MS
Product
Mattermost Server
489
CVEs
0
On KEV
9.9
Max CVSS
3
New 30D
Severity mix
Critical 17High 85Medium 345Low 42
Watch
Add Mattermost Server to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2024-46872 | 4.6 | Oct 29 | Client-Side Path Traversal Leading to CSRF in Playbooks Affected: 9.5.0 through 9.5.9; 9.10.0 through 9.10.2; 9.11.0 through 9.11.1 |
| CVE-2022-1385 | 4.6 | Apr 19 | Mattermost 6.4.x and earlier fails to properly invalidate pending email invitations when the action is performed from the system console, which allows accidentally invited users… Affected: before 6.5.0 |
| CVE-2026-95666 | 4.3 | Sep 22 | Unbounded post ID array in the bulk reactions endpoint allows denial of service Affected: 11.7.0 before 11.7.11; 11.8.0 before 11.8.6; 11.9.0 before 11.9.2; 11.10.0 before 11.10.2 |
| CVE-2026-86348 | 4.3 | Sep 14 | MS Calendar plugin: unrecovered handler panics from malformed post-action requests could crash the plugin process Affected: 10.11.0 before 10.11.23; 11.7.0 before 11.7.8; 11.8.0 before 11.8.5; 11.9.0 before 11.9.1 |
| CVE-2026-86349 | 4.3 | Sep 14 | Mattermost Server Algorithmic DoS via Unbounded Markdown Block Nesting Affected: 10.11.0 before 10.11.23; 11.7.0 before 11.7.9; 11.8.0 before 11.8.5; 11.9.0 before 11.9.1 |
| CVE-2026-13417 | 4.3 | Sep 14 | Boards plugin denial of service via unvalidated block fields.properties Affected: 10.11.0 before 10.11.23; 11.7.0 before 11.7.8; 11.8.0 before 11.8.5; 11.9.0 before 11.9.1 |
| CVE-2026-10542 | 4.3 | Sep 14 | Playbooks channel action update validation issue Affected: 10.11.0 before 10.11.23; 11.7.0 before 11.7.8; 11.8.0 before 11.8.5; 11.9.0 before 11.9.1 |
| CVE-2026-14344 | 4.3 | Sep 14 | Inconsistent authorization checks in Mattermost Boards endpoints Affected: 10.11.0 before 10.11.23; 11.7.0 before 11.7.8; 11.8.0 before 11.8.5; 11.9.0 before 11.9.1 |
| CVE-2026-12882 | 4.3 | Sep 14 | Mattermost Markdown autolink parsing denial of service Affected: 10.11.0 before 10.11.23; 11.7.0 before 11.7.8; 11.8.0 before 11.8.5; 11.9.0 before 11.9.1 |
| CVE-2026-11993 | 4.3 | Sep 14 | Fix authenticated members disabling file content indexing server-wide via extraction pool exhaustion Affected: 10.11.0 before 10.11.23; 11.7.0 before 11.7.8; 11.8.0 before 11.8.5; 11.9.0 before 11.9.1 |
| CVE-2026-14259 | 4.3 | Sep 14 | Board archive import bypasses team board creation permissions Affected: 10.11.0 before 10.11.23; 11.7.0 before 11.7.8; 11.8.0 before 11.8.5; 11.9.0 before 11.9.1 |
| CVE-2026-16045 | 4.3 | Aug 17 | Delegated OAuth tokens could revoke unrelated OAuth application authorizations Affected: 10.11.0 before 10.11.22; 11.7.0 before 11.7.7 |
| CVE-2026-16047 | 4.3 | Aug 17 | Board channel linking without read channel permission validation Affected: 10.11.0 before 10.11.22; 11.7.0 before 11.7.7; 11.8.0 before 11.8.4 |
| CVE-2026-16046 | 4.3 | Aug 17 | Missing run-state validation on finished playbook runs Affected: 10.11.0 before 10.11.22; 11.7.0 before 11.7.7 |
| CVE-2026-10600 | 4.3 | Jul 27 | Denial of service via unbounded document content extraction in Mattermost Server Affected: 10.11.0 before 10.11.21; 11.6.0 before 11.6.6; 11.7.0 before 11.7.4; 11.8.0 before 11.8.1 |
