MS
Product
Mattermost Server
489
CVEs
0
On KEV
9.9
Max CVSS
3
New 30D
Severity mix
Critical 17High 85Medium 345Low 42
Watch
Add Mattermost Server to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2025-27936 | 5.9 | Apr 16 | Webhook Secret Exposure via Timing attack in MSteams plugin Affected: before 10.5.2 |
| CVE-2024-32045 | 5.9 | May 26 | Playbook run link to private channel grants channel access Affected: 8.1.0 before 8.1.13; 9.5.0 before 9.5.4; 9.6.0 before 9.6.2 |
| CVE-2026-2456 | 5.7 | Mar 16 | Denial of Service via Unbounded Memory Allocation in Integration Actions Affected: 10.11.0 before 10.11.11; 11.2.0 before 11.2.3; 11.3.0 before 11.3.1 |
| CVE-2025-13821 | 5.7 | Feb 16 | User profile update exposes password hash and MFA secrets Affected: 10.11.0 before 10.11.10; 11.1.0 before 11.1.3; 11.2.0 before 11.2.2 |
| CVE-2024-36255 | 5.7 | May 26 | Post actions can run playbook checklist task commands Affected: 8.1.0 before 8.1.13; 9.5.0 before 9.5.4; 9.6.0 before 9.6.2 |
| CVE-2021-37863 | 5.7 | Dec 17 | Mattermost 6.0 and earlier fails to sufficiently validate parameters during post creation, which allows authenticated attackers to cause a client-side crash of the web application… Affected: through 6.0 |
| CVE-2026-96259 | 5.5 | Sep 22 | Mattermost server-side request forgery via OAuth endpoints configurable by a System Administrator Affected: 11.7.0 before 11.7.11; 11.8.0 before 11.8.6; 11.9.0 before 11.9.2; 11.10.0 before 11.10.2 |
| CVE-2026-82920 | 5.5 | Sep 14 | Mattermost ABAC parent policy bypass via policy update endpoint Affected: 11.7.0 before 11.7.8; 11.8.0 before 11.8.5; 11.9.0 before 11.9.1 |
| CVE-2026-7521 | 5.5 | Jul 28 | SAML certificate deletion allows path traversal to delete arbitrary files outside the config directory Affected: 10.11.0 before 10.11.21; 11.6.0 before 11.6.6; 11.7.0 before 11.7.4; 11.8.0 before 11.8.1 |
| CVE-2026-3113 | 5.5 | Mar 26 | mmctl export download command doesn’t restrict permissions to created file to file owner Affected: 10.11.0 before 10.11.12; 11.2.0 before 11.2.4; 11.3.0 before 11.3.2; 11.4.0 |
| CVE-2019-20872 | 5.5 | Jun 19 | An issue was discovered in Mattermost Server before 5.9.0, 5.8.1, 5.7.3, and 4.10.8 Affected: before 4.10.8; 5.7.0 before 5.7.3; 5.8.0 before 5.8.1; 5.9.0; 5.9.0; 5.9.0; +1 more |
| CVE-2019-20860 | 5.5 | Jun 19 | An issue was discovered in Mattermost Server before 5.14.0, 5.13.3, 5.12.6, and 5.9.4 Affected: before 5.9.4; 5.12.0 before 5.12.6; 5.13.0 before 5.13.3; 5.14.0; 5.14.0; 5.14.0; +2 more |
| CVE-2026-16044 | 5.4 | Aug 17 | Insufficient validation of guest board admin privileges on archive import Affected: 10.11.0 before 10.11.22; 11.7.0 before 11.7.7 |
| CVE-2026-9597 | 5.4 | Jul 13 | Deactivated guest accounts can authenticate via magic-link token in Mattermost REST API login endpoint Affected: 11.6.0 before 11.6.5; 11.7.0 before 11.7.3 |
| CVE-2026-10085 | 5.4 | Jul 13 | Ordinary group/direct message member can enable group_constrained and remove all channel participants Affected: 10.11.0 before 10.11.20; 11.6.0 before 11.6.5; 11.7.0 before 11.7.3 |
| CVE-2026-5139 | 5.4 | Jun 22 | GitLab Plugin Allows Non-Admin Users to Modify Default Instance Configuration Affected: 10.11.0 before 10.11.18; 11.5.0 before 11.5.6; 11.6.0 before 11.6.3; 11.7.0 before 11.7.1 |
