Login Request a demo
MS
Product
Mattermost Server
by Mattermost · last CVE Oct 16, 2026
489
CVEs
0
On KEV
9.9
Max CVSS
3
New 30D
Vulnerabilities489In the news0Timeline
Severity mix
Critical 17High 85Medium 345Low 42
Severity
All severities489Critical17High85Medium345Low42
Exploitation
On CISA KEV0Exploited in the wild0
Watch

Add Mattermost Server to your stack to get only the CVEs that touch what you run.

CVECVSSEPSSPublishedSummary · affected versions
CVE-2024-24988
6.5
1%
Feb 29
Mattermost fails to properly validate the length of the emoji value in the custom user status, allowing an attacker to send multiple times a very long string as an emoji value…
Affected: before 8.1.8; 9.0.0 before 9.1.5; 9.2.0 before 9.2.4
CVE-2024-23493
6.5
0%
Feb 29
Mattermost fails to properly authorize the requests fetching team associated AD/LDAP groups, allowing a user to fetch details of AD/LDAP groups of a team that they are not a…
Affected: before 8.1.9; 9.0.0 before 9.2.5; 9.4.0 before 9.4.2; 9.3.0; 9.3.0; 9.3.0
CVE-2023-49809
6.5
1%
Dec 12
Mattermost fails to handle a null request body in the /add endpoint, allowing a simple member to send a request with null request body to that endpoint and make it crash
Affected: through 8.1.5; 9.0.0 through 9.1.0
CVE-2023-5333
6.5
1%
Oct 9
Mattermost fails to deduplicate input IDs allowing a simple user to cause the application to consume excessive resources and possibly crash by sending a specially crafted request…
Affected: before 7.8.11; 8.0.0 before 8.0.3; 8.1.0 before 8.1.2
CVE-2023-3593
6.5
1%
Jul 17
Mattermost fails to properly validate markdown, allowing an attacker to crash the server via a specially crafted markdown input
Affected: 7.8.0 before 7.8.7; 7.9.0 before 7.9.5; 7.10.0 before 7.10.3
CVE-2023-1775
6.5
1%
Mar 31
When running in a High Availability configuration, Mattermost fails to sanitize some of the user_updated and post_deleted events broadcast to all users, leading to disclosure of…
Affected: before 7.1.6; 7.7.1
CVE-2022-3257
6.5
1%
Sep 23
Mattermost version 7.1.x and earlier fails to sufficiently process a specifically crafted GIF file when it is uploaded while drafting a post, which allows authenticated users to…
Affected: before 7.2.0
CVE-2022-3147
6.5
1%
Sep 9
Mattermost version 7.0.x and earlier fails to sufficiently limit the in-memory sizes of concurrently uploaded JPEG images, which allows authenticated users to cause resource…
Affected: before 7.1.0
CVE-2022-2401
6.5
1%
Jul 14
Unrestricted information disclosure of all users in Mattermost version 6.7.0 and earlier allows team members to access some sensitive information by directly accessing the APIs
Affected: before 6.3.9; 6.4.0 before 6.5.2; 6.6.0; 6.6.1; 6.7.0
CVE-2022-1982
6.5
1%
Jun 2
Uncontrolled resource consumption in Mattermost version 6.6.0 and earlier allows an authenticated attacker to crash the server via a crafted SVG attachment on a post
Affected: 5.0.0 before 6.3.8; 6.4.0 before 6.4.3; 6.5.0; 6.6.0
CVE-2022-1337
6.5
1%
Apr 13
The image proxy component in Mattermost version 6.4.1 and earlier allocates memory for multiple copies of a proxied image, which allows an authenticated attacker to crash the…
Affected: 5.37.0 before 5.37.9; 6.2.0 before 6.2.5; 6.3.0 before 6.3.5; 6.4.0 before 6.4.2
CVE-2022-0904
6.5
1%
Mar 10
