Skip to contentMattermost Server vulnerabilities
- mattermost, mattermost server +1 moreBoards archive import endpoint allows resource exhaustion via zip bomb and file size limit bypass in MattermostCVE-2026-142986.5 Medium
- mattermost, mattermost server +1 moreSAML certificate deletion allows path traversal to delete arbitrary files outside the config directoryCVE-2026-75215.5 Medium
- mattermost, mattermost server +1 moreMattermost Server Denial of Service via Animated GIF Emoji UploadCVE-2026-108196.5 Medium
- mattermost, mattermost server +1 moreDenial of service via unbounded document content extraction in Mattermost ServerCVE-2026-106004.3 Medium
- mattermost, mattermost server +1 moreUnscoped updates to other playbooks' metric configurationCVE-2026-65414.3 Medium
- mattermost, mattermost server +1 moreMattermost schemes teams endpoint exposes private team invite IDsCVE-2026-98203.8 Low
- mattermost, mattermost server +1 moreRemote cluster metadata enumeration via /share-channel autocompleteCVE-2026-98244.3 Medium
- mattermost, mattermost server +1 moreDeactivated guest accounts can authenticate via magic-link token in Mattermost REST API login endpointCVE-2026-95975.4 Medium
- mattermost, mattermost server +1 moreCrafted message attachment causes client-side denial of service via markdown parser regex backtracking in MattermostCVE-2026-68506.5 Medium
- mattermost, mattermost server +1 moreUnauthorized users can trigger interactive post actions in private channels via action cookie channel mismatch in MattermostCVE-2026-101066.5 Medium
- mattermost, mattermost server +1 moreOrdinary group/direct message member can enable group_constrained and remove all channel participantsCVE-2026-100855.4 Medium
- mattermost, mattermost server +1 moreIncoming webhook user attribution via unvalidated webhook ownerCVE-2026-97084.9 Medium
- mattermost, mattermost server +1 moreAuthenticated remote cluster can modify or delete posts it does not own in Mattermost Connected Workspaces shared channelsCVE-2026-101034.3 Medium
- mattermost, mattermost server +1 moreDeactivated user accounts can continue to obtain valid OAuth access tokens via refresh token grant in MattermostCVE-2026-95715.9 Medium
- mattermost, mattermost server +1 moreSSRF via unvalidated attachment URLs in Mattermost Agents plugin MCP serverCVE-2026-43396.5 Medium
- mattermost, mattermost server +1 moreMarkdown image rendering bypass in AI bot tool result posts in MattermostCVE-2026-34723.5 Low
- mattermost, mattermost server +1 moreUser Manager can demote bot accounts to guest without bot-management permissionCVE-2026-8823Fix available3.8 Low
- mattermost, mattermost server +1 moreIDOR in Jira plugin subscription edit endpointCVE-2026-6062Fix available6.4 Medium
- mattermost, mattermost server +1 moreMattermost Jira plugin had unauthenticated {{/ac/installed}} lifecycle callback during pending Jira Cloud installCVE-2026-6673Fix available6.4 Medium
- mattermost, mattermost server +1 moreImproper Permission Check Allows User Manager to Deactivate Bot AccountsCVE-2026-8074Fix available3.8 Low
- mattermost, mattermost server +1 moreGlobal session revocation does not invalidate active WebSocket connectionsCVE-2026-9162Fix available4.3 Medium
- mattermost, mattermost server +1 moreGitLab Plugin Allows Non-Admin Users to Modify Default Instance ConfigurationCVE-2026-5139Fix available5.4 Medium
- mattermost, mattermost server +1 moreCVE-2026-6961: Path traversal via unsanitized FileInfo.Name in Mattermost federation syncCVE-2026-6961Fix available7.6 High
- mattermost, mattermost server +1 moreMattermost group syncable endpoints allow privilege escalation via scheme_adminCVE-2026-7387Fix available8.8 High
- mattermost, mattermost server +1 morePlugin bot username conflict allows user account to be used as bot identity in Mattermost ServerCVE-2026-6046Fix available5.3 Medium
