Mattermost Server allows attackers to create buttons that can launch API requests

Also known as GHSA-m497-hq5x-6jcv, GO-2025-4202

Published 6 y ago 2020-06-19 · modified 4 mo ago 2026-06-17 · JSON

CVSS

4.3

v3.1 · NVD

CISA KEV

not known exploited

EPSS

0.8%

percentile 56%

Public exploits

none known

An issue was discovered in Mattermost Server before 4.3.0, 4.2.1, and 4.1.2. It allows an attacker to create a button that, when pressed by a user, launches an API request.

Exploit prediction (EPSS)

0.78% probability of exploitation in the next 30 days, higher than 56% of all scored CVEs.

CVSS scores

Assigned by	Version	Score	Vector
NVD	3.1	4.3	`CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N`
NVD	2.0	4.3	`AV:N/AC:M/Au:N/C:N/I:P/A:N`
GitHub	3.1	4.3	`CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N`

Affected packages

Ecosystem	Package	Affected	Fixed in
go	`github.com/mattermost/mattermost-server`	<4.1.2 >=4.2.0-rc1, <4.2.1 >=4.3.0-rc1, <4.3.0 <4.1.2+incompatible >=4.2.0-rc1+incompatible, <4.2.1+incompatible >=4.3.0-rc1+incompatible, <4.3.0+incompatible	4.1.2 4.2.1 4.3.0 4.1.2+incompatible 4.2.1+incompatible 4.3.0+incompatible

Classification

Weakness

CWE-20 Improper Input Validation

References

mattermost.com /security-updates/ · x_refsource_CONFIRM, x_transferred
nvd.nist.gov /vuln/detail/CVE-2017-18890 · advisory
github.com /mattermost/mattermost · package
mattermost.com /security-updates · web
github.com /advisories/GHSA-m497-hq5x-6jcv · advisory

Sources

CVE List: CVE-2017-18890
GitHub Advisory: GHSA-m497-hq5x-6jcv
NVD: CVE-2017-18890
OSV: GO-2025-4202

vulnwire keeps one entry per vulnerability: the CVE id wins, then GHSA; records that alias each other are merged. Machine-readable: JSON.