Mattermost

Skip to content What this pays sorona.xyz pays 1.25× the program's reward, up to +$1,000 per finding, plus a complexity bonus of up to $1,000 for especially complex or well-chained bugs. Finding │ Program pays │ Through sorona.xyz P1: Critical │ $2,000 │ $2,500 P2: High │ $750 │ $938 P3: Medium │ $300 │ $375 P4: Low │ $150 │ $188 Submit a vulnerability CVE history 185 Last 12 months 617 Lifetime Access control 40 % Info disclosure 25 % Denial of service 20 % XSS 10 % Latest advisories Loading the feed Overview Mattermost is a self-hosted collaboration and messaging platform: a Slack-shaped product that organisations run on their own infrastructure precisely because they cannot put the conversation on someone else's, and its user base skews heavily toward defence, government and critical-infrastructure operators for exactly that reason. That deployment profile is what makes a bug here matter: the instances that count most are private, segregated or air-gapped, so the operator rather than the vendor absorbs the consequence, and there is no vendor-side hotfix that reaches them all at once. The record is busy, at 617 CVEs lifetime and 185 in the last twelve months, dominated by access-control failures at roughly 40%. Mattermost, Inc. pays through Bugcrowd on a flat four-band ladder: $2,000 for a P1, $750 for a P2, $300 for a P3 and $150 for a P4, with priority set by Bugcrowd's Vulnerability Rating Taxonomy and open to appeal if it is downgraded. The scope is unusually source-forward for a commercial engagement: building from github.com/mattermost/mattermost and testing your own local install is explicitly sanctioned, and twelve first-party plugins are named by source repository. The catch is the paperwork, not the target: the engagement adopts Bugcrowd's standard disclosure terms, which carry channel exclusivity, IP assignment and indefinite confidentiality, so file with Bugcrowd yourself and route the report to us afterwards. sorona.xyz adds 1.25× on top of whatever Mattermost awards, up to $1,000 more, plus a complexity bonus of up to $1,000 for a well-chained finding. In scope The brief describes the target as a backend, a webapp, a desktop app and mobile apps for iOS and Android, and names building from source at github.com/mattermost/mattermost as a sanctioned way to stand one up. Self-hosted from source or from the official downloads, that whole product is the asset. The server backend in full: the REST API and the permission checks on it, the WebSocket layer, teams, channels and roles, file upload and attachment handling, search, and the compliance and export tooling Authentication and session handling across SAML, OpenID Connect, LDAP and AD, MFA, personal access tokens and bot accounts The plugin framework itself: the plugin API, slash commands, incoming and outgoing webhooks, and the interactive dialog and message-action surface The webapp: message and markdown rendering, link previews and embeds, and the system console The Mattermost Desktop applications, and Mattermost Mobile for iOS and Android Twelve first-party plugins, each listed by source repository: Calls, Playbooks, Boards, Copilot/AI, Jira, GitHub, GitLab, Zoom, MS Calendar, MS Teams, MS Teams Meetings and Confluence A Mattermost Cloud instance the researcher provisions for themselves at https://bugcrowd-<your-own-instance>.cloud.mattermost.com/ Out of scope mattermost.com , the main marketing website, which the brief places explicitly out of scope docs.mattermost.com , developers.mattermost.com , academy.mattermost.com , integrations.mattermost.com and about.mattermost.com forum.mattermost.com , a Discourse instance whose own upstream bounty is suspended, so that surface pays nothing anywhere Community and third-party plugins outside the twelve named first-party repositories Other people's servers: the sanctioned targets are an install you built or downloaded yourself and a Cloud instance you provisioned yourself Anything submitted outside Bugcrowd's Crowdcontrol, which the standard terms the engagement adopts say cannot be considered for a reward Most-valued findings Cross-team, cross-channel or cross-role access-control failures that let a member read, post or administer where the permission model says they cannot. Access control is about 40% of this project's CVE history and is the class most likely to be graded P1 on a product whose entire selling point is compartmented conversation. Authentication and session defects, SSO, MFA and token handling, that yield another user's account, and privilege escalation from ordinary member to channel, team or system administrator Information disclosure through the REST API or the WebSocket layer: message content, file attachments, or user and team metadata returned to a caller who should not see any of it, which is 25% of the historical mix Server-side flaws in the twelve first-party plugins, particularly the integration plugins holding credentials for Jira, GitHub, GitLab and Microsoft services, where one bug leaks a token into a third-party system the operator does not control Denial of service an unprivileged member can trigger against a whole self-hosted instance, at 20% of the record and worth more here than usual because these operators have no vendor cloud to fail over to Stored cross-site scripting in message or attachment rendering, which on a chat product fires for every reader of a channel rather than for one victim Program rules Submit through sorona.xyz first. We validate, coordinate with the program's security team, and add the payout uplift on top of whatever it awards. A Bugcrowd account is required and its standard identity and payment terms apply Priority is set by the Bugcrowd Vulnerability Rating Taxonomy and may be downgraded on likelihood or impact, with a stated right of appeal Test a build you made yourself from github.com/mattermost/mattermost , an official download, or a Mattermost Cloud instance you provisioned for yourself, not somebody else's server Only the twelve named first-party plugin repositories are in scope; community and third-party plugins are not mattermost.com and the docs, developer, academy, integrations, about and forum sites are explicitly out of scope Bugcrowd's standard terms require submissions to be made exclusively through Crowdcontrol to be considered for a reward, and treat every submission as confidential to Mattermost unless it consents to disclosure Disclosure Coordinated through Bugcrowd, which triages against the VRT; Mattermost aims to respond within two business days and to make a bounty determination within five business days of validating an issue. Its own vendor policy asks researchers to wait 30 days after a release before publishing details and to send it a link to the writeup, but the engagement runs on Bugcrowd's standard terms and the engagement record disallows disclosure, so publication needs Mattermost's sign-off rather than just the passage of those 30 days. Safe harbor Sorona will not pursue legal action against you for good-faith research submitted to us in line with this policy. We cannot speak for the upstream project, its vendor, or any third party, and we do not grant authorization on their behalf. You are responsible for understanding and following the laws that apply to you, wherever you are, and for staying within any scope the project has defined. Submit a vulnerability