Skip to contentMattermost Server vulnerabilities
- mattermost, mattermost server +1 moreIDOR in CreatePost API allows for timeboxed message disclosureCVE-2025-6226Fix available6.5 Medium
- mattermost, mattermost server +1 moreMattermost Playbooks exposes private channel metadata to unauthorized users via run metadata APICVE-2025-47871Fix available4.3 Medium
- mattermost, mattermost server +1 moreMattermost Playbooks allows privilege escalation through improper access control in playbook run participant managementCVE-2025-46702Fix available5.4 Medium
- mattermost, mattermost server +1 moreUnauthorized Guest user access to PlaybookCVE-2025-3228Fix available4.3 Medium
- mattermost, mattermost server +1 moreUnauthorized channel member management through playbook runsCVE-2025-3227Fix available4.3 Medium
- mattermost, mattermost server +1 morePath Traversal Leading to RCE by Any Authenticated Mattermost UserCVE-2025-4981Fix available9.9 Critical
- mattermost, mattermost server +1 moreMattermost Guest User Information Disclosure VulnerabilityCVE-2025-4128Fix available3.1 Low
- mattermost, mattermost server +1 moreLDAP Injection in Mattermost Enterprise Edition When Using Active DirectoryCVE-2025-4573Fix available4.1 Medium
- mattermost, mattermost server +1 moreImproper Access Control in Mattermost allows System Managers to view team details despite role restrictionsCVE-2025-3611Fix available3.1 Low
- mattermost, mattermost server +1 moreBypass of System Admin User Deactivation Controls for Personal Access Tokens in Mattermost ServerCVE-2025-3230Fix available5.4 Medium
- mattermost, mattermost server +1 moreGoogle OAuth Authentication Bypass for Converted Bot AccountsCVE-2025-2571Fix available4.2 Medium
- mattermost, mattermost server +1 moreImproper Access Control in Mattermost Channel Member APICVE-2025-1792Fix available3.1 Low
- mattermost, mattermost server +1 moreTeam Privacy Settings Authorization Bypass in Mattermost ServerCVE-2025-3913Fix available5.3 Medium
- mattermost, mattermost server +1 moreSystem Admin Cannot Access Environment settings in System Console While System Manager CanCVE-2025-2570Fix available2.7 Low
- mattermost, mattermost server +1 moreImproper access control to group informationCVE-2025-2527Fix available4.3 Medium
- mattermost, mattermost server +1 moreMembers Without Guest Invite Permissions Can Add Guests to TeamsCVE-2025-3446Fix available4.3 Medium
- mattermost, mattermost server +1 moreRepeated LDAP login failures can lock an LDAP accountCVE-2025-31947Fix available5.8 Medium
- mattermost, mattermost server +1 moreUnauthorized Playbooks Post Deletion in Mattermost Playbooks PluginCVE-2025-41423Fix available3.1 Low
- mattermost, mattermost server +1 moreDoS in Mattermost Playbooks via Excessive Task ActionsCVE-2025-35965Fix available6.5 Medium
- mattermost, mattermost server +1 moreWebapp DoS via malicious retrospective post in PlaybooksCVE-2025-41395Fix available6.5 Medium
- mattermost, mattermost server +1 moreUnauthorized View Access to Archived Channel Member InfoCVE-2025-2564Fix available4.3 Medium
- mattermost, mattermost server, ms teams +2 moreWebhook Secret Exposure via Timing attack in MSteams pluginCVE-2025-27936Fix available5.3 Medium
- mattermost, mattermost server +1 moreData exfiltration via AI plugin Jira toolCVE-2025-31363Fix available3.0 Low
- mattermost, mattermost server +1 moreChannel metadata visible in archived channels despite configuration settingCVE-2025-27571Fix available4.3 Medium
- mattermost, mattermost server +1 moreMFA Enforcement Bypass Allows Unauthorized Removal of MFA for Other UsersCVE-2025-27538Fix available2.2 Low
- mattermost, mattermost server +1 moreUnauthorized AI bot activation via Wrangler pluginCVE-2025-24839Fix available3.1 Low
- mattermost, mattermost server +1 moreUnauthorized Bot Login Using CredentialsCVE-2025-2475Fix available5.4 Medium
- mattermost, mattermost server +1 moreLeaked Metadata of Deleted Files via Bookmark CreationCVE-2025-2424Fix available3.1 Low
- mattermost, mattermost server +1 moreSyatem admin profile modification by delegated granular administration roleCVE-2025-32093Fix available4.7 Medium
- mattermost, mattermost server +1 moreUnauthorized Access to User Activity Logs API by delegated granular administration rolesCVE-2025-24866Fix available2.7 Low
- mattermost, mattermost server +1 moreBypassing MFA Enforcement on Plugin EndpointsCVE-2025-25068Fix available7.5 High
- mattermost, mattermost server +1 moreUnauthorized Bookmark Creation and Modification in Archived ChannelsCVE-2025-24920Fix available4.3 Medium
- mattermost, mattermost server +1 moreMFA Enforcement Bypass in Search APIsCVE-2025-30179Fix available4.3 Medium
- mattermost, mattermost server +1 moreUnauthorized Command Execution in Archived ChannelsCVE-2025-25274Fix available4.3 Medium
- mattermost, mattermost server +1 moreUnauthorized Private-to-Public Channel ConversionCVE-2025-27933Fix available5.4 Medium
- mattermost, mattermost server +1 moreAuto-Enrollment of Team Admins into Private Channels without explicit consentCVE-2025-27715Fix available3.3 Low
- mattermost, mattermost server +1 moreUnauthorized View Access to Site Statistics and Team StatisticsCVE-2025-1472Fix available4.3 Medium
- mattermost, mattermost server +1 moreArbitrary file read via block duplication in Mattermost BoardsCVE-2025-20051Fix available9.9 Critical
- mattermost, mattermost server +1 moreSQL Injection in Mattermost Boards via board category ID reorderingCVE-2025-244909.6 Critical
- mattermost, mattermost server +1 moreArbitrary file read in Mattermost Boards via import & export board archiveCVE-2025-25279Public exploitFix availableEPSS 24.2%9.9 Critical
- mattermost, mattermost server +1 moreSession Persistence After User-to-Bot ConversionCVE-2025-1412Fix available3.1 Low
- mattermost, mattermost server +1 moreChannel export permitted on archived channel when viewing archived channels is disabledCVE-2025-24526Fix available4.3 Medium
- mattermost, mattermost server +1 moreLeaked User IDs and Metadata of Deleted DMsCVE-2025-05033.1 Low
- mattermost, mattermost server +1 moreWebapp crash via object that can't be cast to String in Attachment FieldCVE-2025-20621Fix available6.5 Medium
- mattermost, mattermost server +1 moreInsufficient Input Validation on Post PropsCVE-2025-20088Fix available6.5 Medium
- mattermost, mattermost server +1 moreInsufficient Input Validation on Post PropsCVE-2025-20086Fix available6.5 Medium
- mattermost, mattermost server +1 moreWebApp crash via improper validation of proto style in attachmentsCVE-2025-21088Fix available6.5 Medium
- mattermost, mattermost server +1 moreMisleading UI for undefined admin console settings in Calls causes security confusionCVE-2025-22445Fix available3.5 Low
- mattermost, mattermost server +1 moreDoS via custom post type for sysconsole plugin readersCVE-2025-20033Fix available4.3 Medium
- mattermost, mattermost server +1 moreAccess control flaw for team admins allows unauthorized team additionsCVE-2025-22449Fix available3.8 Low
- Show moreLoading…