MS
Product
Mattermost Server
489
CVEs
0
On KEV
9.9
Max CVSS
3
New 30D
Severity mix
Critical 17High 85Medium 345Low 42
Watch
Add Mattermost Server to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2026-0999 | 4.3 | Feb 16 | Authentication bypass via userID login when email and username login are disabled Affected: 10.11.0 before 10.11.10; 11.1.0 before 11.1.3; 11.2.0 before 11.2.2 |
| CVE-2026-22892 | 4.3 | Feb 13 | Insufficient Authorization in Mattermost Jira Plugin Allows Unauthorized Access to Post Attachments Affected: 10.11.0 before 10.11.10; 11.0.0 before 11.1.3; 11.2.0 before 11.2.2 |
| CVE-2025-13767 | 4.3 | Dec 24 | Unauthorized Read Access to Private Channel Posts via Mattermost Jira Plugin Affected: 10.11.0 before 10.11.8; 10.12.0 before 10.12.4; 11.0.0 before 11.0.6; 11.1.0 before 11.1.1 |
| CVE-2025-62190 | 4.3 | Dec 17 | CSRF Allows Call Initiation and Message Delivery Affected: 10.11.0 before 10.11.7; 10.12.0 before 10.12.3; 11.0.0 before 11.0.5 |
| CVE-2025-13870 | 4.3 | Dec 2 | Unauthorized access and subscription vulnerability in Boards Affected: 10.5.0 before 10.5.13; 10.11.0 before 10.11.5 |
| CVE-2025-12756 | 4.3 | Dec 1 | Insecure Direct Object Reference in Mattermost Boards Plugin Enables Unauthorised Comment Deletion Affected: 10.5.0 before 10.5.13; 10.11.0 before 10.11.5; 10.12.0 before 10.12.2; 11.0.0 before 11.0.3 |
| CVE-2025-12559 | 4.3 | Nov 27 | Information Disclosure in Common Teams API Affected: 10.5.0 before 10.5.13; 10.11.0 before 10.11.5; 10.12.0 before 10.12.2; 11.0.0 before 11.0.3 |
| CVE-2025-41436 | 4.3 | Nov 14 | Unauthorized access to archived channel content via threads interface Affected: before 11.0.0 |
| CVE-2025-11776 | 4.3 | Nov 14 | Guest user can discover archived public channels Affected: before 11.0.0 |
| CVE-2025-11777 | 4.3 | Nov 13 | Cross-team channel membership access Affected: 10.5.0 before 10.5.12; 10.11.0 before 10.11.4 |
| CVE-2025-10545 | 4.3 | Oct 16 | Guest user can add unauthorized team users to private channels Affected: 10.5.0 before 10.5.11; 10.11.0 before 10.11.3 |
| CVE-2025-41443 | 4.3 | Oct 16 | Guest user can discover active public channels Affected: 10.5.0 before 10.5.11; 10.11.0 before 10.11.3 |
| CVE-2025-9078 | 4.3 | Sep 15 | Weak cache keys lead to post IDOR and link preview poisoning Affected: 9.11.0 before 9.11.18; 10.5.0 before 10.5.9; 10.8.0 before 10.8.4; 10.9.0 before 10.9.4; 10.10.0 before 10.10.2 |
| CVE-2025-6465 | 4.3 | Aug 21 | Path traversal in image upload with preview overwrite Affected: 10.5.0 before 10.5.9; 10.8.0 before 10.8.4; 10.9.0 before 10.9.4; 10.10.0 |
| CVE-2025-47870 | 4.3 | Aug 21 | Team invite ID leaked to team admin with no member invite privileges Affected: 9.11.0 before 9.11.18; 10.5.0 before 10.5.9; 10.8.0 before 10.8.4; 10.9.0 before 10.9.3 |
