Skip to contentMattermost vulnerabilities
Newest
- mattermost, mattermost server +1 morePermalink Preview Information Disclosure After Permission RevocationCVE-2026-16294.3 Medium
- mattermost, mattermost server +1 moreTeam Admin Privilege Escalation to Demote Members to GuestCVE-2026-262303.8 Low
- mattermost, mattermost server +1 moreDoS in Calls plugin via malformed msgpack in websocket request.CVE-2026-24545.8 Medium
- mattermost, mattermost server +1 morePermission Bypass in Playbook Run CreationCVE-2026-26304Fix available4.3 Medium
- mattermost, mattermost server +1 moreGuest users can bypass read permissions via search APICVE-2026-24692Fix available4.3 Medium
- mattermost, mattermost server +1 morePassword Change Bypass via Auth Switch EndpointCVE-2026-22545Fix available3.1 Low
- mattermost, mattermost server +1 moreSSRF bypass via IPv4-mapped IPv6 literalsCVE-2026-2455Fix available4.3 Medium
- mattermost, mattermost server +1 morePrivate channel enumeration via /mute slash commandCVE-2026-21386Fix available4.3 Medium
- mattermost, mattermost server +1 moreMemory Exhaustion via Malformed DOC File UploadCVE-2026-25780Fix available4.3 Medium
- mattermost, mattermost server +1 moreGuest user can upload files without permission across teamsCVE-2026-4265Fix available4.3 Medium
- mattermost, mattermost server +1 moreDenial of service via malformed User-Agent header in getBrowserVersionCVE-2026-25783Fix available4.3 Medium
- mattermost, mattermost server +1 moreDoS attack via login attempts with multi-megabyte passwordsCVE-2026-24458Fix available7.5 High
- mattermost, mattermost server +1 moreAdmin RCE via Malicious Plugin Upload on CI Test InstancesCVE-2026-24626.6 Medium
- mattermost, mattermost server +1 moreInformation Disclosure via WebSocket Event When Deleting Unrevealed Burn on Read PostsCVE-2026-2578Fix available4.3 Medium
- mattermost, mattermost server +1 moreMemory Exhaustion via Malformed PSD File UploadCVE-2026-26246Fix available4.3 Medium
- mattermost, mattermost server +1 moreUnauthorized channel enumeration in private teams after member removalCVE-2026-2458Fix available4.3 Medium
- mattermost, mattermost server +1 moreWebSocket Message Spoofing via Permalink Embed ManipulationCVE-2026-2457Fix available4.3 Medium
- mattermost, mattermost server +1 moreMissing authorization check allows unauthorized modification of other users' comments on a boardCVE-2026-2461Public exploitFix available4.3 Medium
- mattermost, mattermost server +1 moreUnauthorized access to invite ID during team creationCVE-2026-2463Fix available4.3 Medium
- mattermost, mattermost ms teams +1 moreMS Teams plugin sensitive config values not properly masked in support packetsCVE-2026-2476Fix available7.6 High
- mattermost, mattermost server +1 moreDenial of Service via Unbounded Memory Allocation in Integration ActionsCVE-2026-2456Fix available5.3 Medium
- mattermost, mattermost desktop +1 moreMattermost allows external websites to open within the app, exposing preload functionality to non-trusted sites.CVE-2026-16284.6 Medium
- mattermost, mattermost server +1 moreTeam Admin Bypass of Invite Permissions via allow_open_invite FieldCVE-2025-14573Fix available3.8 Low
- mattermost, mattermost desktop +1 moreArbitrary application execution via unvalidated server-controlled URLs in Help menuCVE-2026-10467.6 High
- mattermost, mattermost server +1 moreInformation disclosure via channel mentions in postsCVE-2025-14350Fix available4.3 Medium
- mattermost, mattermost server +1 moreUser profile update exposes password hash and MFA secretsCVE-2025-13821Fix available5.7 Medium