| CVE-2026-6541 | 4.3 | Jul 13 | Unscoped updates to other playbooks' metric configuration Affected: 10.11.0 before 10.11.20; 11.6.0 before 11.6.5; 11.7.0 before 11.7.2 |
| CVE-2026-9824 | 4.3 | Jul 13 | Remote cluster metadata enumeration via /share-channel autocomplete Affected: 10.11.0 before 10.11.20; 11.6.0 before 11.6.5; 11.7.0 before 11.7.3 |
| CVE-2026-10103 | 4.3 | Jul 13 | Authenticated remote cluster can modify or delete posts it does not own in Mattermost Connected Workspaces shared channels Affected: 10.11.0 before 10.11.20; 11.6.0 before 11.6.5; 11.7.0 before 11.7.3 |
| CVE-2026-9162 | 4.3 | Jun 22 | Global session revocation does not invalidate active WebSocket connections Affected: 10.11.0 before 10.11.18; 11.5.0 before 11.5.6; 11.6.0 before 11.6.3; 11.7.0 before 11.7.1 |
| CVE-2026-6689 | 4.3 | Jun 12 | *Missing* {{invite_user}} *permission check on team creation allows unprivileged users to set open-invite and allowed-domains team settings* Affected: 10.11.0 before 10.11.17; 11.5.0 before 11.5.5; 11.6.0 before 11.6.2 |
| CVE-2026-3433 | 4.3 | Jun 12 | Mattermost fails to scope role_updated websocket events to authorized team and channel members Affected: 10.11.0 before 10.11.17; 11.5.0 before 11.5.5; 11.6.0 before 11.6.2 |
| CVE-2026-4646 | 4.3 | May 22 | Insufficient input validation in GitHub plugin API causes denial of service Affected: 10.11.0 before 10.11.15; 11.4.0 before 11.4.5; 11.5.0 before 11.5.4; 11.6.0 before 11.6.1 |
| CVE-2026-3636 | 4.3 | May 22 | Sanitize team member data returned by API Affected: 10.11.0 before 10.11.15; 11.4.0 before 11.4.5; 11.5.0 before 11.5.4; 11.6.0 before 11.6.1 |
| CVE-2026-4055 | 4.3 | May 21 | Insufficient permission validation on cross-team playbook run creation Affected: 10.11.0 before 10.11.17; 11.5.0 before 11.5.5; 11.6.0 before 11.6.2 |
| CVE-2026-28732 | 4.3 | May 18 | Slash command trigger-word update allowed command hijacking Affected: 10.11.0 before 10.11.14; 11.4.0 before 11.4.4; 11.5.0 before 11.5.2 |
| CVE-2026-6343 | 4.3 | May 18 | Mattermost Playbooks Plugin fails to enforce view permissions in list endpoints, allowing unauthorized access to public playbooks Affected: 10.11.0 before 10.11.14; 11.4.0 before 11.4.4; 11.5.0 before 11.5.2 |
| CVE-2026-4286 | 4.3 | May 18 | Playbooks Plugin fails to validate team transfers, allowing unauthorized removal of member access via playbook update Affected: 10.11.0 before 10.11.14; 11.5.0 before 11.5.2 |
| CVE-2026-6339 | 4.3 | May 18 | Missing request origin validation on burn-on-read reveal endpoint Affected: 11.4.0 before 11.4.4; 11.5.0 before 11.5.2 |
| CVE-2026-6341 | 4.3 | May 18 | Incomplete group locking implementation Affected: 10.13.0 through 10.13.11; 11.1.0 through 11.1.5; 11.3.0 through 11.3.4 |
| CVE-2026-6342 | 4.3 | May 18 | Group prefix matching bypass for subscriptions Affected: 10.13.0 through 10.13.11; 11.1.0 through 11.1.5; 11.3.0 through 11.3.4 |
| CVE-2026-4273 | 4.3 | May 18 | Insufficient token rotation validation in remote cluster invite confirmation Affected: 10.11.0 before 10.11.14; 11.5.0 before 11.5.2 |
