Skip to contentMattermost Server vulnerabilities
- mattermost, mattermost zoom, server +2 moreMattermost Zoom Plugin channel preference API lacks authorization checksCVE-2026-0997Fix available4.3 Medium
- mattermost, mattermost zoom, server +2 moreMattermost Zoom Plugin allows unauthorized meeting creation and post modification via insufficient API access controlsCVE-2026-0998Fix available4.3 Medium
- mattermost, mattermost server +1 moreAuthentication bypass via userID login when email and username login are disabledCVE-2026-0999Fix available5.4 Medium
- mattermost, mattermost server +1 moreTime-of-check time-of-use vulnerability in common teams APICVE-2026-20796Fix available3.1 Low
- mattermost, mattermost server +1 moreInsufficient Authorization in Mattermost Jira Plugin Allows Unauthorized Access to Post AttachmentsCVE-2026-22892Fix available4.3 Medium
- mattermost, mattermost server +1 moreApplication-Level DoS via infinite re-render loop in user profile handlingCVE-2025-14435Fix available6.8 Medium
- mattermost, mattermost server +1 moreDoS from quadratic complexity in model.ParseHashtagsCVE-2025-14822Fix available3.1 Low
- mattermost, mattermost server +1 moreMattermost Jira plugin crafted action leaks Jira issue detailsCVE-2025-64641Fix available4.1 Medium
- mattermost, mattermost server +1 moreUnauthorized Read Access to Private Channel Posts via Mattermost Jira PluginCVE-2025-13767Fix available4.3 Medium
- mattermost, mattermost server +1 moreMattermost Jira plugin user spoofing enables Jira request forgery.CVE-2025-14273Fix available7.2 High
- mattermost, mattermost server +1 moreLack of Invalidation of Legacy Remote Cluster Invite Tokens After ConfirmationCVE-2025-13324Fix available3.7 Low
- mattermost, mattermost server +1 moreDoS in Calls plugin via malformed UTF-8 in WebSocket requestCVE-2025-12689Fix available6.5 Medium
- mattermost, mattermost server +1 moreOpen redirect in error page when link opened in new tabCVE-2025-62690Fix available3.1 Low
- mattermost, mattermost server +1 moreMattermost GitHub Plugin allows unauthorized GitHub reactions via reaction forwarding hijackingCVE-2025-13352Fix available3.0 Low
- mattermost, mattermost server +1 moreCSRF Allows Call Initiation and Message DeliveryCVE-2025-62190Fix available4.3 Medium
- mattermost, mattermost server +1 moreUnauthorized access and subscription vulnerability in BoardsCVE-2025-13870Fix available3.1 Low
- mattermost, mattermost server +1 moreInsecure Direct Object Reference in Mattermost Boards Plugin Enables Unauthorised Comment DeletionCVE-2025-127564.3 Medium
- mattermost, mattermost server +1 moreAccount Takeover via Code Exchange EndpointCVE-2025-12421Fix available9.9 Critical
- mattermost, mattermost server +1 moreInformation Disclosure in Common Teams APICVE-2025-12559Fix available4.3 Medium
- mattermost, mattermost server +1 moreAccount takeover on OAuth/OpenID-enabled serversCVE-2025-12419Fix available9.9 Critical
- mattermost, mattermost server +1 moreChannel member objects leak read statusCVE-2025-55074Fix available3.0 Low
- mattermost, mattermost server +1 morePassword hash and MFA secret returned in user email verification endpointCVE-2025-11794Fix available4.9 Medium
- mattermost, mattermost server +1 moreMS Teams plugin OAuth allows editing arbitrary postsCVE-2025-55073Fix available5.4 Medium
- mattermost, mattermost server +1 moreLack of MFA enforcement in WebSocket connectionsCVE-2025-55070Fix available6.5 Medium
- mattermost, mattermost server +1 moreUnauthorized access to archived channel content via threads interfaceCVE-2025-41436Fix available3.1 Low
- mattermost, mattermost server +1 moreGuest user can discover archived public channelsCVE-2025-11776Fix available4.3 Medium
- mattermost, mattermost server +1 moreCross-team channel membership accessCVE-2025-11777Fix available3.1 Low
- mattermost, mattermost server +1 moreArbitrary Mattermost Team can be joined by manipulating the OAuth stateCVE-2025-58073Fix available8.1 High
- mattermost, mattermost server +1 moreSlack import bypasses email verification for team access controlsCVE-2025-41410Fix available5.4 Medium
- mattermost, mattermost server +1 moreGuest user can add unauthorized team users to private channelsCVE-2025-10545Fix available3.1 Low
- mattermost, mattermost server +1 moreArbitrary Mattermost Team can be joined by manipulating the SAML RelayStateCVE-2025-58075Fix available8.1 High
- mattermost, mattermost server +1 moreInsecure string comparison enables timing attacksCVE-2025-54499Fix available3.1 Low
- mattermost, mattermost server +1 moreGuest user can discover active public channelsCVE-2025-41443Fix available4.3 Medium
- mattermost, mattermost server +1 moreIDOR in board file download allows any user to download any file by UUIDCVE-2025-9081Fix available3.1 Low
- mattermost, mattermost server +1 moreAdmin RCE via prepackaged plugins by way of misconfigured imports directoryCVE-2025-9079Fix available8.0 High
- mattermost, mattermost server +1 moreOne-Click Mattermost Account Takeover via Poisoned RelayState SAML ParameterCVE-2025-9072Fix available7.6 High
- mattermost, mattermost server +1 moreOpen redirect in OAuth loginCVE-2025-9084Fix available3.1 Low
- mattermost, mattermost server +1 moreWeak cache keys lead to post IDOR and link preview poisoningCVE-2025-9078Fix available4.3 Medium
- mattermost, mattermost server +1 moreMattermost Server exposes sensitive user credentials during shared channel membership synchronizationCVE-2025-9076Fix available6.5 Medium
- mattermost, mattermost server +1 moreNil pointer dereference in bulk import crashes serverCVE-2025-8402Fix available4.9 Medium
- mattermost, mattermost server +1 morePath traversal in image upload with preview overwriteCVE-2025-6465Fix available4.3 Medium
- mattermost, mattermost server +1 moreTeam invite ID leaked to team admin with no member invite privilegesCVE-2025-47870Fix available4.3 Medium
- mattermost, mattermost server +1 moreMattermost Shared Channel Upload Type Validation BypassCVE-2025-49222Fix available6.8 Medium
- mattermost, mattermost server +1 morePath Traversal in Template Upload Allows Uploading Files Outside Target DirectoryCVE-2025-8023Fix available6.8 Medium
- mattermost, mattermost server +1 moreChannel and Team Membership APIs inadvertently allow loss of Member privileges.CVE-2025-53971Fix available3.8 Low
- mattermost, mattermost server +1 moreAI plugin APIs can be triggered using post actionsCVE-2025-47700Fix available3.5 Low
- mattermost, mattermost server +1 moreThread summarization allows persistent access to channelCVE-2025-49810Fix available3.5 Low
- mattermost, mattermost server +1 moreImport Path Traversal Enables Unauthorized Unsigned Plugin InstallationCVE-2025-36530Fix available6.8 Medium
- mattermost, mattermost server +1 moreInvite token is used as part of the secure communicationCVE-2025-6227Fix available2.2 Low
- mattermost, mattermost server +1 moreArbitrary file read by system admin via path traversalCVE-2025-6233Fix available6.8 Medium
- Show moreLoading…