| CVE-2025-49810 | 4.3 | Aug 21 | Thread summarization allows persistent access to channel Affected: 10.5.0 before 10.5.9 |
| CVE-2025-3228 | 4.3 | Jun 20 | Unauthorized Guest user access to Playbook Affected: 9.11.0 before 9.11.16; 10.5.0 before 10.5.6; 10.6.0 before 10.6.6; 10.7.0 before 10.7.3; 10.8.0; 10.8.0; +2 more |
| CVE-2025-3227 | 4.3 | Jun 20 | Unauthorized channel member management through playbook runs Affected: 9.11.0 before 9.11.16; 10.5.0 before 10.5.6; 10.6.0 before 10.6.6; 10.7.0 before 10.7.3; 10.8.0; 10.8.0; +2 more |
| CVE-2025-4128 | 4.3 | Jun 11 | Mattermost Guest User Information Disclosure Vulnerability Affected: 9.11.0 before 9.11.14; 10.5.0 before 10.5.5 |
| CVE-2025-3611 | 4.3 | May 30 | Improper Access Control in Mattermost allows System Managers to view team details despite role restrictions Affected: 9.11.0 before 9.11.13; 10.5.0 before 10.5.4; 10.7.0; 10.7.0; 10.7.0 |
| CVE-2025-2527 | 4.3 | May 15 | Improper access control to group information Affected: 9.11.0 before 9.11.12; 10.5.0 before 10.5.3 |
| CVE-2025-3446 | 4.3 | May 15 | Members Without Guest Invite Permissions Can Add Guests to Teams Affected: 9.11.0 before 9.11.12; 10.4.0 before 10.4.5; 10.5.0 before 10.5.3; 10.6.0 before 10.6.2 |
| CVE-2025-41423 | 4.3 | Apr 24 | Unauthorized Playbooks Post Deletion in Mattermost Playbooks Plugin Affected: 9.11.0 before 9.11.11; 10.4.0 before 10.4.3; 10.5.0 |
| CVE-2025-2564 | 4.3 | Apr 16 | Unauthorized View Access to Archived Channel Member Info Affected: 9.11.0 before 9.11.10; 10.4.0 before 10.4.4; 10.5.0 before 10.5.2 |
| CVE-2025-27571 | 4.3 | Apr 16 | Channel metadata visible in archived channels despite configuration setting Affected: 9.11.0 before 9.11.10; 10.4.0 before 10.4.4; 10.5.0 before 10.5.2 |
| CVE-2025-24839 | 4.3 | Apr 16 | Unauthorized AI bot activation via Wrangler plugin Affected: 9.11.0 before 9.11.10; 10.4.0 before 10.4.4; 10.5.0 before 10.5.2 |
| CVE-2025-2424 | 4.3 | Apr 14 | Leaked Metadata of Deleted Files via Bookmark Creation Affected: 9.11.0 before 9.11.10; 10.5.0 before 10.5.2 |
| CVE-2025-27933 | 4.3 | Mar 21 | Mattermost versions 10.4.x <= 10.4.2, 10.3.x <= 10.3.3, 9.11.x <= 9.11.8 fail to fail to enforce channel conversion restrictions, which allows members with permission to convert… Affected: 9.11.0 before 9.11.9; 10.3.0 before 10.3.4; 10.4.0 before 10.4.3 |
| CVE-2025-24920 | 4.3 | Mar 21 | Mattermost versions 10.4.x <= 10.4.2, 10.3.x <= 10.3.3, 9.11.x <= 9.11.8, 10.5.x <= 10.5.0 fail to restrict bookmark creation and updates in archived channels, which allows… Affected: 9.11.0 before 9.11.9; 10.3.0 before 10.3.4; 10.4.0 before 10.4.3; 10.5.0 before 10.5.1 |
| CVE-2025-1472 | 4.3 | Mar 19 | Mattermost versions 9.11.x <= 9.11.8 fail to properly perform authorization of the Viewer role which allows an attacker with the Viewer role configured with No Access to Reporting… Affected: 9.11.0 before 9.11.9 |
