Mattermost vulnerabilities

Products

• Server 506
• Mattermost 487
• Desktop 34
• Mobile 21
• Confluence 14
• Confluence Plugin 14
• Desktop 3
• Focalboard 2
• Legal Hold 2
• App Framework 2
• Boards 2
• Boards 2
• Playbooks 2
• Ms Teams 2
• Playbooks 2
• Zoom 2

Newest

• mattermost Path traversal in Mattermost Agents plugin mention reminder allows plugin replacement via crafted post CVE-2026-93851 8.0 HighOctober 28, 2026
• mattermost Team admin can escalate a team member's permissions via the team member roles endpoint CVE-2026-93846 3.8 LowOctober 26, 2026
• mattermost, mattermost server +1 more Mattermost OpenID discovery endpoint request bypasses outbound connection filtering, allowing SSRF by a System Administrator CVE-2026-93848 2.7 LowOctober 26, 2026
• mattermost, mattermost server +1 more Unbounded memory consumption during PDF text extraction CVE-2026-93850 6.5 MediumOctober 26, 2026
• mattermost, mattermost server +1 more Mattermost allows authenticated users to trigger excessive memory allocation via crafted msgpack binary WebSocket frames CVE-2026-93849 6.5 MediumOctober 26, 2026
• mattermost, mattermost server +1 more Improper post type validation on scheduled post endpoints CVE-2026-93847 3.5 LowOctober 26, 2026
• mattermost Insufficient length validation when parsing Zoom chat transcriptions CVE-2026-116516 6.5 MediumOctober 26, 2026
• mattermost, mattermost server +1 more Null condition in Playbooks import crashes the plugin CVE-2026-13411 4.3 MediumOctober 22, 2026
• mattermost, mattermost server +1 more Mattermost Server fails to restrict Slack import account binding, allowing team admins to forge posts as existing users CVE-2026-18799 4.3 MediumOctober 16, 2026
• mattermost, mattermost server +1 more Mattermost local image proxy allows server memory exhaustion via unbounded image response buffering CVE-2026-16251 6.5 MediumOctober 16, 2026
• mattermost, mattermost server +1 more Private team metadata disclosure via the team search API CVE-2026-18256 4.3 MediumOctober 16, 2026
• mattermost, mattermost server +1 more Mattermost invitation tokens not bound to invited email address allowing unauthorized team and private channel access CVE-2026-18223 5.0 MediumOctober 16, 2026
• mattermost, mattermost server +1 more Mattermost fails to reject OAuth application sessions in account type switch, allowing account takeover via bearer token CVE-2026-19076 4.4 MediumOctober 16, 2026
• mattermost, mattermost server +1 more Improper order of authorisations in Mattermost GetFile API leads to an authenticated user to determine a post’s quarantined status CVE-2026-18560 4.3 MediumOctober 16, 2026
• mattermost, mattermost server +1 more Mattermost SAML RelayState forgery allows unauthorized team membership CVE-2026-16453 7.1 HighOctober 16, 2026
• mattermost, mattermost server +1 more Mattermost logs plaintext authentication tokens in debug-level server logs on failed auth attempts CVE-2026-19600 4.5 MediumOctober 16, 2026
• mattermost, mattermost server +1 more Mattermost leaks interactive-message integration secrets to non-admin users via post-deletion events and thread reads CVE-2026-19621 6.5 MediumOctober 16, 2026
• mattermost, mattermost server +1 more Private channel ID disclosure via user status endpoints CVE-2026-19603 4.3 MediumOctober 16, 2026
• mattermost, mattermost server +1 more Missing server side validation allowed user to quarantine a DM and GM post CVE-2026-18795 6.4 MediumOctober 16, 2026
• mattermost, mattermost server +1 more Uncapped mention keys in user notification properties allow CPU exhaustion during post processing CVE-2026-19867 4.3 MediumOctober 16, 2026
• mattermost, mattermost server +1 more Disclosure of AD/LDAP bind password via Test Connection CVE-2026-19601 4.9 MediumOctober 16, 2026
• mattermost, mattermost server +1 more Mattermost guest account privilege escalation via member roles API CVE-2026-18551 6.5 MediumOctober 16, 2026
• mattermost, mattermost server +1 more Outgoing OAuth connection client secret exposure during connection validation CVE-2026-19541 6.5 MediumOctober 16, 2026
• mattermost, mattermost server +1 more Mattermost server missing request body size limit on plugin routes allows denial of service by an authenticated user CVE-2026-96260 6.5 MediumSeptember 22, 2026
