MS
Product
Mattermost Server
489
CVEs
0
On KEV
9.9
Max CVSS
3
New 30D
Severity mix
Critical 17High 85Medium 345Low 42
Watch
Add Mattermost Server to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2017-18916 | 5.3 | Jun 19 | An issue was discovered in Mattermost Server before 3.8.2, 3.7.5, and 3.6.7 Affected: before 3.6.7; 3.7.0 before 3.7.5; 3.8.0 before 3.8.2 |
| CVE-2017-18914 | 5.3 | Jun 19 | An issue was discovered in Mattermost Server before 3.8.2, 3.7.5, and 3.6.7 Affected: before 3.6.7; 3.7.0 before 3.7.5; 3.8.0 before 3.8.2 |
| CVE-2017-18905 | 5.3 | Jun 19 | An issue was discovered in Mattermost Server before 4.0.0, 3.10.2, and 3.9.2, when used as an OAuth 2.0 service provider, Session invalidation was mishandled Affected: before 3.9.2; 3.10.0 before 3.10.2 |
| CVE-2016-11076 | 5.3 | Jun 19 | An issue was discovered in Mattermost Server before 3.0.0 Affected: before 3.0.0 |
| CVE-2016-11075 | 5.3 | Jun 19 | An issue was discovered in Mattermost Server before 3.0.0 Affected: before 3.0.0 |
| CVE-2016-11068 | 5.3 | Jun 19 | An issue was discovered in Mattermost Server before 3.2.0 Affected: before 3.2.0 |
| CVE-2016-11067 | 5.3 | Jun 19 | An issue was discovered in Mattermost Server before 3.2.0 Affected: before 3.2.0 |
| CVE-2016-11062 | 5.3 | Jun 19 | An issue was discovered in Mattermost Server before 3.5.1 Affected: before 3.5.1 |
| CVE-2017-18902 | 5.3 | Jun 19 | An issue was discovered in Mattermost Server before 4.1.0, 4.0.4, and 3.10.3 Affected: before 3.10.3; 4.0.0 before 4.0.4 |
| CVE-2017-18901 | 5.3 | Jun 19 | An issue was discovered in Mattermost Server before 4.1.0, 4.0.4, and 3.10.3 Affected: before 3.10.3; 4.0.0 before 4.0.4 |
| CVE-2017-18899 | 5.3 | Jun 19 | An issue was discovered in Mattermost Server before 4.2.0, 4.1.1, and 4.0.5 Affected: before 4.0.5; 4.1.0 before 4.1.1; 4.2.0; 4.2.0; 4.2.0; 4.2.0 |
| CVE-2017-18898 | 5.3 | Jun 19 | An issue was discovered in Mattermost Server before 4.2.0, 4.1.1, and 4.0.5 Affected: before 4.0.5; 4.1.0 before 4.1.1; 4.2.0; 4.2.0; 4.2.0; 4.2.0 |
| CVE-2017-18896 | 5.3 | Jun 19 | An issue was discovered in Mattermost Server before 4.2.0, 4.1.1, and 4.0.5 Affected: before 4.0.5; 4.1.0 before 4.1.1; 4.2.0; 4.2.0; 4.2.0; 4.2.0 |
| CVE-2017-18895 | 5.3 | Jun 19 | An issue was discovered in Mattermost Server before 4.2.0, 4.1.1, and 4.0.5 Affected: before 4.0.5; 4.1.0 before 4.1.1; 4.2.0; 4.2.0; 4.2.0; 4.2.0 |
| CVE-2017-18887 | 5.3 | Jun 19 | An issue was discovered in Mattermost Server before 4.3.0, 4.2.1, and 4.1.2 Affected: before 4.1.2; 4.2.0 before 4.2.1; 4.3.0; 4.3.0; 4.3.0; 4.3.0 |
| CVE-2017-18873 | 5.3 | Jun 19 | An issue was discovered in Mattermost Server before 4.3.0, 4.2.1, and 4.1.2 Affected: before 4.1.2; 4.2.0 before 4.2.1; 4.3.0; 4.3.0; 4.3.0; 4.3.0 |
| CVE-2019-20889 | 5.3 | Jun 19 | An issue was discovered in Mattermost Server before 5.7, 5.6.3, 5.5.2, and 4.10.5 Affected: 4.10.0 before 4.10.5; 5.5.0 before 5.5.2; 5.6.0 before 5.6.3; 5.7.0; 5.7.0; 5.7.0; +3 more |
