Skip to contentMattermost vulnerabilities
Newest
- mattermost, mattermost server +1 morePassword hash and MFA secret returned in user email verification endpointCVE-2025-11794Fix available4.9 Medium
- mattermost, mattermost server +1 moreMS Teams plugin OAuth allows editing arbitrary postsCVE-2025-55073Fix available5.4 Medium
- mattermost, mattermost server +1 moreLack of MFA enforcement in WebSocket connectionsCVE-2025-55070Fix available6.5 Medium
- mattermost, mattermost server +1 moreUnauthorized access to archived channel content via threads interfaceCVE-2025-41436Fix available3.1 Low
- mattermost, mattermost server +1 moreGuest user can discover archived public channelsCVE-2025-11776Fix available4.3 Medium
- mattermost, mattermost mobile +1 moreInadequate validation of SSO redirect credentials permits credential theftCVE-2025-594806.1 Medium
- mattermost, mattermost server +1 moreCross-team channel membership accessCVE-2025-11777Fix available3.1 Low
- mattermost, mattermost desktop +1 moreMattermost Desktop DoS when user has basic authentication server configuredCVE-2025-550356.1 Medium
- mattermost, mattermost server +1 moreArbitrary Mattermost Team can be joined by manipulating the OAuth stateCVE-2025-58073Fix available8.1 High
- mattermost, mattermost server +1 moreSlack import bypasses email verification for team access controlsCVE-2025-41410Fix available5.4 Medium
- mattermost, mattermost server +1 moreGuest user can add unauthorized team users to private channelsCVE-2025-10545Fix available3.1 Low
- mattermost, mattermost server +1 moreArbitrary Mattermost Team can be joined by manipulating the SAML RelayStateCVE-2025-58075Fix available8.1 High
- mattermost, mattermost server +1 moreInsecure string comparison enables timing attacksCVE-2025-54499Fix available3.1 Low
- mattermost, mattermost server +1 moreGuest user can discover active public channelsCVE-2025-41443Fix available4.3 Medium
- mattermost, mattermost desktop +1 moreMattermost Desktop App crashes when clicking on malformed external URLCVE-2025-580843.5 Low
- mattermost, mattermost server +1 moreIDOR in board file download allows any user to download any file by UUIDCVE-2025-9081Fix available3.1 Low
- mattermost, mattermost server +1 moreAdmin RCE via prepackaged plugins by way of misconfigured imports directoryCVE-2025-9079Fix available8.0 High
- mattermost, mattermost server +1 moreOne-Click Mattermost Account Takeover via Poisoned RelayState SAML ParameterCVE-2025-9072Fix available7.6 High
- mattermost, mattermost server +1 moreOpen redirect in OAuth loginCVE-2025-9084Fix available3.1 Low
- mattermost, mattermost server +1 moreWeak cache keys lead to post IDOR and link preview poisoningCVE-2025-9078Fix available4.3 Medium
- mattermost, mattermost server +1 moreMattermost Server exposes sensitive user credentials during shared channel membership synchronizationCVE-2025-9076Fix available6.5 Medium
- mattermost, mattermost server +1 moreNil pointer dereference in bulk import crashes serverCVE-2025-8402Fix available4.9 Medium
- mattermost, mattermost server +1 morePath traversal in image upload with preview overwriteCVE-2025-6465Fix available4.3 Medium
- mattermost, mattermost server +1 moreTeam invite ID leaked to team admin with no member invite privilegesCVE-2025-47870Fix available4.3 Medium
- mattermost, mattermost server +1 moreMattermost Shared Channel Upload Type Validation BypassCVE-2025-49222Fix available6.8 Medium
- mattermost, mattermost server +1 morePath Traversal in Template Upload Allows Uploading Files Outside Target DirectoryCVE-2025-8023Fix available6.8 Medium
- mattermost, mattermost server +1 moreChannel and Team Membership APIs inadvertently allow loss of Member privileges.CVE-2025-53971Fix available3.8 Low
