MS
Product
Mattermost Server
489
CVEs
0
On KEV
9.9
Max CVSS
3
New 30D
Severity mix
Critical 17High 85Medium 345Low 42
Watch
Add Mattermost Server to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2026-4858 | 9.9 | May 21 | Path traversal in integration action URL leading to arbitrary API execution via system admin’s auth token. Affected: 10.11.0 before 10.11.15; 11.4.0 before 11.4.5; 11.5.0 before 11.5.4; 11.6.0 |
| CVE-2025-12421 | 9.9 | Nov 27 | Account Takeover via Code Exchange Endpoint Affected: 10.5.0 before 10.5.13; 10.11.0 before 10.11.5; 10.12.0 before 10.12.2; 11.0.0 before 11.0.3 |
| CVE-2025-12419 | 9.9 | Nov 27 | Account takeover on OAuth/OpenID-enabled servers Affected: 10.5.0 before 10.5.13; 10.11.0 before 10.11.5; 10.12.0 before 10.12.2; 11.0.0 before 11.0.4 |
| CVE-2025-4981 | 9.9 | Jun 20 | Mattermost versions 10.5.x <= 10.5.5, 9.11.x <= 9.11.15, 10.8.x <= 10.8.0, 10.7.x <= 10.7.2, 10.6.x <= 10.6.5 fail to sanitize filenames in the archive extractor which allows… Affected: 9.11.0 before 9.11.16; 10.5.0 before 10.5.6; 10.6.0 before 10.6.6; 10.7.0 before 10.7.3; 10.8.0; 10.8.0; +2 more |
| CVE-2023-6458 | 9.8 | Dec 6 | Mattermost webapp fails to validate route parameters in/<TEAM_NAME>/channels/<CHANNEL_NAME> allowing an attacker to perform a client-side path traversal Affected: before 7.8.14; 8.0.0 before 8.1.5; 9.0.0 before 9.0.3; 9.1.0 before 9.1.2 |
| CVE-2017-18920 | 9.8 | Jun 19 | An issue was discovered in Mattermost Server before 3.6.2 Affected: before 3.6.2 |
| CVE-2017-18915 | 9.8 | Jun 19 | An issue was discovered in Mattermost Server before 3.8.2, 3.7.5, and 3.6.7 Affected: 3.6.0 before 3.6.7; 3.7.0 before 3.7.5; 3.8.0 before 3.8.2 |
| CVE-2017-18908 | 9.8 | Jun 19 | An issue was discovered in Mattermost Server before 4.0.0, 3.10.2, and 3.9.2 Affected: before 3.9.2; 3.10.0 before 3.10.2 |
| CVE-2016-11074 | 9.8 | Jun 19 | An issue was discovered in Mattermost Server before 3.0.0 Affected: before 3.0.0 |
| CVE-2017-18912 | 9.8 | Jun 19 | An issue was discovered in Mattermost Server before 3.8.2, 3.7.5, and 3.6.7 Affected: before 3.6.7; 3.7.0 before 3.7.5; 3.8.0 before 3.8.2 |
| CVE-2017-18900 | 9.8 | Jun 19 | An issue was discovered in Mattermost Server before 4.1.0, 4.0.4, and 3.10.3 Affected: before 3.10.3; 4.0.0 before 4.0.4 |
| CVE-2017-18888 | 9.8 | Jun 19 | An issue was discovered in Mattermost Server before 4.3.0, 4.2.1, and 4.1.2 Affected: before 4.1.2; 4.2.0 before 4.2.1; 4.3.0; 4.3.0; 4.3.0; 4.3.0 |
| CVE-2017-18885 | 9.8 | Jun 19 | An issue was discovered in Mattermost Server before 4.3.0, 4.2.1, and 4.1.2 Affected: before 4.1.2; 4.2.0 before 4.2.1; 4.3.0; 4.3.0; 4.3.0; 4.3.0 |
| CVE-2018-21251 | 9.8 | Jun 19 | An issue was discovered in Mattermost Server before 5.2 and 5.1.1 Affected: before 5.1.1; 5.2.0; 5.2.0; 5.2.0; 5.2.0; 5.2.0; +1 more |
| CVE-2026-12985 | 9.3 | Sep 14 | Mattermost DCR redirect URI allowlist bypass via improper URL component validation Affected: 11.7.0 before 11.7.8; 11.8.0 before 11.8.5; 11.9.0 before 11.9.1 |
| CVE-2017-18911 | 9.1 | Jun 19 | An issue was discovered in Mattermost Server before 3.8.2, 3.7.5, and 3.6.7 Affected: before 3.6.7; 3.7.0 before 3.7.5; 3.8.0 before 3.8.2 |
| CVE-2017-18883 | 9.1 | Jun 19 | An issue was discovered in Mattermost Server before 4.3.0, 4.2.1, and 4.1.2, when serving as an OAuth 2.0 Service Provider Affected: before 4.1.2; 4.2.0 before 4.2.1; 4.3.0; 4.3.0; 4.3.0; 4.3.0 |
| CVE-2026-7387 | 8.8 | Jun 12 | Mattermost group syncable endpoints allow privilege escalation via scheme_admin Affected: 10.11.0 before 10.11.17; 11.5.0 before 11.5.5; 11.6.0 before 11.6.2 |
