH
0 packages depend on it
an advisory here reaches each of them
// ai model usage Tracked for PyPI packages. HuggingFace models declare Python dependencies, so go packages are not covered.
cvss CVSS v3.1 base score out of 10; GitHub rates it HIGH
epss chance of exploitation in 30 days, 30th percentile of all CVEs
xyz score CyberXYZ composite out of 10
fig. 01 — GHSA-vg67-chm7-8m3j, the advisory selected below
// 11 advisories GHSA-vg67-chm7-8m3j Mattermost versions 9.9.x <= 9.9.0, 9.5.x <= 9.5.6, 9.7.x <= 9.7.5, 9.8.x <= 9.8.1 fail to properly validate synced posts, when shared channels are enabled… HIGH GHSA-x3r8-2hmh-89f5 Mattermost versions 10.11.x < 10.11.5, 11.0.x < 11.0.4, 10.12.x < 10.12.2 fail to invalidate remote cluster invite tokens when using the legacy (version 1)… MODE GHSA-p6gj-jc38-x2m7 Mattermost versions 11.0.x <= 11.0.2, 10.12.x <= 10.12.1, 10.11.x <= 10.11.4, 10.5.x <= 10.5.12 fail to validate user permissions when deleting comments in… MODE GHSA-j6gg-r5jc-47cm Mattermost versions < 11 fail to properly restrict access to archived channel search API which allows guest users to discover archived public channels via the… MODE GHSA-9fpw-c9x7-cv3j Mattermost versions 9.9.x <= 9.9.0 and 9.5.x <= 9.5.6 fail to validate the source of sync messages and only allow the correct remote IDs, which allows a… MODE GHSA-jr9x-3x7m-4j75 Mattermost versions 9.9.x <= 9.9.0, 9.5.x <= 9.5.6, 9.7.x <= 9.7.5 and 9.8.x <= 9.8.1 fail to disallow the modification of local channels by a remote, when… MODE GHSA-q66g-q98c-q454 Mattermost versions 10.11.x <= 10.11.4 fail to validate redirect URLs on the /error page, which allows an attacker to redirect a victim to a malicious site via… LOW GHSA-jf5h-xfw4-p8gp Mattermost versions 10.11.x <= 10.11.6 and Mattermost GitHub plugin versions <=2.4.0 fail to validate plugin bot identity in reaction forwarding which allows… LOW GHSA-58w6-w55x-6wq8 Mattermost versions 10.11.x <= 10.11.4, 10.5.x <= 10.5.12 fail to validate the user permission when accessing the files and subscribing to the block in Boards… LOW GHSA-mqcj-8c2g-h97q Mattermost versions 10.11.x <= 10.11.3, 10.5.x <= 10.5.11 fail to properly validate team membership permissions in the Add Channel Member API, which allows… LOW GHSA-j2h2-cvwh-cr64 Mattermost Server Sensitive Data Exposure in github.com/mattermost/mattermost UNKN Mattermost versions 9.9.x <= 9.9.0, 9.5.x <= 9.5.6, 9.7.x <= 9.7.5, 9.8.x <= 9.8.1 fail to properly validate synced posts, when shared channels are enabled…
Full advisory text at GitHub advisory or NVD .
// cvss v3.1 vector CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:L
Attack vector Network
Attack complexity Low
Privileges required High
User interaction None
Scope Unchanged
Confidentiality None
Integrity High
Availability Low // fixed in 5.3.2-0.20240619142046-8181a9ddffc0
go get github.com/mattermost/mattermost@v5.3.2-0.20240619142046-8181a9ddffc0 upgrade past every affected range above
// at a glance Affected < 5.3.2-0.20240619142046-8181a9ddffc0 Fixed in 5.3.2-0.20240619142046-8181a9ddffc0 Weakness CWE-284 Improper access control Published 2024-08-01updated 2025-07-09 Sources github // questions Is github.com/mattermost/mattermost safe to install? CyberXYZ does not call a package safe in absolute terms. It records 11 known vulnerabilities for github.com/mattermost/mattermost (go), the worst rated HIGH, and no malicious-package signal. Whether it is acceptable depends on the version you run.
Does github.com/mattermost/mattermost have known vulnerabilities? Yes. CyberXYZ records 11 known vulnerabilities for github.com/mattermost/mattermost (go), the worst rated HIGH. These include GHSA-vg67-chm7-8m3j, GHSA-x3r8-2hmh-89f5, GHSA-p6gj-jc38-x2m7, GHSA-j6gg-r5jc-47cm, GHSA-9fpw-c9x7-cv3j.
How do I check github.com/mattermost/mattermost before installing? Search github.com/mattermost/mattermost in CyberXYZ Check at https://cyberxyz.io/check?q=github.com%2Fmattermost%2Fmattermost . The xyz Scanner checks a project's dependencies, and CyberXYZ Proxy checks each package as it is installed.
Checked 2026-11-14 at 06:49 UTC. The most recent advisory here was published 2025-12-17. Updated continuously from NVD, GHSA, OSV and CNA feeds.
Think a verdict here is wrong? Tell us — we respond within 2 business days. Report an issue with this page