Doyensec

Weak SSRF Filtering

Insufficient Electron Fuses Configuration

Silent Desktop Screenshot Capture

Denial of Service via crashing the Calls Plugin

Mattermost version 2.10.0 and earlier fails to sanitize deeplink paths, which allows an attacker to perform CSRF attacks against the server.

Lack of Hardening against media exploitation from a remote origin

Regex DoS from a malicious server enrolled in Desktop

IDOR when marking read a user's channel

User creation date manipulation in POST /api/v4/users

One-click Client-Side Path Traversal Leading to CSRF in User Management admin page