| CVE-2026-3108 | 8.8 | Mar 26 | Terminal Escape Injection in mmctl Report Posts Command Affected: 10.11.0 before 10.11.11; 11.2.0 before 11.2.3; 11.3.0 before 11.3.2; 11.4.0 |
| CVE-2025-25274 | 8.8 | Mar 21 | Mattermost versions 10.4.x <= 10.4.2, 10.3.x <= 10.3.3, 9.11.x <= 9.11.8 fail to restrict command execution in archived channels, which allows authenticated users to run commands… Affected: 9.11.0 before 9.11.9; 10.3.0 before 10.3.4; 10.4.0 before 10.4.3 |
| CVE-2025-25068 | 8.8 | Mar 21 | Mattermost versions 10.4.x <= 10.4.2, 10.3.x <= 10.3.3, 9.11.x <= 9.11.8, 10.5.x <= 10.5.0 fail to enforce MFA on plugin endpoints, which allows authenticated attackers to bypass… Affected: 9.11.0 before 9.11.9; 10.3.0 before 10.3.4; 10.4.0 before 10.4.3; 10.5.0 before 10.5.1 |
| CVE-2025-1412 | 8.8 | Feb 24 | Mattermost versions 9.11.x <= 9.11.6, 10.4.x <= 10.4.1 fail to invalidate all active sessions when converting a user to a bot, with allows the converted user to escalate their… Affected: 9.11.0 before 9.11.7; 10.4.0 before 10.4.2 |
| CVE-2024-2450 | 8.8 | Mar 15 | Mattermost versions 8.1.x before 8.1.10, 9.2.x before 9.2.6, 9.3.x before 9.3.2, and 9.4.x before 9.4.3 fail to correctly verify account ownership when switching from email to… Affected: 8.1.0 before 8.1.10; 9.2.0 before 9.2.6; 9.3.0 before 9.3.2; 9.4.0 before 9.4.3; 9.5.0 |
| CVE-2023-45316 | 8.8 | Dec 12 | Mattermost fails to validate if a relative path is passed in /plugins/playbooks/api/v0/telemetry/run/<telem_run_id> as a telemetry run ID, allowing an attacker to use a path… Affected: through 7.8.14; 8.0.0 through 8.1.5; 9.0.0 through 9.0.3; 9.1.1 through 9.1.2; 9.2.0 through 9.2.1 |
| CVE-2023-2515 | 8.8 | May 12 | Mattermost fails to restrict a user with permissions to edit other users and to create personal access tokens from elevating their privileges to system admin Affected: before 7.1.8; 7.2.0 before 7.7.4; 7.8.0 before 7.8.3; 7.9.0 before 7.9.2 |
| CVE-2022-1384 | 8.8 | Apr 19 | Mattermost version 6.4.x and earlier fails to properly check the plugin version when a plugin is installed from the Marketplace, which allows an authenticated and an authorized… Affected: before 6.5.0 |
| CVE-2017-18903 | 8.8 | Jun 19 | An issue was discovered in Mattermost Server before 4.0.0, 3.10.2, and 3.9.2 Affected: before 3.9.2; 3.10.0 before 3.10.2 |
| CVE-2017-18886 | 8.8 | Jun 19 | An issue was discovered in Mattermost Server before 4.3.0, 4.2.1, and 4.1.2 Affected: before 4.1.2; 4.2.0 before 4.2.1; 4.3.0; 4.3.0; 4.3.0; 4.3.0 |
| CVE-2018-21264 | 8.8 | Jun 19 | An issue was discovered in Mattermost Server before 4.7.0, 4.6.2, and 4.5.2 Affected: before 4.5.2; 4.6.0 before 4.6.2; 4.7.0; 4.7.0; 4.7.0; 4.7.0 |
| CVE-2018-21263 | 8.8 | Jun 19 | An issue was discovered in Mattermost Server before 4.7.0, 4.6.2, and 4.5.2 Affected: before 4.5.2; 4.6.0 before 4.6.2; 4.7.0; 4.7.0; 4.7.0; 4.7.0 |
| CVE-2019-20865 | 8.8 | Jun 19 | An issue was discovered in Mattermost Server before 5.12.0, 5.11.1, 5.10.2, 5.9.2, and 4.10.10 Affected: before 4.10.10; 5.9.0 before 5.9.2; 5.10.0 before 5.10.2; 5.11.0 before 5.11.1; 5.12.0; 5.12.0; +4 more |
| CVE-2019-20841 | 8.8 | Jun 19 | An issue was discovered in Mattermost Server before 5.18.0, 5.17.2, 5.16.4, 5.15.4, and 5.9.7 Affected: before 5.9.7; 5.15.0 before 5.15.4; 5.16.0 before 5.16.4; 5.17.0 before 5.17.2; 5.18.0; 5.18.0; +2 more |
| CVE-2026-6346 | 8.7 | May 18 | Sensitive credentials exposed in plaintext in Mattermost support packets Affected: 10.11.0 before 10.11.14; 11.4.0 before 11.4.4; 11.5.0 before 11.5.2 |