| CVE-2026-3637 | 4.3 | May 18 | Mattermost fails to enforce create_post permission when editing posts Affected: 10.11.0 before 10.11.14; 11.4.0 before 11.4.4; 11.5.0 before 11.5.2 |
| CVE-2026-28759 | 4.3 | May 18 | Insufficient authorization in shared channel membership sync allows remote cluster to remove users from arbitrary channels Affected: 10.11.0 before 10.11.14; 11.4.0 before 11.4.4; 11.5.0 before 11.5.2 |
| CVE-2026-4053 | 4.3 | May 15 | post edit time limit is not enforced on some post update operations Affected: 10.11.0 before 10.11.14; 11.5.0 before 11.5.2 |
| CVE-2026-3115 | 4.3 | Mar 26 | Guest users can view group member IDs without respecting view restrictions Affected: 10.11.0 before 10.11.11; 11.2.0 before 11.2.3; 11.3.0 before 11.3.2; 11.4.0 |
| CVE-2026-1629 | 4.3 | Mar 16 | Permalink Preview Information Disclosure After Permission Revocation Affected: 10.11.0 before 10.11.11 |
| CVE-2026-26304 | 4.3 | Mar 16 | Permission Bypass in Playbook Run Creation Affected: 11.2.0 before 11.2.3; 11.3.0 before 11.3.1 |
| CVE-2026-24692 | 4.3 | Mar 16 | Guest users can bypass read permissions via search API Affected: 10.11.0 before 10.11.11; 11.2.0 before 11.2.3; 11.3.0 before 11.3.1 |
| CVE-2026-2455 | 4.3 | Mar 16 | SSRF bypass via IPv4-mapped IPv6 literals Affected: 10.11.0 before 10.11.11; 11.2.0 before 11.2.3; 11.3.0 before 11.3.1 |
| CVE-2026-21386 | 4.3 | Mar 16 | Private channel enumeration via /mute slash command Affected: 10.11.0 before 10.11.11; 11.2.0 before 11.2.3; 11.3.0 before 11.3.1 |
| CVE-2026-25780 | 4.3 | Mar 16 | Memory Exhaustion via Malformed DOC File Upload Affected: 10.11.0 before 10.11.11; 11.2.0 before 11.2.3; 11.3.0 before 11.3.1 |
| CVE-2026-4265 | 4.3 | Mar 16 | Guest user can upload files without permission across teams Affected: 10.11.0 before 10.11.11; 11.2.0 before 11.2.3; 11.3.0 before 11.3.1 |
| CVE-2026-25783 | 4.3 | Mar 16 | Denial of service via malformed User-Agent header in getBrowserVersion Affected: 10.11.0 before 10.11.11; 11.2.0 before 11.2.3; 11.3.0 before 11.3.1 |
| CVE-2026-2578 | 4.3 | Mar 16 | Information Disclosure via WebSocket Event When Deleting Unrevealed Burn on Read Posts Affected: 11.3.0 before 11.3.1 |
| CVE-2026-26246 | 4.3 | Mar 16 | Memory Exhaustion via Malformed PSD File Upload Affected: 10.11.0 before 10.11.11; 11.2.0 before 11.2.3; 11.3.0 before 11.3.1 |
| CVE-2026-2458 | 4.3 | Mar 16 | Unauthorized channel enumeration in private teams after member removal Affected: 10.11.0 before 10.11.11; 11.2.0 before 11.2.3; 11.3.0 before 11.3.1 |
| CVE-2026-2457 | 4.3 | Mar 16 | WebSocket Message Spoofing via Permalink Embed Manipulation Affected: 10.11.0 before 10.11.11; 11.2.0 before 11.2.3; 11.3.0 before 11.3.1 |
| CVE-2026-2461 | 4.3 | Mar 16 | Missing authorization check allows unauthorized modification of other users' comments on a board Affected: before 10.11.11; 11.0.0 through 11.0.3; 11.1.0 before 11.2.3; 11.3.0 before 11.3.1 |
| CVE-2026-2463 | 4.3 | Mar 16 | Unauthorized access to invite ID during team creation Affected: 10.11.0 before 10.11.11; 11.2.0 before 11.2.3; 11.3.0 before 11.3.1 |
| CVE-2025-14350 | 4.3 | Feb 16 | Information disclosure via channel mentions in posts Affected: 10.11.0 before 10.11.10; 11.1.0 before 11.1.3; 11.2.0 before 11.2.2 |