| CVE-2019-20889 | 中5.3 | An issue was discovered in Mattermost Server before 5.7, 5.6.3, 5.5.2, and 4.10.5. It mishandles permissions for user-access token creation. | 19/06/2020 |
| CVE-2019-20888 | 高7.5 | An issue was discovered in Mattermost Server before 5.7, 5.6.3, 5.5.2, and 4.10.5. It allows attackers to cause a denial of service (memory consumption) via an outgoing webhook or a slash command integration. | 19/06/2020 |
| CVE-2019-20887 | 中4.3 | An issue was discovered in Mattermost Server before 5.7.1, 5.6.4, 5.5.3, and 4.10.6. It does not honor flags API permissions when deciding whether a user can receive intra-team posts. | 19/06/2020 |
| CVE-2019-20886 | 高7.5 | An issue was discovered in Mattermost Server before 5.8.0. The first user is sometimes inadvertently a system admin. | 19/06/2020 |
| CVE-2019-20885 | 高7.5 | An issue was discovered in Mattermost Server before 5.8.0. It does not always generate a robots.txt file. | 19/06/2020 |
| CVE-2019-20884 | 中5.3 | An issue was discovered in Mattermost Server before 5.8.0. It allows attackers to partially attach a file to more than one post. | 19/06/2020 |
| CVE-2019-20883 | 中4.3 | An issue was discovered in Mattermost Server before 5.8.0, when Town Square is set to Read-Only. Users can pin or unpin a post. | 19/06/2020 |
| CVE-2019-20882 | 中5.3 | An issue was discovered in Mattermost Server before 5.8.0. It does not honor the domain requirement when processing a join request for an open team. | 19/06/2020 |
| CVE-2019-20881 | 高7.3 | An issue was discovered in Mattermost Server before 5.8.0. It mishandles brute-force attacks against MFA. | 19/06/2020 |
| CVE-2019-20880 | 高7.5 | An issue was discovered in Mattermost Server before 5.8.0, 5.7.2, 5.6.5, and 4.10.7. It allows attackers to cause a denial of service (memory consumption) via OpenGraph. | 19/06/2020 |
| CVE-2019-20879 | 中4.3 | An issue was discovered in Mattermost Server before 5.8.0, 5.7.2, 5.6.5, and 4.10.7. Changes to e-mail addresses do not require credential re-entry. | 19/06/2020 |
| CVE-2019-20878 | 中4.3 | An issue was discovered in Mattermost Server before 5.9.0, 5.8.1, 5.7.3, and 4.10.8. Changes, within the application, to e-mail addresses are mishandled. | 19/06/2020 |
| CVE-2019-20877 | 中5.3 | An issue was discovered in Mattermost Server before 5.9.0, 5.8.1, 5.7.3, and 4.10.8. It allows attackers to obtain sensitive information about whether someone has 2FA enabled. | 19/06/2020 |
| CVE-2019-20876 | 中5.4 | An issue was discovered in Mattermost Server before 5.9.0, 5.8.1, 5.7.3, and 4.10.8. Users can deactivate themselves, bypassing a policy. | 19/06/2020 |
| CVE-2019-20875 | 中5.3 | An issue was discovered in Mattermost Server before 5.9.0, 5.8.1, 5.7.3, and 4.10.8. It allows a password reset to proceed while an e-mail address is being changed. | 19/06/2020 |
| CVE-2018-21265 | 中5.3 | An issue was discovered in Mattermost Desktop App before 4.0.0. It mishandled the Same Origin Policy for setPermissionRequestHandler (e.g., video, audio, and notifications). | 19/06/2020 |
| CVE-2018-21263 | 高8.8 | An issue was discovered in Mattermost Server before 4.7.0, 4.6.2, and 4.5.2. An attacker could authenticate to a different user's account via a crafted SAML response. | 19/06/2020 |
| CVE-2018-21262 | 高7.5 | An issue was discovered in Mattermost Server before 4.7.3. It allows attackers to cause a denial of service (application crash) via invalid LaTeX text. | 19/06/2020 |
| CVE-2018-21261 | 中4.3 | An issue was discovered in Mattermost Server before 4.8.1, 4.7.4, and 4.6.3. An e-mail invite accidentally included the team invite_id, which leads to unintended excessive invitation privileges. | 19/06/2020 |
| CVE-2018-21260 | 低2.7 | An issue was discovered in Mattermost Server before 4.8.1, 4.7.4, and 4.6.3. WebSocket events were accidentally sent during certain user-management operations, violating user privacy. | 19/06/2020 |