| CVE-2026-28735 | 5.4 | May 22 | GitHub OAuth Scope Validation Affected: 10.11.0 before 10.11.15; 11.4.0 before 11.4.5; 11.5.0 before 11.5.4; 11.6.0 before 11.6.1 |
| CVE-2026-4274 | 5.4 | Mar 26 | Insufficient authorization in shared channel membership sync grants team-level access instead of channel-level access Affected: 10.11.0 before 10.11.11; 11.2.0 before 11.2.3; 11.3.0 before 11.3.2; 11.4.0 before 11.4.1 |
| CVE-2025-41410 | 5.4 | Oct 16 | Slack import bypasses email verification for team access controls Affected: 10.5.0 before 10.5.11; 10.10.0 before 10.10.3; 10.11.0 before 10.11.3 |
| CVE-2025-9072 | 5.4 | Sep 15 | One-Click Mattermost Account Takeover via Poisoned RelayState SAML Parameter Affected: 10.5.0 before 10.5.10; 10.9.0 before 10.9.5; 10.10.0 before 10.10.2 |
| CVE-2025-47871 | 5.4 | Jun 30 | Mattermost Playbooks exposes private channel metadata to unauthorized users via run metadata API Affected: 9.11.0 before 9.11.16; 10.5.0 before 10.5.6; 10.6.0 before 10.6.6; 10.7.0 before 10.7.3; 10.8.0; 10.8.0; +2 more |
| CVE-2025-46702 | 5.4 | Jun 30 | Mattermost Playbooks allows privilege escalation through improper access control in playbook run participant management Affected: 9.11.0 before 9.11.16; 10.5.0 before 10.5.6; 10.6.0 before 10.6.6; 10.7.0 before 10.7.3; 10.8.0; 10.8.0; +2 more |
| CVE-2025-3230 | 5.4 | May 30 | Bypass of System Admin User Deactivation Controls for Personal Access Tokens in Mattermost Server Affected: 9.11.0 before 9.11.13; 10.5.0 before 10.5.4; 10.6.0 before 10.6.3; 10.7.0 before 10.7.1 |
| CVE-2025-2475 | 5.4 | Apr 14 | Unauthorized Bot Login Using Credentials Affected: 9.11.0 before 9.11.10; 10.4.0 before 10.4.4; 10.5.0 before 10.5.2 |
| CVE-2024-42406 | 5.4 | Sep 26 | Unauthorized access on archived channels Affected: 9.5.0 before 9.5.9; 9.9.0 before 9.9.3; 9.10.0 before 9.10.2; 9.11.0; 9.11.0; 9.11.0; +1 more |
| CVE-2024-45843 | 5.4 | Sep 26 | Weak SSRF Filtering Affected: 9.5.0 before 9.5.9 |
| CVE-2024-39837 | 5.4 | Aug 1 | Malicious remote can create arbitrary channels Affected: 9.5.0 before 9.5.7; 9.9.0 |
| CVE-2023-6547 | 5.4 | Dec 12 | Mattermost fails to validate team membership when a user attempts to access a playbook, allowing a user with permissions to a playbook but no permissions to the team the playbook… Affected: through 8.1.5; 9.2.0 through 9.2.1 |
| CVE-2023-3586 | 5.4 | Jul 17 | Mattermost fails to disable public Boards after the "Enable Publicly-Shared Boards" configuration option is disabled, resulting in previously-shared public Boards to remain… Affected: 7.8.0 before 7.8.7; 7.9.0 before 7.9.5; 7.10.0 before 7.10.3 |
| CVE-2023-1776 | 5.4 | Mar 31 | Boards in Mattermost allows an attacker to upload a malicious SVG image file as an attachment to a card and share it using a direct link to the file Affected: before 7.1.6; 7.7.1 |
| CVE-2023-1774 | 5.4 | Mar 31 | When processing an email invite to a private channel on a team, Mattermost fails to validate the inviter's permission to that channel, allowing an attacker to invite themselves to… Affected: before 7.1.6; 7.7.1 |
| CVE-2021-37862 | 5.4 | Dec 17 | Mattermost 6.0 and earlier fails to sufficiently validate the email address during registration, which allows attackers to trick users into signing up using attacker-controlled… Affected: through 6.0 |
| CVE-2016-11070 | 5.4 | Jun 19 | An issue was discovered in Mattermost Server before 3.1.0 Affected: before 3.1.0 |
