Skip to content
Mattermost Server vulnerabilities
-
mattermost, mattermost server +1 more
Mattermost OpenID discovery endpoint request bypasses outbound connection filtering, allowing SSRF by a System Administrator
CVE-2026-93848
2.7 Low
-
mattermost, mattermost server +1 more
Unbounded memory consumption during PDF text extraction
CVE-2026-93850
6.5 Medium
-
mattermost, mattermost server +1 more
Mattermost allows authenticated users to trigger excessive memory allocation via crafted msgpack binary WebSocket frames
CVE-2026-93849
6.5 Medium
-
mattermost, mattermost server +1 more
Improper post type validation on scheduled post endpoints
CVE-2026-93847
3.5 Low
-
mattermost, mattermost server +1 more
Null condition in Playbooks import crashes the plugin
CVE-2026-13411
4.3 Medium
-
mattermost, mattermost server +1 more
Mattermost Server fails to restrict Slack import account binding, allowing team admins to forge posts as existing users
CVE-2026-18799
4.3 Medium
-
mattermost, mattermost server +1 more
Mattermost local image proxy allows server memory exhaustion via unbounded image response buffering
CVE-2026-16251
6.5 Medium
-
mattermost, mattermost server +1 more
Private team metadata disclosure via the team search API
CVE-2026-18256
4.3 Medium
-
mattermost, mattermost server +1 more
Mattermost invitation tokens not bound to invited email address allowing unauthorized team and private channel access
CVE-2026-18223
5.0 Medium
-
mattermost, mattermost server +1 more
Mattermost fails to reject OAuth application sessions in account type switch, allowing account takeover via bearer token
CVE-2026-19076
4.4 Medium
-
mattermost, mattermost server +1 more
Improper order of authorisations in Mattermost GetFile API leads to an authenticated user to determine a post’s quarantined status
CVE-2026-18560
4.3 Medium
-
mattermost, mattermost server +1 more
Mattermost SAML RelayState forgery allows unauthorized team membership
CVE-2026-16453
7.1 High
-
mattermost, mattermost server +1 more
Mattermost logs plaintext authentication tokens in debug-level server logs on failed auth attempts
CVE-2026-19600
4.5 Medium
-
mattermost, mattermost server +1 more
Mattermost leaks interactive-message integration secrets to non-admin users via post-deletion events and thread reads
CVE-2026-19621
6.5 Medium
-
mattermost, mattermost server +1 more
Private channel ID disclosure via user status endpoints
CVE-2026-19603
4.3 Medium
-
mattermost, mattermost server +1 more
Missing server side validation allowed user to quarantine a DM and GM post
CVE-2026-18795
6.4 Medium
-
mattermost, mattermost server +1 more
Uncapped mention keys in user notification properties allow CPU exhaustion during post processing
CVE-2026-19867
4.3 Medium
-
mattermost, mattermost server +1 more
Disclosure of AD/LDAP bind password via Test Connection
CVE-2026-19601
4.9 Medium
-
mattermost, mattermost server +1 more
Mattermost guest account privilege escalation via member roles API
CVE-2026-18551
6.5 Medium
-
mattermost, mattermost server +1 more
Outgoing OAuth connection client secret exposure during connection validation
CVE-2026-19541
6.5 Medium
-
mattermost, mattermost server +1 more
Mattermost server missing request body size limit on plugin routes allows denial of service by an authenticated user
CVE-2026-96260
6.5 Medium
-
mattermost, mattermost server +1 more
Mattermost server-side request forgery via OAuth endpoints configurable by a System Administrator
CVE-2026-96259
5.5 Medium
-
mattermost, mattermost server +1 more
Unbounded post ID array in the bulk reactions endpoint allows denial of service
CVE-2026-95666
4.3 Medium
-
mattermost, mattermost server +1 more
Data Retention Teams Endpoint Leaks Private Team Invite ID
CVE-2026-91181
6.5 Medium
-
mattermost, mattermost server +1 more
Mattermost DCR redirect URI allowlist bypass via improper URL component validation
CVE-2026-12985
6.8 Medium
-
mattermost, mattermost server +1 more
Mattermost ABAC parent policy bypass via policy update endpoint
CVE-2026-82920
5.5 Medium
-
mattermost, mattermost server +1 more
MS Calendar plugin: unrecovered handler panics from malformed post-action requests could crash the plugin process
CVE-2026-86348
4.3 Medium
-
mattermost, mattermost server +1 more
Mattermost Server Algorithmic DoS via Unbounded Markdown Block Nesting
CVE-2026-86349
4.3 Medium
-
mattermost, mattermost server +1 more
Unauthenticated webhook request with null notification entry could crash the Microsoft Calendar plugin.