• mattermost, mattermost server +1 more Mattermost server-side request forgery via OAuth endpoints configurable by a System Administrator CVE-2026-96259 5.5 MediumSeptember 22, 2026
• mattermost, mattermost server +1 more Unbounded post ID array in the bulk reactions endpoint allows denial of service CVE-2026-95666 4.3 MediumSeptember 22, 2026
• mattermost, mattermost desktop +1 more Mattermost Desktop App Missing IPC Sender Validation in Calls Leave Handler CVE-2026-12284 3.8 LowSeptember 17, 2026
• mattermost, mattermost desktop +1 more Mattermost Desktop App plugin popout scheme validation bypass CVE-2026-75588 2.6 LowSeptember 17, 2026
• mattermost, mattermost desktop +1 more Mattermost Desktop local network access from server-rendered content CVE-2026-75025 4.7 MediumSeptember 16, 2026
• mattermost, mattermost server +1 more Data Retention Teams Endpoint Leaks Private Team Invite ID CVE-2026-91181 6.5 MediumSeptember 14, 2026
• mattermost, mattermost server +1 more Mattermost DCR redirect URI allowlist bypass via improper URL component validation CVE-2026-12985 6.8 MediumSeptember 14, 2026
• mattermost, mattermost server +1 more Mattermost ABAC parent policy bypass via policy update endpoint CVE-2026-82920 5.5 MediumSeptember 14, 2026
• mattermost, mattermost server +1 more MS Calendar plugin: unrecovered handler panics from malformed post-action requests could crash the plugin process CVE-2026-86348 4.3 MediumSeptember 14, 2026
• mattermost, mattermost server +1 more Mattermost Server Algorithmic DoS via Unbounded Markdown Block Nesting CVE-2026-86349 4.3 MediumSeptember 14, 2026
• mattermost, mattermost server +1 more Unauthenticated webhook request with null notification entry could crash the Microsoft Calendar plugin. CVE-2026-10556 5.3 MediumSeptember 14, 2026
• mattermost, mattermost server +1 more Boards plugin denial of service via unvalidated block fields.properties CVE-2026-13417 4.3 MediumSeptember 14, 2026
• mattermost, mattermost server +1 more Missing property field ownership validation in Playbooks run property update endpoint CVE-2026-9812 6.5 MediumSeptember 14, 2026
• mattermost, mattermost server +1 more Playbooks run owner channel membership permission bypass CVE-2026-8821 7.1 HighSeptember 14, 2026
• mattermost, mattermost server +1 more Unbounded zlib decompression in Calls SDP WebSocket messages CVE-2026-5132 6.5 MediumSeptember 14, 2026
• mattermost, mattermost server +1 more Uploading a crafted image causes excessive memory allocation in the Mattermost Server CVE-2026-15814 6.5 MediumSeptember 14, 2026
• mattermost, mattermost server +1 more Playbooks channel action update validation issue CVE-2026-10542 5.0 MediumSeptember 14, 2026
• mattermost, mattermost server +1 more Inconsistent authorization checks in Mattermost Boards endpoints CVE-2026-14344 4.3 MediumSeptember 14, 2026
• mattermost, mattermost server +1 more Mattermost Markdown autolink parsing denial of service CVE-2026-12882 4.3 MediumSeptember 14, 2026
• mattermost, mattermost server +1 more Fix authenticated members disabling file content indexing server-wide via extraction pool exhaustion CVE-2026-11993 4.3 MediumSeptember 14, 2026
• mattermost, mattermost server +1 more Board archive import bypasses team board creation permissions CVE-2026-14259 4.3 MediumSeptember 14, 2026
• mattermost, mattermost desktop +1 more Plaintext pre-auth secret exposure via Desktop App diagnostics report CVE-2026-75587 3.6 LowAugust 17, 2026
• mattermost, mattermost server +1 more Mattermost thread memberships persist after team removal, exposing private channel thread metadata on re-invite CVE-2026-9693 3.5 LowAugust 17, 2026
• mattermost, mattermost server +1 more Mattermost Boards plugin didn’t enforce role-based authorization on board channel link allowing board editors to expose boards to arbitrary channels CVE-2026-9859 6.5 MediumAugust 17, 2026
• mattermost, mattermost server +1 more Insufficient server-side validation of board member role fields permits privilege escalation CVE-2026-9816 8.3 HighAugust 17, 2026
• mattermost, mattermost server +1 more Boards plugin panics on WebSocket command with non-string field types CVE-2026-10080 6.5 MediumAugust 17, 2026
• Show olderLoading…