A stack overflow bug in the document extractor in Mattermost Server in versions up to and including 6.3.2 allows an attacker to crash the server via submitting a maliciously…
Affected: 5.0.0 before 5.37.8; 6.0.0 before 6.1.3; 6.2.0 before 6.2.3; 6.3.0 before 6.3.3
CVE-2016-11078
6.5
1%
Jun 19
An issue was discovered in Mattermost Server before 3.0.0
Affected: before 3.0.0
CVE-2016-11072
6.5
1%
Jun 19
An issue was discovered in Mattermost Server before 3.0.2
Affected: before 3.0.2
CVE-2017-18874
6.5
1%
Jun 19
An issue was discovered in Mattermost Server before 4.3.0, 4.2.1, and 4.1.2 when local storage for files is used
Affected: before 4.1.2; 4.2.0 before 4.2.1; 4.3.0; 4.3.0; 4.3.0; 4.3.0
CVE-2018-21250
6.5
1%
Jun 19
An issue was discovered in Mattermost Server before 5.2.2, 5.1.2, and 4.10.4
Affected: before 4.10.4; 5.1.0 before 5.1.2; 5.2.0 before 5.2.2
CVE-2019-20873
6.5
1%
Jun 19
An issue was discovered in Mattermost Server before 5.9.0, 5.8.1, 5.7.3, and 4.10.8
Affected: before 4.10.8; 5.7.0 before 5.7.3; 5.8.0 before 5.8.1; 5.9.0; 5.9.0; 5.9.0; +1 more
CVE-2020-14460
6.5
1%
Jun 19
An issue was discovered in Mattermost Server before 5.19.0, 5.18.1, 5.17.3, 5.16.5, and 5.9.8
Affected: before 5.9.8; 5.16.0 before 5.16.5; 5.17.0 before 5.17.3; 5.18.0 before 5.18.1; 5.19.0; 5.19.0; +1 more
CVE-2019-20844
6.5
0%
Jun 19
An issue was discovered in Mattermost Server before 5.18.0, 5.17.2, 5.16.4, 5.15.4, and 5.9.7
Affected: before 5.9.7; 5.15.0 before 5.15.4; 5.16.0 before 5.16.4; 5.17.0 before 5.17.2; 5.18.0; 5.18.0; +2 more
CVE-2026-6062
6.4
0%
Jun 22
IDOR in Jira plugin subscription edit endpoint
Affected: 10.11.0 before 10.11.18; 11.5.0 before 11.5.6; 11.6.0 before 11.6.3; 11.7.0 before 11.7.1
CVE-2026-6673
6.4
0%
Jun 22
Mattermost Jira plugin had unauthenticated {{/ac/installed}} lifecycle callback during pending Jira Cloud install
Affected: 10.11.0 before 10.11.18; 11.5.0 before 11.5.6; 11.6.0 before 11.6.3; 11.7.0 before 11.7.1
CVE-2026-10527
6.3
0%
Aug 17
Boards plugin retains Board Admin rights for users demoted to System Guest
Affected: 10.11.0 before 10.11.22; 11.7.0 before 11.7.7; 11.8.0 before 11.8.4
CVE-2026-16048
6.3
0%
Aug 17
Channel member roles accept out-of-scope roles
Affected: 10.11.0 before 10.11.22; 11.7.0 before 11.7.7; 11.8.0 before 11.8.3
CVE-2024-31859
6.3
0%
May 26
Mattermost versions 9.5.x <= 9.5.3, 9.6.x <= 9.6.1 and 8.1.x <= 8.1.12 fail to perform proper authorization checks which allows a member running a playbook in an existing channel…
Affected: 8.1.0 before 8.1.13; 9.5.0 before 9.5.4; 9.6.0 before 9.6.2
CVE-2026-27656
6.1
0%
Mar 25
Account Takeover via Substring Matching in OpenID Connect Authentication
Affected: 10.11.0 before 10.11.12; 11.2.0 before 11.2.4; 11.3.0 before 11.3.2; 11.4.0 before 11.4.1
CVE-2025-62690
6.1
0%
Dec 17
Open redirect in error page when link opened in new tab
Affected: 10.11.0 before 10.11.5
CVE-2025-9084
6.1
0%
Sep 15
Open redirect in OAuth login
Affected: 10.5.0 before 10.5.10
CVE-2024-2445
6.1
0%
Mar 15
Mattermost Jira plugin versions shipped with Mattermost versions 8.1.x before 8.1.10, 9.2.x before 9.2.6, 9.3.x before 9.3.2, and 9.4.x before 9.4.3 fail to escape user-controlled…
Affected: 8.1.0 before 8.1.10; 9.2.0 before 9.2.6; 9.3.0 before 9.3.2; 9.4.0 before 9.4.3
CVE-2023-7113
6.1
0%
Dec 29
Mattermost version 8.1.6 and earlier fails to sanitize channel mention data in posts, which allows an attacker to inject markup in the web client
