MS
Product
Mattermost Server
489
CVEs
0
On KEV
9.9
Max CVSS
3
New 30D
Severity mix
Critical 17High 85Medium 345Low 42
Watch
Add Mattermost Server to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2026-7387 | 8.8 | Jun 12 | Mattermost group syncable endpoints allow privilege escalation via scheme_admin Affected: 10.11.0 before 10.11.17; 11.5.0 before 11.5.5; 11.6.0 before 11.6.2 |
| CVE-2026-3108 | 8.8 | Mar 26 | Terminal Escape Injection in mmctl Report Posts Command Affected: 10.11.0 before 10.11.11; 11.2.0 before 11.2.3; 11.3.0 before 11.3.2; 11.4.0 |
| CVE-2025-25274 | 8.8 | Mar 21 | Mattermost versions 10.4.x <= 10.4.2, 10.3.x <= 10.3.3, 9.11.x <= 9.11.8 fail to restrict command execution in archived channels, which allows authenticated users to run commands… Affected: 9.11.0 before 9.11.9; 10.3.0 before 10.3.4; 10.4.0 before 10.4.3 |
| CVE-2025-25068 | 8.8 | Mar 21 | Mattermost versions 10.4.x <= 10.4.2, 10.3.x <= 10.3.3, 9.11.x <= 9.11.8, 10.5.x <= 10.5.0 fail to enforce MFA on plugin endpoints, which allows authenticated attackers to bypass… Affected: 9.11.0 before 9.11.9; 10.3.0 before 10.3.4; 10.4.0 before 10.4.3; 10.5.0 before 10.5.1 |
| CVE-2025-1412 | 8.8 | Feb 24 | Mattermost versions 9.11.x <= 9.11.6, 10.4.x <= 10.4.1 fail to invalidate all active sessions when converting a user to a bot, with allows the converted user to escalate their… Affected: 9.11.0 before 9.11.7; 10.4.0 before 10.4.2 |
| CVE-2024-2450 | 8.8 | Mar 15 | Mattermost versions 8.1.x before 8.1.10, 9.2.x before 9.2.6, 9.3.x before 9.3.2, and 9.4.x before 9.4.3 fail to correctly verify account ownership when switching from email to… Affected: 8.1.0 before 8.1.10; 9.2.0 before 9.2.6; 9.3.0 before 9.3.2; 9.4.0 before 9.4.3; 9.5.0 |
| CVE-2023-45316 | 8.8 | Dec 12 | Mattermost fails to validate if a relative path is passed in /plugins/playbooks/api/v0/telemetry/run/<telem_run_id> as a telemetry run ID, allowing an attacker to use a path… Affected: through 7.8.14; 8.0.0 through 8.1.5; 9.0.0 through 9.0.3; 9.1.1 through 9.1.2; 9.2.0 through 9.2.1 |
| CVE-2023-2515 | 8.8 | May 12 | Mattermost fails to restrict a user with permissions to edit other users and to create personal access tokens from elevating their privileges to system admin Affected: before 7.1.8; 7.2.0 before 7.7.4; 7.8.0 before 7.8.3; 7.9.0 before 7.9.2 |
| CVE-2022-1384 | 8.8 | Apr 19 | Mattermost version 6.4.x and earlier fails to properly check the plugin version when a plugin is installed from the Marketplace, which allows an authenticated and an authorized… Affected: before 6.5.0 |
| CVE-2017-18903 | 8.8 | Jun 19 | An issue was discovered in Mattermost Server before 4.0.0, 3.10.2, and 3.9.2 Affected: before 3.9.2; 3.10.0 before 3.10.2 |
| CVE-2017-18886 | 8.8 | Jun 19 | An issue was discovered in Mattermost Server before 4.3.0, 4.2.1, and 4.1.2 Affected: before 4.1.2; 4.2.0 before 4.2.1; 4.3.0; 4.3.0; 4.3.0; 4.3.0 |
| CVE-2018-21264 | 8.8 | Jun 19 | An issue was discovered in Mattermost Server before 4.7.0, 4.6.2, and 4.5.2 Affected: before 4.5.2; 4.6.0 before 4.6.2; 4.7.0; 4.7.0; 4.7.0; 4.7.0 |
| CVE-2018-21263 | 8.8 | Jun 19 | An issue was discovered in Mattermost Server before 4.7.0, 4.6.2, and 4.5.2 Affected: before 4.5.2; 4.6.0 before 4.6.2; 4.7.0; 4.7.0; 4.7.0; 4.7.0 |
| CVE-2019-20865 | 8.8 | Jun 19 | An issue was discovered in Mattermost Server before 5.12.0, 5.11.1, 5.10.2, 5.9.2, and 4.10.10 Affected: before 4.10.10; 5.9.0 before 5.9.2; 5.10.0 before 5.10.2; 5.11.0 before 5.11.1; 5.12.0; 5.12.0; +4 more |
| CVE-2019-20841 | 8.8 | Jun 19 | An issue was discovered in Mattermost Server before 5.18.0, 5.17.2, 5.16.4, 5.15.4, and 5.9.7 Affected: before 5.9.7; 5.15.0 before 5.15.4; 5.16.0 before 5.16.4; 5.17.0 before 5.17.2; 5.18.0; 5.18.0; +2 more |
| CVE-2026-6346 | 8.7 | May 18 | Sensitive credentials exposed in plaintext in Mattermost support packets Affected: 10.11.0 before 10.11.14; 11.4.0 before 11.4.4; 11.5.0 before 11.5.2 |
| CVE-2026-2454 | 8.6 | Mar 16 | DoS in Calls plugin via malformed msgpack in websocket request. Affected: 10.11.0 before 10.11.11; 11.2.0 before 11.2.3; 11.3.0 before 11.3.1 |
| CVE-2026-9816 | 8.3 | