MS
Product
Mattermost Server
489
CVEs
0
On KEV
9.9
Max CVSS
3
New 30D
Severity mix
Critical 17High 85Medium 345Low 42
Watch
Add Mattermost Server to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2024-4182 | 4.3 | Apr 26 | Mattermost versions 9.6.0, 9.5.x before 9.5.3, 9.4.x before 9.4.5, and 8.1.x before 8.1.12 fail to handle JSON parsing errors in custom status values, which allows an… Affected: 8.1.0 before 8.1.12; 9.4.0 before 9.4.5; 9.5.0 before 9.5.3; 9.6.0 before 9.6.1 |
| CVE-2024-32046 | 4.3 | Apr 26 | Mattermost versions 9.6.x <= 9.6.0, 9.5.x <= 9.5.2, 9.4.x <= 9.4.4 and 8.1.x <= 8.1.11 fail to remove detailed error messages in API requests even if the developer mode is off… Affected: 8.1.0 before 8.1.12; 9.4.0 before 9.4.5; 9.5.0 before 9.5.3; 9.6.0 before 9.6.1 |
| CVE-2024-2446 | 4.3 | Mar 15 | Mattermost versions 8.1.x before 8.1.10, 9.2.x before 9.2.6, 9.3.x before 9.3.2, and 9.4.x before 9.4.3 fail to limit the number of @-mentions processed per message, allowing an… Affected: 8.1.0 before 8.1.10; 9.2.0 before 9.2.6; 9.3.0 before 9.3.2; 9.4.0 before 9.4.3 |
| CVE-2024-1953 | 4.3 | Feb 29 | Mattermost versions 8.1.x before 8.1.9, 9.2.x before 9.2.5, 9.3.0, and 9.4.x before 9.4.2 fail to limit the number of role names requested from the API, allowing an authenticated… Affected: 8.1.0 before 8.1.9; 9.2.0 before 9.2.5; 9.4.0 before 9.4.2; 9.3.0 |
| CVE-2024-1952 | 4.3 | Feb 29 | Mattermost version 8.1.x before 8.1.9 fails to sanitize data associated with permalinks when a plugin updates an ephemeral post, allowing an authenticated attacker who can control… Affected: 8.1.0 before 8.1.9 |
| CVE-2024-1942 | 4.3 | Feb 29 | Mattermost versions 8.1.x before 8.1.9, 9.2.x before 9.2.5, and 9.3.0 fail to sanitize the metadata on posts containing permalinks under specific conditions, which allows an… Affected: 8.1.0 before 8.1.9; 9.2.0 before 9.2.5; 9.3.0 |
| CVE-2024-1888 | 4.3 | Feb 29 | Mattermost fails to check the "invite_guest" permission when inviting guests of other teams to a team, allowing a member with permissions to add other members but not to add… Affected: before 8.1.9; 9.2.0 before 9.2.5; 9.3.0 before 9.3.1; 9.4.0 before 9.4.2 |
| CVE-2024-23488 | 4.3 | Feb 29 | Mattermost fails to properly restrict the access of files attached to posts in an archived channel, resulting in members being able to access files of archived channels even if… Affected: before 8.1.9; 9.0.0 before 9.4.2 |
| CVE-2024-1887 | 4.3 | Feb 29 | Mattermost fails to check if compliance export is enabled when fetching posts of public channels allowing a user that is not a member of the public channel to fetch the posts,… Affected: before 8.1.9; 9.2.0 before 9.2.5; 9.3.0 before 9.3.1 |
| CVE-2024-1402 | 4.3 | Feb 9 | Mattermost fails to check if a custom emoji reaction exists when sending it to a post and to limit the amount of custom emojis allowed to be added in a post, allowing an attacker… Affected: through 8.1.7; 9.0.0 through 9.1.4; 9.2.0 through 9.2.3 |
| CVE-2024-24776 | 4.3 | Feb 9 | Mattermost fails to check the required permissions in the POST /api/v4/channels/stats/member_count API resulting in channel member counts being leaked to a user without… Affected: through 8.1.7 |
| CVE-2023-50333 | 4.3 | Jan 2 | Mattermost fails to update the permissions of the current session for a user who was just demoted to guest, allowing freshly demoted guests to change group names Affected: before 8.1.7 |
| CVE-2023-48732 | 4.3 | Jan 2 | Mattermost fails to scope the WebSocket response around notified users to a each user separately resulting in the WebSocket broadcasting the information about who was notified… Affected: before 8.1.7 |
| CVE-2023-47858 | 4.3 | Jan 2 | Mattermost fails to properly verify the permissions needed for viewing archived public channels, allowing a member of one team to get details about the archived public channels… Affected: before 8.1.7; 9.0.0 before 9.0.5; 9.1.0 before 9.1.4; 9.2.0 before 9.2.3 |
| CVE-2023-6727 | 4.3 | Dec 12 | Mattermost fails to perform correct authorization checks when creating a playbook action, allowing users without access to the playbook to create playbook actions Affected: through 8.1.5; 9.2.0 through 9.2.1 |
| CVE-2023-49874 | 4.3 | Dec 12 | Mattermost fails to check whether a user is a guest when updating the tasks of a private playbook run allowing a guest to update the tasks of a private playbook run if they know… Affected: through 7.8.14; 8.0.0 through 8.1.5; 9.0.0 through 9.0.3; 9.1.1 through 9.1.2; 9.2.0 through 9.2.1 |
| CVE-2023-3585 | 4.3 | Jul 17 | Mattermost Boards fail to properly validate a board link, allowing an attacker to crash a channel by posting a specially crafted boards link Affected: before 7.8.7; 7.9.0 before 7.9.5; 7.10.0 before 7.10.3 |
| CVE-2023-3582 | 4.3 | Jul 17 | Mattermost fails to verify channel membership when linking a board to a channel allowing a low-privileged authenticated user to link a Board to a private channel they don't have… Affected: 7.8.0 before 7.8.7; 7.9.0 before 7.9.5; 7.10.0 before 7.10.3 |
| CVE-2023-3577 | 4.3 | Jul 17 | Mattermost fails to properly restrict requests to localhost/intranet during the interactive dialog, which could allow an attacker to perform a limited blind SSRF Affected: 7.8.0 before 7.8.7; 7.10.0 before 7.10.3 |
| CVE-2023-2281 | 4.3 | Apr 25 | When archiving a team, Mattermost fails to sanitize the related Websocket event sent to currently connected clients Affected: before 7.9.0 |
| CVE-2022-1332 | 4.3 | Apr 13 | One of the API in Mattermost version 6.4.1 and earlier fails to properly protect the permissions, which allows the authenticated members with restricted custom admin role to… Affected: 5.37.0 before 5.37.9; 6.2.0 before 6.2.5; 6.3.0 before 6.3.5; 6.4.0 before 6.4.2 |
| CVE-2016-11081 | 4.3 | Jun 19 | An issue was discovered in Mattermost Server before 2.2.0 Affected: before 2.2.0 |
| CVE-2016-11080 | 4.3 | Jun 19 | An issue was discovered in Mattermost Server before 3.0.0 Affected: before 3.0.0 |
| CVE-2016-11065 | 4.3 | Jun 19 | An issue was discovered in Mattermost Server before 3.3.0 Affected: before 3.3.0 |
| CVE-2017-18910 | 4.3 | Jun 19 | An issue was discovered in Mattermost Server before 3.8.2, 3.7.5, and 3.6.7 Affected: before 3.6.7; 3.7.0 before 3.7.5; 3.8.0 before 3.8.2 |
| CVE-2017-18890 | 4.3 | Jun 19 | An issue was discovered in Mattermost Server before 4.3.0, 4.2.1, and 4.1.2 Affected: before 4.1.2; 4.2.0 before 4.2.1; 4.3.0; 4.3.0; 4.3.0; 4.3.0 |
| CVE-2017-18889 | 4.3 | Jun 19 | An issue was discovered in Mattermost Server before 4.3.0, 4.2.1, and 4.1.2 Affected: before 4.1.2; 4.2.0 before 4.2.1; 4.3.0; 4.3.0; 4.3.0; 4.3.0 |
| CVE-2017-18878 | 4.3 | Jun 19 | An issue was discovered in Mattermost Server before 4.3.0, 4.2.1, and 4.1.2 Affected: before 4.1.2; 4.2.0 before 4.2.1; 4.3.0; 4.3.0; 4.3.0; 4.3.0 |
| CVE-2018-21256 | 4.3 | Jun 19 | An issue was discovered in Mattermost Server before 5.1 Affected: before 5.1.0 |
| CVE-2018-21252 | 4.3 | Jun 19 | An issue was discovered in Mattermost Server before 5.2, 5.1.1, 5.0.3, and 4.10.3 Affected: before 4.10.3; 5.0.0 before 5.0.3; 5.1.0 before 5.1.1; 5.2.0; 5.2.0; 5.2.0; +3 more |
| CVE-2017-18872 | 4.3 | Jun 19 | An issue was discovered in Mattermost Server before 4.4.3 and 4.3.3 Affected: before 4.3.3; 4.4.0 before 4.4.3 |
| CVE-2019-20890 | 4.3 | Jun 19 | An issue was discovered in Mattermost Server before 5.7 Affected: before 5.7.0 |
| CVE-2019-20887 | 4.3 | Jun 19 | An issue was discovered in Mattermost Server before 5.7.1, 5.6.4, 5.5.3, and 4.10.6 Affected: before 4.10.6; 5.5.0 before 5.5.3; 5.6.0 before 5.6.4; 5.7.0 before 5.7.1 |
| CVE-2019-20883 | 4.3 | Jun 19 | An issue was discovered in Mattermost Server before 5.8.0, when Town Square is set to Read-Only Affected: before 5.8.0 |
| CVE-2019-20879 | 4.3 | Jun 19 | An issue was discovered in Mattermost Server before 5.8.0, 5.7.2, 5.6.5, and 4.10.7 Affected: before 4.10.7; 5.6.0 before 5.6.5; 5.7.0 before 5.7.2; 5.8.0; 5.8.0; 5.8.0; +1 more |
| CVE-2019-20878 | 4.3 | Jun 19 | An issue was discovered in Mattermost Server before 5.9.0, 5.8.1, 5.7.3, and 4.10.8 Affected: before 4.10.8; 5.7.0 before 5.7.3; 5.8.0 before 5.8.1; 5.9.0; 5.9.0; 5.9.0; +1 more |
| CVE-2018-21261 | 4.3 | Jun 19 | An issue was discovered in Mattermost Server before 4.8.1, 4.7.4, and 4.6.3 Affected: 4.6.0 before 4.6.3; 4.7.0 before 4.7.4; 4.8.0 before 4.8.1 |
| CVE-2018-21255 | 4.3 | Jun 19 | An issue was discovered in Mattermost Server before 5.1 Affected: before 5.1.0 |
| CVE-2018-21254 | 4.3 | Jun 19 | An issue was discovered in Mattermost Server before 5.1 Affected: before 5.1.0 |
| CVE-2018-21253 | 4.3 | Jun 19 | An issue was discovered in Mattermost Server before 5.1, 5.0.2, and 4.10.2 Affected: before 4.10.2; 5.0.0 before 5.0.2; 5.1.0; 5.1.0; 5.1.0; 5.1.0 |
| CVE-2017-18870 | 4.3 | Jun 19 | An issue was discovered in Mattermost Server before 4.5.0, 4.4.5, and 4.3.4 Affected: before 4.3.4; 4.4.0 before 4.4.5; 4.5.0; 4.5.0; 4.5.0; 4.5.0 |
| CVE-2019-20870 | 4.3 | Jun 19 | An issue was discovered in Mattermost Server before 5.10.0 Affected: before 5.10.0 |
| CVE-2026-15754 | 4.2 | Aug 17 | Missing per-channel team-scope check in ABAC access control policy unassign allows cross-team policy removal Affected: 11.7.0 before 11.7.7; 11.8.0 before 11.8.4 |
| CVE-2025-2571 | 4.2 | May 30 | Google OAuth Authentication Bypass for Converted Bot Accounts Affected: 9.11.0 before 9.11.13; 10.5.0 before 10.5.4; 10.6.0 before 10.6.3; 10.7.0 before 10.7.1 |
| CVE-2025-64641 | 4.1 | Dec 24 | Mattermost Jira plugin crafted action leaks Jira issue details Affected: 10.11.0 before 10.11.8; 10.12.0 before 10.12.4; 11.0.0 before 11.0.6; 11.1.0 before 11.1.1 |
| CVE-2025-4573 | 4.1 | Jun 11 | LDAP Injection in Mattermost Enterprise Edition When Using Active Directory Affected: 9.11.0 before 9.11.14; 10.5.0 before 10.5.5; 10.6.0 before 10.6.4; 10.7.0 before 10.7.2 |
| CVE-2024-24774 | 4.1 | Feb 9 | Mattermost Jira Plugin handling subscriptions fails to check the security level of an incoming issue or limit it based on the user who created the subscription resulting… Affected: through 8.1.7 |
| CVE-2026-9820 | 3.8 | Jul 13 | Mattermost schemes teams endpoint exposes private team invite IDs Affected: 10.11.0 before 10.11.20; 11.7.0 before 11.7.3 |
| CVE-2026-8823 | 3.8 | Jun 22 | User Manager can demote bot accounts to guest without bot-management permission Affected: 10.11.0 before 10.11.18; 11.7.0 before 11.7.1 |
| CVE-2026-8074 | 3.8 | Jun 22 | Improper Permission Check Allows User Manager to Deactivate Bot Accounts Affected: 10.11.0 before 10.11.18; 11.7.0 before 11.7.1 |