Skip to contentMattermost vulnerabilities
Newest
- mattermost, mattermost server +1 moreMisleading UI for undefined admin console settings in Calls causes security confusionCVE-2025-22445Fix available3.5 Low
- mattermost, mattermost server +1 moreDoS via custom post type for sysconsole plugin readersCVE-2025-20033Fix available4.3 Medium
- mattermost, mattermost server +1 moreAccess control flaw for team admins allows unauthorized team additionsCVE-2025-22449Fix available3.8 Low
- mattermost, mattermost mobile +1 moreInsecure Android File Provider PathsCVE-2024-113585.7 Medium
- mattermost, mattermost server +1 moreZipbomb DoS via Missing Slack Import ValidationCVE-2024-54682Fix available6.5 Medium
- mattermost, mattermost server +1 moreDoS via lack of type validation in CallsCVE-2024-54083Fix available6.5 Medium
- mattermost, mattermost server +1 moreBypass of "Max failed attempts" restriction via race conditionCVE-2024-48872Fix available4.8 Medium
- mattermost, mattermost server +1 moreImproper propagation of permission scheme updates across cluster nodesCVE-2024-122474.6 Medium
- mattermost, mattermost server +1 moreDomain Restriction Bypass on RegistrationCVE-2024-115998.2 High
- mattermost, mattermost server +1 morePrivate channel names leaking when Elasticsearch is enabledCVE-2024-52032Fix available4.3 Medium
- mattermost, mattermost server +1 moreMFA Code ReplayCVE-2024-36250Fix available3.1 Low
- mattermost, mattermost server +1 moreUnauthorized Access to view channels' detailsCVE-2024-42000Fix available2.7 Low
- mattermost, mattermost server +1 moreClient-Side Path Traversal Leading to CSRF in PlaybooksCVE-2024-46872Fix available4.6 Medium
- mattermost, mattermost server +1 moreDoS via Amplified GraphQL Response in PlaybooksCVE-2024-47401Fix available4.3 Medium
- mattermost, mattermost server +1 moreArbitrary post deletion via Playbooks /ignore-thread endpointCVE-2024-50052Fix available4.3 Medium
- mattermost, mattermost server +1 morePrivate channel names leaked with Ctrl+K when ElasticSearch is enabledCVE-2024-10241Fix available4.3 Medium
- mattermostIncorrect Session Creation with Desktop SSOCVE-2024-10214Fix available3.5 Low
- mattermost, mattermost server +1 moreInsufficient Authorization On Unlinked Channel FilesCVE-2024-91554.3 Medium
- mattermost, mattermost server +1 moreDoS via non-string message using permalink embedCVE-2024-47003Fix available3.1 Low
- mattermost, mattermost server +1 moreUnauthorized access on archived channelsCVE-2024-42406Fix available5.4 Medium
- mattermost, mattermost server +1 moreWeak SSRF FilteringCVE-2024-45843Fix available3.1 Low
- mattermost, mattermost server +1 moreUnauthorized access on archived channels via file linksCVE-2024-47145Fix available3.1 Low
- mattermost, mattermost desktop +1 moreInsufficient Electron Fuses ConfigurationCVE-2024-45835Fix available2.5 Low
- mattermost, mattermost desktop +1 moreSilent Desktop Screenshot CaptureCVE-2024-39772Fix available3.7 Low
- mattermost, mattermost mobile +1 moreMobile password gets saved in dictionary under conditionsCVE-2024-458334.5 Medium
- mattermost, mattermost desktop +1 moreRCE in desktop app in Windows by local attackerCVE-2024-39613Fix available5.3 Medium
- mattermost channel export, mattermost +1 moreExcessive Resource Consumption via `/export`CVE-2024-43105Fix available4.3 Medium
- mattermost, mattermost server +1 moreUnauthorized channel file uploadCVE-2024-43780Fix available4.3 Medium
- mattermost, mattermost server +1 moreInsufficient permissions checks on teamsCVE-2024-42497Fix available6.0 Medium
- mattermost, mattermost server +1 moreUnauthorized disabling of invite URLCVE-2024-40884Fix available2.7 Low
- mattermostSystem Role with edit access to permissions can elevate themselves to system adminCVE-2024-8071Fix available4.7 Medium
- mattermostUser creation date manipulation in POST /api/v4/usersCVE-2024-424115.3 Medium
- mattermostOne-click Client-Side Path Traversal Leading to CSRF in User Management admin pageCVE-2024-40886Fix available4.6 Medium
- mattermostIDOR when marking read a user's channelCVE-2024-438134.3 Medium
- mattermostServer crash via Elasticsearch certificate fileCVE-2024-398104.9 Medium
- mattermostEmail addresses of remote users visible in props regardless of server settingsCVE-2024-32939Fix available4.3 Medium
- mattermostMunged email address used for password resets and notificationsCVE-2024-39836Fix available4.8 Medium
- mattermost, mattermost server +1 moreMalicious remote can claim that a user was synced from another remoteCVE-2024-41926Fix available2.7 Low
- mattermost, mattermost server +1 moreMalicious remote can make an arbitrary local channel read-onlyCVE-2024-41162Fix available4.1 Medium
- mattermost, mattermost server +1 moreMalicious remote can create/update/delete arbitrary posts in arbitrary channelsCVE-2024-41144Fix available5.5 Medium
- mattermost, mattermost server +1 moreRemote username set to an arbitrary string by remote userCVE-2024-39839Fix available4.3 Medium
- mattermost, mattermost server +1 moreMalicious remote can create arbitrary channelsCVE-2024-39837Fix available3.8 Low
- mattermostPermanently local data deletion by malicious remoteCVE-2024-39832Fix available6.8 Medium
- mattermostMalicious remote can invite itself to an arbitrary local channelCVE-2024-39777Fix available8.7 High
- mattermostMalicious remote can add users to arbitrary teams and channelsCVE-2024-39274Fix available8.7 High
- mattermostExisting local user overwritten by malicious remoteCVE-2024-36492Fix available7.4 High
- mattermostMalicious remote can create arbitrary reactions on arbitrary postsCVE-2024-29977Fix available2.7 Low
- mattermost, mattermost mobile +1 moreSpoofed push notifications from malicious serverCVE-2024-397674.2 Medium
- mattermost, mattermost mobile +1 moreLaTeX post content manipulation via renderer state leak across contextsCVE-2024-329452.6 Low
- mattermostLimited DoS due to permitting creating users with user-defined IDsCVE-2024-64285.3 Medium
- Show moreLoading…