CVE-2017-18915 — Vulnerability in...

CRITICAL

Mattermost Server server restarts may provide attackers with API access

Published May 24, 2022Updated February 19, 2026Source: osv

Summary

An issue was discovered in Mattermost Server before 3.8.2, 3.7.5, and 3.6.7. After a restart of a server, an attacker might suddenly gain API Endpoint access.

Advisory Timeline

First published May 24, 2022 (1602 days ago).
Last revised February 19, 2026 — 1367 days after initial publication.

Remediation

Upgrade to the fixed version using your package manager.

Update github.com/mattermost/mattermost-server to 3.6.7-0.20170420152529-0968e4079e0a or later

go get github.com/mattermost/mattermost-server@v3.6.7-0.20170420152529-0968e4079e0a

Update github.com/mattermost/mattermost-server to 3.7.5 or later

go get github.com/mattermost/mattermost-server@v3.7.5

Update github.com/mattermost/mattermost-server to 3.8.2 or later

go get github.com/mattermost/mattermost-server@v3.8.2

After upgrading, run your dependency scanner again to confirm the vulnerability is resolved.

Affected Packages (3)

Affects 1 ecosystem: go (1).

Package	Ecosystem	Affected	Fixed In
github.com/mattermost/mattermost-server	go	All versions	3.6.7-0.20170420152529-0968e4079e0a
github.com/mattermost/mattermost-server	go	All versions	3.7.5
github.com/mattermost/mattermost-server	go	All versions	3.8.2

Vulnerability Classification

Common Weakness Enumeration (CWE) identifiers for this vulnerability type.

CWE-20
Improper Input ValidationMITRE
CWE-807
View on MITRE

CVSS Score Breakdown

What the CVSS (Common Vulnerability Scoring System) 9.8 score means for each attack dimension.

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

References

Frequently Asked Questions

What is CVE-2017-18915?: Mattermost Server server restarts may provide attackers with API access This vulnerability has been assigned a severity rating of CRITICAL (CVSS score: 9.8/10).
How do I check if my project is affected by CVE-2017-18915?: CVE-2017-18915 affects github.com/mattermost/mattermost-server. Use GeekWala's free vulnerability scanner to check your dependencies against CVE-2017-18915 and 200,000+ other known vulnerabilities.

Severity & Exploitability

CVSS Score

9.8

Exploitation is straightforward and causes maximum impact. Patch immediately.

Also Known As

GHSA-hxxj-8phw-74vw

GO-2026-4462

Related CVEs

CVE-2017-18900
CRITICAL
Mattermost Server is vulnerable CSV Injection
CVE-2017-18885
CRITICAL
Mattermost Server allows attackers to gain privileges by accessing unintended API endpoints with users' credentials
CVE-2025-12421
CRITICAL
Mattermost fails to to verify the token used during code exchange
CVE-2026-6961
HIGH
Mattermost doesn't sanitize FileInfo.Name received from federated peers during shared channel file sync
CVE-2026-6346
HIGH
Mattermost doesn't sanitize sensitive configuration fields before including them in support packet generation
CVE-2026-4858
HIGH
Mattermost has a Path Traversal issue
CVE-2026-5308
HIGH
Mattermost doesn't enforce request body size limits on plugin HTTP endpoints
CVE-2026-24458
HIGH
Mattermost fails to properly handle very long passwords

Check if you're affected

Scan your dependencies to see if this vulnerability affects your projects.

Scan Your Dependencies