| CVE-2025-24526 | 4.3 | Feb 24 | Mattermost versions 10.1.x <= 10.1.3, 10.4.x <= 10.4.1, 9.11.x <= 9.11.7, 10.3.x <= 10.3.2, 10.2.x <= 10.2.2 fail to restrict channel export of archived channels when the "Allow… Affected: 9.11.0 before 9.11.8; 10.1.0 before 10.1.4; 10.2.0 before 10.2.3; 10.3.0 before 10.3.3; 10.4.0 before 10.4.2 |
| CVE-2024-12247 | 4.3 | Dec 5 | Mattermost versions 9.7.x <= 9.7.5, 9.8.x <= 9.8.2 and 9.9.x <= 9.9.2 fail to properly propagate permission scheme updates across cluster nodes which allows a user to keep old… Affected: 9.7.0 before 9.7.6; 9.8.0 before 9.8.3; 9.9.0 before 9.9.3 |
| CVE-2024-52032 | 4.3 | Nov 9 | Mattermost versions 10.0.x <= 10.0.0 and 9.11.x <= 9.11.2 fail to properly query ElasticSearch when searching for the channel name in channel switcher which allows an attacker to… Affected: 9.11.0 before 9.11.3; 10.0.0; 10.0.0; 10.0.0; 10.0.0; 10.0.0 |
| CVE-2024-42000 | 4.3 | Nov 9 | Mattermost versions 9.10.x <= 9.10.2, 9.11.x <= 9.11.1, 9.5.x <= 9.5.9 and 10.0.x <= 10.0.0 fail to properly authorize the requests to /api/v4/channels which allows a User or… Affected: 9.5.0 before 9.5.10; 9.10.0 before 9.10.3; 9.11.0 before 9.11.2; 10.0.0; 10.0.0; 10.0.0; +2 more |
| CVE-2024-50052 | 4.3 | Oct 29 | Mattermost versions 9.10.x <= 9.10.2, 9.11.x <= 9.11.1, 9.5.x <= 9.5.9 fail to check that the origin of the message in an integration action matches with the original post… Affected: 9.5.0 before 9.5.10; 9.10.0 before 9.10.3; 9.11.0 before 9.11.2 |
| CVE-2024-10241 | 4.3 | Oct 29 | Mattermost versions 9.5.x <= 9.5.9 fail to properly filter the channel data when ElasticSearch is enabled which allows a user to get private channel names by using cmd+K/ctrl+K Affected: 9.5.0 before 9.5.10 |
| CVE-2024-9155 | 4.3 | Sep 26 | Mattermost versions 9.10.x <= 9.10.1, 9.9.x <= 9.9.2, 9.5.x <= 9.5.8 fail to limit access to channels files that have not been linked to a post which allows an attacker to view… Affected: 9.5.0 before 9.5.9; 9.9.0 before 9.9.3; 9.10.0 before 9.10.2 |
| CVE-2024-47145 | 4.3 | Sep 26 | Mattermost versions 9.5.x <= 9.5.8 fail to properly authorize access to archived channels when viewing archived channels is disabled, which allows an attacker to view posts and… Affected: 9.5.0 before 9.5.9 |
| CVE-2024-43780 | 4.3 | Aug 22 | Mattermost versions 9.9.x <= 9.9.1, 9.5.x <= 9.5.7, 9.10.0, 9.8.x <= 9.8.2 fail to enforce permissions which allows a guest user with read access to upload files to a channel Affected: 9.5.0 before 9.5.8; 9.8.0 before 9.8.3; 9.9.0 before 9.9.2; 9.10.0 |
| CVE-2024-41926 | 4.3 | Aug 1 | Mattermost versions 9.9.x <= 9.9.0 and 9.5.x <= 9.5.6 fail to validate the source of sync messages and only allow the correct remote IDs, which allows a malicious remote to set… Affected: 9.5.0 before 9.5.7; 9.9.0 |