| CVE-2019-20884 | 5.3 | Jun 19 | An issue was discovered in Mattermost Server before 5.8.0 Affected: before 5.8.0 |
| CVE-2019-20882 | 5.3 | Jun 19 | An issue was discovered in Mattermost Server before 5.8.0 Affected: before 5.8.0 |
| CVE-2019-20877 | 5.3 | Jun 19 | An issue was discovered in Mattermost Server before 5.9.0, 5.8.1, 5.7.3, and 4.10.8 Affected: before 4.10.8; 5.7.0 before 5.7.3; 5.8.0 before 5.8.1; 5.9.0; 5.9.0; 5.9.0; +1 more |
| CVE-2019-20875 | 5.3 | Jun 19 | An issue was discovered in Mattermost Server before 5.9.0, 5.8.1, 5.7.3, and 4.10.8 Affected: before 4.10.8; 5.7.0 before 5.7.3; 5.8.0 before 5.8.1; 5.9.0; 5.9.0; 5.9.0; +1 more |
| CVE-2018-21259 | 5.3 | Jun 19 | An issue was discovered in Mattermost Server before 4.10.1, 4.9.4, and 4.8.2 Affected: before 4.8.2; 4.9.0 before 4.9.4; 4.10.0 before 4.10.1 |
| CVE-2018-21257 | 5.3 | Jun 19 | An issue was discovered in Mattermost Server before 5.1 Affected: before 5.1.0 |
| CVE-2019-20869 | 5.3 | Jun 19 | An issue was discovered in Mattermost Server before 5.10.0, 5.9.1, 5.8.2, and 4.10.9 Affected: before 4.10.9; 5.7.0 before 5.7.3; 5.8.0 before 5.8.2; 5.9.0 before 5.9.1; 5.10.0; 5.10.0; +4 more |
| CVE-2019-20867 | 5.3 | Jun 19 | An issue was discovered in Mattermost Server before 5.11.0 Affected: before 5.11.0 |
| CVE-2019-20866 | 5.3 | Jun 19 | An issue was discovered in Mattermost Server before 5.12.0 Affected: before 5.12.0 |
| CVE-2020-14457 | 5.3 | Jun 19 | An issue was discovered in Mattermost Server before 5.20.0 Affected: before 5.20.0 |
| CVE-2020-14452 | 5.3 | Jun 19 | An issue was discovered in Mattermost Server before 5.21.0 Affected: before 5.21.0 |
| CVE-2019-20847 | 5.3 | Jun 19 | An issue was discovered in Mattermost Server before 5.18.0 Affected: before 5.18.0 |
| CVE-2026-6333 | 5.0 | May 18 | SSRF via Host Header Spoofing in Custom Slash Commands Affected: 10.11.0 before 10.11.14; 11.5.0 before 11.5.2 |
| CVE-2026-19076 | 4.9 | Oct 16 | Mattermost fails to reject OAuth application sessions in account type switch, allowing account takeover via bearer token Affected: 11.7.0 before 11.7.10; 11.8.0 before 11.8.6; 11.9.0 before 11.9.2; 11.10.0 |
| CVE-2026-19600 | 4.9 | Oct 16 | Mattermost logs plaintext authentication tokens in debug-level server logs on failed auth attempts Affected: 11.7.0 before 11.7.10; 11.8.0 before 11.8.6; 11.9.0 before 11.9.2; 11.10.0 before 11.10.2 |
| CVE-2026-9708 | 4.9 | Jul 13 | Incoming webhook user attribution via unvalidated webhook owner Affected: 10.11.0 before 10.11.20; 11.6.0 before 11.6.5; 11.7.0 before 11.7.3 |
| CVE-2026-3112 | 4.9 | Mar 26 | Arbitrary File Read via Advanced Logging Support Packet Affected: 10.11.0 before 10.11.12; 11.2.0 before 11.2.4; 11.3.0 before 11.3.2; 11.4.0 |