- mattermost, mattermost zoom, server +2 moreMattermost Zoom Plugin channel preference API lacks authorization checksCVE-2026-0997Fix available4.3 Medium
- mattermost, mattermost zoom, server +2 moreMattermost Zoom Plugin allows unauthorized meeting creation and post modification via insufficient API access controlsCVE-2026-0998Fix available4.3 Medium
- mattermost, mattermost server +1 moreAuthentication bypass via userID login when email and username login are disabledCVE-2026-0999Fix available5.4 Medium
- mattermost, mattermost server +1 moreTime-of-check time-of-use vulnerability in common teams APICVE-2026-20796Fix available3.1 Low
- mattermost, mattermost server +1 moreInsufficient Authorization in Mattermost Jira Plugin Allows Unauthorized Access to Post AttachmentsCVE-2026-22892Fix available4.3 Medium
- mattermost confluence, confluence plugin +1 moreCross-Site Scripting (XSS) via Unescaped Display Names in Mattermost Confluence Plugin OAuth2 FlowCVE-2025-13523Fix available7.7 High
- mattermost, mattermost server +1 moreApplication-Level DoS via infinite re-render loop in user profile handlingCVE-2025-14435Fix available6.8 Medium
- mattermost, mattermost server +1 moreDoS from quadratic complexity in model.ParseHashtagsCVE-2025-14822Fix available3.1 Low
- mattermost, mattermost server +1 moreMattermost Jira plugin crafted action leaks Jira issue detailsCVE-2025-64641Fix available4.1 Medium
- mattermost, mattermost server +1 moreUnauthorized Read Access to Private Channel Posts via Mattermost Jira PluginCVE-2025-13767Fix available4.3 Medium
- mattermost, mattermost server +1 moreMattermost Jira plugin user spoofing enables Jira request forgery.CVE-2025-14273Fix available7.2 High
- mattermost, mattermost desktop +1 moreMattermost Desktop App fails to enable Hardened Runtime when packaged for Mac App StoreCVE-2025-133263.9 Low
- mattermost, mattermost server +1 moreLack of Invalidation of Legacy Remote Cluster Invite Tokens After ConfirmationCVE-2025-13324Fix available3.7 Low
- mattermost, mattermost desktop +1 moreMattermost Desktop App logging sensitive information and fails to clear data on server deletionCVE-2025-133213.3 Low
- mattermost, mattermost server +1 moreDoS in Calls plugin via malformed UTF-8 in WebSocket requestCVE-2025-12689Fix available6.5 Medium
- mattermost, mattermost server +1 moreOpen redirect in error page when link opened in new tabCVE-2025-62690Fix available3.1 Low
- mattermost, mattermost server +1 moreMattermost GitHub Plugin allows unauthorized GitHub reactions via reaction forwarding hijackingCVE-2025-13352Fix available3.0 Low
- mattermost, mattermost server +1 moreCSRF Allows Call Initiation and Message DeliveryCVE-2025-62190Fix available4.3 Medium
- mattermost, mattermost server +1 moreUnauthorized access and subscription vulnerability in BoardsCVE-2025-13870Fix available3.1 Low
- mattermost, mattermost server +1 moreInsecure Direct Object Reference in Mattermost Boards Plugin Enables Unauthorised Comment DeletionCVE-2025-127564.3 Medium
- mattermost, mattermost server +1 moreAccount Takeover via Code Exchange EndpointCVE-2025-12421Fix available9.9 Critical
- mattermost, mattermost server +1 moreInformation Disclosure in Common Teams APICVE-2025-12559Fix available4.3 Medium
- mattermost, mattermost server +1 moreAccount takeover on OAuth/OpenID-enabled serversCVE-2025-12419Fix available9.9 Critical
- mattermost, mattermost server +1 moreChannel member objects leak read statusCVE-2025-55074Fix available3.0 Low
- Show moreLoading…