- mattermost, mattermost server +1 more*Missing* {{invite_user}} *permission check on team creation allows unprivileged users to set open-invite and allowed-domains team settings*CVE-2026-6689Fix available4.3 Medium
- mattermost, mattermost server +1 moreMattermost Remote Cluster PATCH API Leaks Authentication TokensCVE-2026-7184Fix available6.5 Medium
- mattermost, mattermost server +1 moreMattermost: Delegated admins could patch protected default system rolesCVE-2026-6739Fix available6.7 Medium
- mattermost, mattermost server +1 moreMattermost fails to scope role_updated websocket events to authorized team and channel membersCVE-2026-3433Fix available4.3 Medium
- mattermost, mattermost server +1 moreServer panic via outgoing webhook responsesCVE-2026-4915Fix available6.5 Medium
- mattermost, mattermost server +1 moreGitHub OAuth Scope ValidationCVE-2026-28735Fix available5.4 Medium
- mattermost, mattermost server +1 morePersistent notification timing attack causing server denial of serviceCVE-2026-4635Fix available6.5 Medium
- mattermost, mattermost server +1 moreImproper file ownership validation in the Boards API allows unauthorised file accessCVE-2026-3473Fix available5.9 Medium
- mattermost, mattermost server +1 moreInsufficient input validation in GitHub plugin API causes denial of serviceCVE-2026-4646Fix available4.3 Medium
- mattermost, mattermost server +1 moreSanitize team member data returned by APICVE-2026-3636Fix available4.3 Medium
- mattermost, mattermost server +1 moreUnauthenticated WebSocket binary frame causes denial of service in Mattermost ServerCVE-2026-5740Fix available7.5 High
- mattermost, mattermost server +1 moreMissing request body size limits on Zoom plugin HTTP endpointsCVE-2026-5308Fix available4.9 Medium
- mattermost, mattermost server +1 moreDenial of service via crafted TIFF file uploadCVE-2026-5755Fix available6.5 Medium
- mattermost, mattermost server +1 morePath traversal in integration action URL leading to arbitrary API execution via system admin’s auth token.CVE-2026-4858Fix available8.0 High
- mattermost, mattermost server +1 moreInsufficient permission validation on cross-team playbook run creationCVE-2026-4055Fix available4.3 Medium
- mattermost, mattermost server +1 moreSSRF via Host Header Spoofing in Custom Slash CommandsCVE-2026-6333Fix available3.5 Low
- mattermost, mattermost server +1 morePrevent password disclosure and force reset during Slack importCVE-2026-6345Fix available6.5 Medium
- mattermost, mattermost server +1 moreSensitive credentials exposed in plaintext in Mattermost support packetsCVE-2026-6346Fix available8.7 High
- mattermost, mattermost server +1 moreSlash command trigger-word update allowed command hijackingCVE-2026-28732Fix available4.3 Medium
- mattermost, mattermost server +1 moreMattermost Playbooks Plugin fails to enforce view permissions in list endpoints, allowing unauthorized access to public playbooksCVE-2026-6343Fix available4.3 Medium
- mattermost, mattermost server +1 moreMattermost Calls plugin exposes TURN server credentials in plaintext in support packetsCVE-2026-6347Fix available7.6 High
- mattermost, mattermost server +1 moreMissing authorization check in AI message rewrite endpoint allows access to private thread contentCVE-2026-5163Fix available6.5 Medium
- mattermost, mattermost server +1 moreInstance and webhook GitLab plugin commands were able to be run by non-admin usersCVE-2026-31176.5 Medium
- mattermost, mattermost server +1 morePlaybooks Plugin fails to validate team transfers, allowing unauthorized removal of member access via playbook updateCVE-2026-4286Fix available3.1 Low
- mattermost, mattermost server +1 moreMissing request origin validation on burn-on-read reveal endpointCVE-2026-6339Fix available4.3 Medium
- Show moreLoading…