| CVE-2026-3116 | 4.9 | Mar 26 | Improper Input Validation in Zoom Plugin Webhook Handler Affected: 10.11.0 before 10.11.12; 11.2.0 before 11.2.4; 11.3.0 before 11.3.2; 11.4.0 before 11.4.1 |
| CVE-2025-11794 | 4.9 | Nov 14 | Password hash and MFA secret returned in user email verification endpoint Affected: 10.5.0 before 10.5.12; 10.11.0 before 10.11.4; 10.12.0 before 10.12.1 |
| CVE-2025-8402 | 4.9 | Aug 21 | Nil pointer dereference in bulk import crashes server Affected: 9.11.0 before 9.11.18; 10.5.0 before 10.5.9; 10.8.0 before 10.8.4; 10.9.0 before 10.9.4; 10.10.0 |
| CVE-2025-8023 | 4.9 | Aug 21 | Path Traversal in Template Upload Allows Uploading Files Outside Target Directory Affected: 9.11.0 before 9.11.18; 10.5.0 before 10.5.9; 10.8.0 before 10.8.4; 10.9.0 before 10.9.3 |
| CVE-2025-36530 | 4.9 | Aug 21 | Import Path Traversal Enables Unauthorized Unsigned Plugin Installation Affected: 9.11.0 before 9.11.18; 10.5.0 before 10.5.9; 10.8.0 before 10.8.4; 10.9.0 before 10.9.2 |
| CVE-2025-6233 | 4.9 | Jul 18 | Arbitrary file read by system admin via path traversal Affected: 9.11.0 before 9.11.17; 10.5.0 before 10.5.8; 10.7.0 before 10.7.4; 10.8.0 before 10.8.2 |
| CVE-2025-32093 | 4.9 | Apr 14 | Syatem admin profile modification by delegated granular administration role Affected: 9.11.0 before 9.11.10; 10.4.0 before 10.4.4; 10.5.0 before 10.5.2 |
| CVE-2024-54682 | 4.9 | Dec 16 | Zipbomb DoS via Missing Slack Import Validation Affected: 9.5.0 before 9.5.13; 9.11.0 before 9.11.5; 10.0.0 before 10.0.3; 10.1.0 before 10.1.3 |
| CVE-2024-42497 | 4.9 | Aug 22 | Insufficient permissions checks on teams Affected: 9.5.0 before 9.5.8; 9.8.0 before 9.8.3; 9.9.0 before 9.9.2; 9.10.0 |
| CVE-2017-18918 | 4.9 | Jun 19 | An issue was discovered in Mattermost Server before 3.7.3 and 3.6.5 Affected: 3.6.0 before 3.6.5; 3.7.0 before 3.7.3 |
| CVE-2017-18876 | 4.9 | Jun 19 | An issue was discovered in Mattermost Server before 4.3.0, 4.2.1, and 4.1.2 when local storage for files is used Affected: before 4.1.2; 4.2.0 before 4.2.1; 4.3.0; 4.3.0; 4.3.0; 4.3.0 |
| CVE-2017-18875 | 4.9 | Jun 19 | An issue was discovered in Mattermost Server before 4.3.0, 4.2.1, and 4.1.2 when local storage for files is used Affected: before 4.1.2; 4.2.0 before 4.2.1; 4.3.0; 4.3.0; 4.3.0; 4.3.0 |
| CVE-2026-3495 | 4.8 | May 18 | Unescaped variables during error page composition Affected: 10.11.0 before 10.11.14; 11.5.0 before 11.5.2 |
| CVE-2024-48872 | 4.8 | Dec 16 | Bypass of "Max failed attempts" restriction via race condition Affected: 9.5.0 before 9.5.13; 9.11.0 before 9.11.5; 10.0.0 before 10.0.3; 10.1.0 before 10.1.3 |
| CVE-2024-36250 | 4.8 | Nov 9 | MFA Code Replay Affected: 9.5.0 before 9.5.11; 9.11.0 before 9.11.3 |
| CVE-2026-27659 | 4.6 | Mar 25 | CSRF vulnerability in UpdateAccessControlPolicyActiveStatus endpoint Affected: 10.11.0 before 10.11.11; 11.2.0 before 11.2.3; 11.3.0 before 11.3.2; 11.4.0 before 11.4.1 |