CVE-2026-10556
5.3 Medium
-
mattermost, mattermost server +1 more
Boards plugin denial of service via unvalidated block fields.properties
CVE-2026-13417
4.3 Medium
-
mattermost, mattermost server +1 more
Missing property field ownership validation in Playbooks run property update endpoint
CVE-2026-9812
6.5 Medium
-
mattermost, mattermost server +1 more
Playbooks run owner channel membership permission bypass
CVE-2026-8821
7.1 High
-
mattermost, mattermost server +1 more
Unbounded zlib decompression in Calls SDP WebSocket messages
CVE-2026-5132
6.5 Medium
-
mattermost, mattermost server +1 more
Uploading a crafted image causes excessive memory allocation in the Mattermost Server
CVE-2026-15814
6.5 Medium
-
mattermost, mattermost server +1 more
Playbooks channel action update validation issue
CVE-2026-10542
5.0 Medium
-
mattermost, mattermost server +1 more
Inconsistent authorization checks in Mattermost Boards endpoints
CVE-2026-14344
4.3 Medium
-
mattermost, mattermost server +1 more
Mattermost Markdown autolink parsing denial of service
CVE-2026-12882
4.3 Medium
-
mattermost, mattermost server +1 more
Fix authenticated members disabling file content indexing server-wide via extraction pool exhaustion
CVE-2026-11993
4.3 Medium
-
mattermost, mattermost server +1 more
Board archive import bypasses team board creation permissions
CVE-2026-14259
4.3 Medium
-
mattermost, mattermost server +1 more
Mattermost thread memberships persist after team removal, exposing private channel thread metadata on re-invite
CVE-2026-9693
3.5 Low
-
mattermost, mattermost server +1 more
Mattermost Boards plugin didn’t enforce role-based authorization on board channel link allowing board editors to expose boards to arbitrary channels
CVE-2026-9859
6.5 Medium
-
mattermost, mattermost server +1 more
Insufficient server-side validation of board member role fields permits privilege escalation
CVE-2026-9816
8.3 High
-
mattermost, mattermost server +1 more
Boards plugin panics on WebSocket command with non-string field types
CVE-2026-10080
6.5 Medium
-
mattermost, mattermost server +1 more
Boards plugin retains Board Admin rights for users demoted to System Guest
CVE-2026-10527
6.3 Medium
-
mattermost, mattermost server +1 more
Missing per-channel team-scope check in ABAC access control policy unassign allows cross-team policy removal
CVE-2026-15754
4.2 Medium
-
mattermost, mattermost server +1 more
Insufficient validation of guest board admin privileges on archive import
CVE-2026-16044
3.9 Low
-
mattermost, mattermost server +1 more
Delegated OAuth tokens could revoke unrelated OAuth application authorizations
CVE-2026-16045
2.7 Low
-
mattermost, mattermost server +1 more
Board channel linking without read channel permission validation
CVE-2026-16047
4.3 Medium
-
mattermost, mattermost server +1 more
Missing run-state validation on finished playbook runs
CVE-2026-16046
3.5 Low
-
mattermost, mattermost server +1 more
Channel member roles accept out-of-scope roles
CVE-2026-16048
6.3 Medium
- Show olderLoading…