winfunc

SAML certificate deletion allows path traversal to delete arbitrary files outside the config directory

Global session revocation does not invalidate active WebSocket connections

Mattermost group syncable endpoints allow privilege escalation via scheme_admin

Mattermost Remote Cluster PATCH API Leaks Authentication Tokens

Terminal Escape Injection in mmctl Report Posts Command

mmctl export download command doesn’t restrict permissions to created file to file owner

Zip Bomb Denial of Service via Unrestricted Archive Decompression

Guest users can view group member IDs without respecting view restrictions

Private channel enumeration via /mute slash command

SSRF bypass via IPv4-mapped IPv6 literals