| CVE-2019-20876 | 5.4 | Jun 19 | An issue was discovered in Mattermost Server before 5.9.0, 5.8.1, 5.7.3, and 4.10.8 Affected: before 4.10.8; 5.7.0 before 5.7.3; 5.8.0 before 5.8.1; 5.9.0; 5.9.0; 5.9.0; +1 more |
| CVE-2026-10556 | 5.3 | Sep 14 | Unauthenticated webhook request with null notification entry could crash the Microsoft Calendar plugin. Affected: 10.11.0 before 10.11.23; 11.7.0 before 11.7.8; 11.8.0 before 11.8.5; 11.9.0 before 11.9.1 |
| CVE-2026-6046 | 5.3 | Jun 12 | Plugin bot username conflict allows user account to be used as bot identity in Mattermost Server Affected: 10.11.0 before 10.11.17; 11.5.0 before 11.5.5; 11.6.0 before 11.6.2 |
| CVE-2026-4635 | 5.3 | May 22 | Persistent notification timing attack causing server denial of service Affected: 10.11.0 before 10.11.15; 11.4.0 before 11.4.5; 11.5.0 before 11.5.4; 11.6.0 before 11.6.1 |
| CVE-2025-55073 | 5.3 | Nov 14 | MS Teams plugin OAuth allows editing arbitrary posts Affected: 10.5.0 before 10.5.12; 10.11.0 before 10.11.4; 10.12.0 before 10.12.1 |
| CVE-2025-31947 | 5.3 | May 15 | Repeated LDAP login failures can lock an LDAP account Affected: 9.11.0 before 9.11.12; 10.4.0 before 10.4.5; 10.5.0 before 10.5.3; 10.6.0 before 10.6.2 |
| CVE-2025-0503 | 5.3 | Feb 14 | Leaked User IDs and Metadata of Deleted DMs Affected: 9.11.0 before 9.11.7 |
| CVE-2025-22445 | 5.3 | Jan 9 | Misleading UI for undefined admin console settings in Calls causes security confusion Affected: 10.0.0 before 10.3.0 |
| CVE-2024-11599 | 5.3 | Nov 28 | Domain Restriction Bypass on Registration Affected: 9.5.0 before 9.5.12; 9.11.0 before 9.11.4; 10.0.0 before 10.0.2; 10.1.0 before 10.1.2 |
| CVE-2023-46701 | 5.3 | Dec 12 | Mattermost fails to perform authorization checks in the /plugins/playbooks/api/v0/runs/add-to-timeline-dialog endpoint of the Playbooks plugin allowing an attacker to get limited… Affected: through 7.8.14; 8.0.0 through 8.1.5; 9.0.0 through 9.0.3; 9.1.1 through 9.1.2; 9.2.0 through 9.2.1 |
| CVE-2023-6459 | 5.3 | Dec 6 | Mattermost is grouping calls in the /metrics endpoint by id and reports that id in the response Affected: before 7.8.14; 8.0.0 before 8.1.5 |
| CVE-2023-5331 | 5.3 | Oct 9 | Mattermost fails to properly check the creator of an attached file when adding the file to a draft post, potentially exposing unauthorized file information Affected: before 7.8.11; 8.0.0 before 8.0.3; 8.1.0 before 8.1.2 |
| CVE-2023-1777 | 5.3 | Mar 31 | Mattermost allows an attacker to request a preview of an existing message when creating a new message via the createPost API call, disclosing the contents of the linked message Affected: before 7.1.6; 7.7.1; 7.8.0 |
| CVE-2022-2366 | 5.3 | Jul 12 | Incorrect default configuration for trusted IP header in Mattermost version 6.7.0 and earlier allows attacker to bypass some of the rate limitations in place or use manipulated… Affected: before 6.3.9; 6.4.0 before 6.5.2; 6.6.0 before 6.6.2; 6.7.0 |
| CVE-2017-18919 | 5.3 | Jun 19 | An issue was discovered in Mattermost Server before 3.7.0 and 3.6.3 Affected: before 3.6.3 |
| CVE-2017-18916 | 5.3 | Jun 19 | An issue was discovered in Mattermost Server before 3.8.2, 3.7.5, and 3.6.7 Affected: before 3.6.7; 3.7.0 before 3.7.5; 3.8.0 before 3.8.2 |
| CVE-2017-18914 | 5.3 | Jun 19 | An issue was discovered in Mattermost Server before 3.8.2, 3.7.5, and 3.6.7 Affected: before 3.6.7; 3.7.0 before 3.7.5; 3.8.0 before 3.8.2 |