| CVE-2024-41162 | 4.3 | Aug 1 | Mattermost versions 9.9.x <= 9.9.0, 9.5.x <= 9.5.6, 9.7.x <= 9.7.5 and 9.8.x <= 9.8.1 fail to disallow the modification of local channels by a remote, when shared channels are… Affected: 9.5.0 before 9.5.7; 9.7.0 before 9.7.6; 9.8.0 before 9.8.2; 9.9.0 |
| CVE-2024-39839 | 4.3 | Aug 1 | Mattermost versions 9.9.x <= 9.9.0, 9.5.x <= 9.5.6, 9.7.x <= 9.7.5, 9.8.x <= 9.8.1 fail to disallow users to set their own remote username, when shared channels were enabled,… Affected: 9.5.0 before 9.5.7; 9.7.0 before 9.7.6; 9.8.0 before 9.8.2; 9.9.0 |
| CVE-2024-5272 | 4.3 | May 26 | Mattermost versions 9.5.x <= 9.5.3, 9.6.x <= 9.6.1, 8.1.x <= 8.1.12 fail to restrict the audience of the "custom_playbooks_playbook_run_updated" webhook event, which allows a… Affected: 8.1.0 before 8.1.13; 9.5.0 before 9.5.4; 9.6.0 before 9.6.2 |
| CVE-2024-5270 | 4.3 | May 26 | Mattermost versions 9.5.x <= 9.5.3, 9.7.x <= 9.7.1, 9.6.x <= 9.6.1 and 8.1.x <= 8.1.12 fail to check if the email signup configuration option is enabled when a user requests to… Affected: 8.1.0 before 8.1.13; 9.5.0 before 9.5.4; 9.6.0 before 9.6.2; 9.7.0 before 9.7.2 |
| CVE-2024-36241 | 4.3 | May 26 | Mattermost versions 9.5.x <= 9.5.3, 9.6.x <= 9.6.1 and 8.1.x <= 8.1.12 fail to enforce proper access controls which allows user to view arbitrary post contents via the /playbook… Affected: 8.1.0 before 8.1.13; 9.5.0 before 9.5.4; 9.6.0 before 9.6.2 |
| CVE-2024-34152 | 4.3 | May 26 | Mattermost versions 9.5.x <= 9.5.3, 9.6.x <= 9.6.1 and 8.1.x <= 8.1.12 fail to perform proper access control which allows a guest to get the metadata of a public playbook run that… Affected: 8.1.0 before 8.1.13; 9.5.0 before 9.5.4; 9.6.0 before 9.6.2 |
| CVE-2024-34029 | 4.3 | May 26 | Mattermost versions 9.5.x <= 9.5.3, 9.7.x <= 9.7.1 and 8.1.x <= 8.1.12 fail to perform a proper authorization check in the /api/v4/groups/<group-id>/channels/<channel-id>/link… Affected: 8.1.0 before 8.1.13; 9.5.0 before 9.5.4; 9.7.0 before 9.7.2 |
| CVE-2024-29215 | 4.3 | May 26 | Mattermost versions 9.5.x <= 9.5.3, 9.7.x <= 9.7.1, 9.6.x <= 9.6.1, 8.1.x <= 8.1.12 fail to enforce proper access control which allows a user to run a slash command in a channel… Affected: 8.1.0 before 8.1.13; 9.5.0 before 9.5.4; 9.6.0 before 9.6.2; 9.7.0 before 9.7.2 |
| CVE-2024-4182 | 4.3 | Apr 26 | Mattermost versions 9.6.0, 9.5.x before 9.5.3, 9.4.x before 9.4.5, and 8.1.x before 8.1.12 fail to handle JSON parsing errors in custom status values, which allows an… Affected: 8.1.0 before 8.1.12; 9.4.0 before 9.4.5; 9.5.0 before 9.5.3; 9.6.0 before 9.6.1 |
| CVE-2024-32046 | 4.3 | Apr 26 | Mattermost versions 9.6.x <= 9.6.0, 9.5.x <= 9.5.2, 9.4.x <= 9.4.4 and 8.1.x <= 8.1.11 fail to remove detailed error messages in API requests even if the developer mode is off… Affected: 8.1.0 before 8.1.12; 9.4.0 before 9.4.5; 9.5.0 before 9.5.3; 9.6.0 before 9.6.1 |