| CVE-2026-2454 | 8.6 | Mar 16 | DoS in Calls plugin via malformed msgpack in websocket request. Affected: 10.11.0 before 10.11.11; 11.2.0 before 11.2.3; 11.3.0 before 11.3.1 |
| CVE-2026-9816 | 8.3 | Aug 17 | Insufficient server-side validation of board member role fields permits privilege escalation Affected: 10.11.0 before 10.11.22; 11.7.0 before 11.7.7; 11.8.0 before 11.8.4 |
| CVE-2025-14273 | 8.3 | Dec 22 | Mattermost Jira plugin user spoofing enables Jira request forgery. Affected: 10.11.0 before 10.11.8; 10.12.0 before 10.12.4; 11.0.0 before 11.0.6; 11.1.0 before 11.1.1 |
| CVE-2023-4478 | 8.2 | Aug 25 | Mattermost fails to restrict which parameters' values it takes from the request during signup allowing an attacker to register users as inactive, thus blocking them from later… Affected: before 7.8.9; 7.9.0 before 7.10.5; 8.0.0 |
| CVE-2023-3591 | 8.2 | Jul 17 | Mattermost fails to invalidate previously generated password reset tokens when a new reset token was created Affected: 7.8.0 before 7.8.7; 7.9.0 before 7.9.5; 7.10.0 before 7.10.3 |
| CVE-2026-28741 | 8.1 | Apr 15 | CSRF Protection Bypass Allows Updating a User's Authentication Method Affected: 10.11.0 before 10.11.13; 11.3.0 before 11.3.3; 11.4.0 before 11.4.3; 11.5.0 before 11.5.1 |
| CVE-2025-58073 | 8.1 | Oct 16 | Arbitrary Mattermost Team can be joined by manipulating the OAuth state Affected: 10.5.0 before 10.5.11; 10.10.0 before 10.10.3; 10.11.0 before 10.11.3 |
| CVE-2025-58075 | 8.1 | Oct 16 | Arbitrary Mattermost Team can be joined by manipulating the SAML RelayState Affected: 10.5.0 before 10.5.11; 10.10.0 before 10.10.3; 10.11.0 before 10.11.3 |
| CVE-2023-3581 | 8.1 | Jul 17 | Mattermost fails to properly validate the origin of a websocket connection allowing a MITM attacker on Mattermost to access the websocket APIs Affected: 7.8.0 before 7.8.7; 7.9.0 before 7.9.5; 7.10.0 before 7.10.3 |
| CVE-2017-18906 | 8.1 | Jun 19 | An issue was discovered in Mattermost Server before 4.0.0, 3.10.2, and 3.9.2, when Single Sign-On OAuth2 is used Affected: before 3.9.2; 3.10.0 before 3.10.2 |
| CVE-2017-18894 | 8.1 | Jun 19 | An issue was discovered in Mattermost Server before 4.2.0, 4.1.1, and 4.0.5, when used as an OAuth 2.0 service provider Affected: before 4.0.5; 4.1.0 before 4.1.1; 4.2.0; 4.2.0; 4.2.0; 4.2.0 |
| CVE-2017-18884 | 8.1 | Jun 19 | An issue was discovered in Mattermost Server before 4.3.0, 4.2.1, and 4.1.2 Affected: before 4.1.2; 4.2.0 before 4.2.1; 4.3.0; 4.3.0; 4.3.0; 4.3.0 |
| CVE-2026-6961 | 7.6 | Jun 12 | CVE-2026-6961: Path traversal via unsanitized FileInfo.Name in Mattermost federation sync Affected: 10.11.0 before 10.11.17; 11.5.0 before 11.5.5; 11.6.0 before 11.6.2 |
| CVE-2026-6347 | 7.6 | May 18 | Mattermost Calls plugin exposes TURN server credentials in plaintext in support packets Affected: 10.11.0 before 10.11.14; 11.4.0 before 11.4.4; 11.5.0 before 11.5.2 |
| CVE-2026-5740 | 7.5 | May 22 | Unauthenticated WebSocket binary frame causes denial of service in Mattermost Server Affected: 10.11.0 before 10.11.15; 11.4.0 before 11.4.5; 11.5.0 before 11.5.4; 11.6.0 before 11.6.1 |
| CVE-2026-5308 | 7.5 | May 22 | Missing request body size limits on Zoom plugin HTTP endpoints Affected: 10.11.0 before 10.11.15; 11.4.0 before 11.4.5; 11.5.0 before 11.5.4; 11.6.0 before 11.6.1 |
| CVE-2026-20719 | 7.5 | Mar 25 | DoS via URL Previews Rendering Malicious SVGs Affected: 10.11.0 before 10.11.12; 11.2.0 before 11.2.4; 11.3.0 before 11.3.2; 11.4.0 before 11.4.1 |