| Package | Affected versions | Patched versions |
|---|---|---|
| github.com/mattermost/mattermost-server | ≥ 10.5.0, < 10.5.9≥ 10.5.0+incompatible, < 10.5.9+incompatible≥ 10.8.0, < 10.8.4≥ 10.8.0+incompatible, < 10.8.4+incompatible≥ 10.9.0, < 10.9.3≥ 10.9.0+incompatible, < 10.9.3+incompatible≥ 9.11.0, < 9.11.18≥ 9.11.0+incompatible, < 9.11.18+incompatible | 10.5.910.5.9+incompatible10.8.410.8.4+incompatible10.9.310.9.3+incompatible9.11.189.11.18+incompatible |
| github.com/mattermost/mattermost-server/v5 | ≤ 5.39.3all versions | |
| github.com/mattermost/mattermost-server/v6 | ≤ 6.7.2all versions | |
| github.com/mattermost/mattermost/server/v8 | < 8.0.0-20250708065844-b38e2eccda18 | 8.0.0-20250708065844-b38e2eccda18 |
| mattermost server | ≥ 10.5.0, < 10.5.9≥ 10.8.0, < 10.8.4≥ 10.9.0, < 10.9.3≥ 9.11.0, < 9.11.18 | 10.5.910.8.410.9.39.11.18 |
Mattermost versions 10.8.x <= 10.8.3, 10.5.x <= 10.5.8, 9.11.x <= 9.11.17, 10.9.x <= 10.9.2 fail to sanitize the team invite ID in the POST /api/v4/teams/:teamId/restore endpoint which allows an team admin with no member invite privileges to get the team’s invite id.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free