Affected: before 8.1.7
CVE-2023-1421
6.1
0%
Mar 15
A reflected cross-site scripting vulnerability in the OAuth flow completion endpoints in Mattermost allows an attacker to send AJAX requests on behalf of the victim via sharing a…
Affected: 5.32.0 before 7.7.0
CVE-2017-18921
6.1
1%
Jun 19
An issue was discovered in Mattermost Server before 3.6.0 and 3.5.2
Affected: before 3.5.2
CVE-2017-18913
6.1
1%
Jun 19
An issue was discovered in Mattermost Server before 3.8.2, 3.7.5, and 3.6.7
Affected: before 3.6.7; 3.7.0 before 3.7.5; 3.8.0 before 3.8.2
CVE-2017-18907
6.1
1%
Jun 19
An issue was discovered in Mattermost Server before 4.0.0, 3.10.2, and 3.9.2
Affected: before 3.9.2; 3.10.0 before 3.10.2
CVE-2016-11084
6.1
0%
Jun 19
An issue was discovered in Mattermost Server before 2.1.0
Affected: before 2.1.0
CVE-2016-11083
6.1
1%
Jun 19
An issue was discovered in Mattermost Server before 2.2.0
Affected: before 2.2.0
CVE-2016-11082
6.1
1%
Jun 19
An issue was discovered in Mattermost Server before 2.2.0
Affected: before 2.2.0
CVE-2016-11079
6.1
1%
Jun 19
An issue was discovered in Mattermost Server before 3.0.0
Affected: before 3.0.0
CVE-2016-11073
6.1
1%
Jun 19
An issue was discovered in Mattermost Server before 3.0.0
Affected: before 3.0.0
CVE-2016-11071
6.1
1%
Jun 19
An issue was discovered in Mattermost Server before 3.1.0
Affected: before 3.1.0
CVE-2016-11063
6.1
1%
Jun 19
An issue was discovered in Mattermost Server before 3.5.1
Affected: before 3.5.1
CVE-2017-18904
6.1
1%
Jun 19
An issue was discovered in Mattermost Server before 4.0.0, 3.10.2, and 3.9.2
Affected: before 3.9.2; 3.10.0 before 3.10.2
CVE-2017-18897
6.1
1%
Jun 19
An issue was discovered in Mattermost Server before 4.2.0, 4.1.1, and 4.0.5, when used as an OAuth 2.0 service provider
Affected: before 4.0.5; 4.1.0 before 4.1.1; 4.2.0; 4.2.0; 4.2.0; 4.2.0
CVE-2017-18893
6.1
1%
Jun 19
An issue was discovered in Mattermost Server before 4.2.0, 4.1.1, and 4.0.5
Affected: before 4.0.5; 4.1.0 before 4.1.1; 4.2.0; 4.2.0; 4.2.0; 4.2.0
CVE-2017-18892
6.1
1%
Jun 19
An issue was discovered in Mattermost Server before 4.2.0, 4.1.1, and 4.0.5
Affected: before 4.0.5; 4.1.0 before 4.1.1; 4.2.0; 4.2.0; 4.2.0; 4.2.0
CVE-2017-18891
6.1
1%
Jun 19
An issue was discovered in Mattermost Server before 4.2.0, 4.1.1, and 4.0.5
Affected: before 4.0.5; 4.1.0 before 4.1.1; 4.2.0; 4.2.0; 4.2.0; 4.2.0
CVE-2017-18882
6.1
1%
Jun 19
An issue was discovered in Mattermost Server before 4.3.0, 4.2.1, and 4.1.2
Affected: before 4.1.2; 4.2.0 before 4.2.1; 4.3.0; 4.3.0; 4.3.0; 4.3.0
CVE-2017-18881
6.1
1%
Jun 19
An issue was discovered in Mattermost Server before 4.3.0, 4.2.1, and 4.1.2
Affected: before 4.1.2; 4.2.0 before 4.2.1; 4.3.0; 4.3.0; 4.3.0; 4.3.0
CVE-2017-18880
6.1
1%
Jun 19
An issue was discovered in Mattermost Server before 4.3.0, 4.2.1, and 4.1.2
Affected: before 4.1.2; 4.2.0 before 4.2.1; 4.3.0; 4.3.0; 4.3.0; 4.3.0
CVE-2017-18879
6.1
1%
Jun 19
An issue was discovered in Mattermost Server before 4.3.0, 4.2.1, and 4.1.2
Affected: before 4.1.2; 4.2.0 before 4.2.1; 4.3.0; 4.3.0; 4.3.0; 4.3.0
CVE-2017-18877
6.1
1%
Jun 19
An issue was discovered in Mattermost Server before 4.3.0, 4.2.1, and 4.1.2
Affected: 4.1.0 before 4.1.2; 4.2.0 before 4.2.1; 4.3.0; 4.3.0; 4.3.0; 4.3.0
Page 2 of 7 · 345 total
123…7