- mattermost, mattermost server +1 moreAI plugin APIs can be triggered using post actionsCVE-2025-47700Fix available3.5 Low
- mattermost, mattermost server +1 moreThread summarization allows persistent access to channelCVE-2025-49810Fix available3.5 Low
- mattermost, mattermost server +1 moreImport Path Traversal Enables Unauthorized Unsigned Plugin InstallationCVE-2025-36530Fix available6.8 Medium
- mattermost confluence, confluence plugin +1 moreUnauthorized Channel Subscription Creation in Mattermost Confluence PluginCVE-2025-8285Fix available4.0 Medium
- mattermost confluence, confluence plugin +1 moreUnexpected input to Create Channel Subscription endpoint causes DoS in Mattermost Confluence PluginCVE-2025-54525Fix available7.5 High
- mattermost confluence, confluence plugin +1 moreUnauthenticated Channel Subscription Edit in Mattermost Confluence PluginCVE-2025-54478Fix available7.2 High
- mattermost confluence, confluence plugin +1 moreUnexpected Input to Cloud Webhook endpoint Causes DoS in Mattermost Confluence PluginCVE-2025-54463Fix available5.9 Medium
- mattermost confluence, confluence plugin +1 moreUnauthorized Subscription Creation to Confluence Space in Mattermost Confluence PluginCVE-2025-54458Fix available5.0 Medium
- mattermost confluence, confluence plugin +1 moreUnauthorized Channel Subscription Edit in Mattermost Confluence PluginCVE-2025-53910Fix available4.0 Medium
- mattermost confluence, confluence plugin +1 moreLack of Authorization on Get Channel Subscriptions for Autocomplete in Mattermost Confluence PluginCVE-2025-53857Fix available3.7 Low
- mattermost confluence, confluence plugin +1 moreUnexpected Input to Server Webhook endpoint Causes DoS in Mattermost Confluence PluginCVE-2025-53514Fix available5.9 Medium
- mattermost confluence, confluence plugin +1 moreUnexpected input to Update Channel Subscription endpoint causes DoS in Mattermost Confluence PluginCVE-2025-52931Fix available7.5 High
- mattermost confluence, confluence plugin +1 moreUnauthenticated Access to Channel Subscription in Mattermost Confluence PluginCVE-2025-49221Fix available3.7 Low
- mattermost confluence, confluence plugin +1 moreUnauthorized Subscription Edit to Confluence Space in Mattermost Confluence PluginCVE-2025-48731Fix available6.4 Medium
- mattermost confluence, confluence plugin +1 moreUnauthenticated Channel Subscription Creation in Mattermost Confluence PluginCVE-2025-44004Fix available7.2 High
- mattermost confluence, confluence plugin +1 moreUnauthorized Channel Subscription Read in Mattermost Confluence PluginCVE-2025-44001Fix available4.0 Medium
- mattermost, mattermost server +1 moreInvite token is used as part of the secure communicationCVE-2025-6227Fix available2.2 Low
- mattermost, mattermost server +1 moreArbitrary file read by system admin via path traversalCVE-2025-6233Fix available6.8 Medium
- mattermost, mattermost server +1 moreIDOR in CreatePost API allows for timeboxed message disclosureCVE-2025-6226Fix available6.5 Medium
- mattermost, mattermost server +1 moreMattermost Playbooks exposes private channel metadata to unauthorized users via run metadata APICVE-2025-47871Fix available4.3 Medium
- mattermost, mattermost server +1 moreMattermost Playbooks allows privilege escalation through improper access control in playbook run participant managementCVE-2025-46702Fix available5.4 Medium
- mattermost, mattermost server +1 moreUnauthorized Guest user access to PlaybookCVE-2025-3228Fix available4.3 Medium
- mattermost, mattermost server +1 moreUnauthorized channel member management through playbook runsCVE-2025-3227Fix available4.3 Medium
- Show moreLoading…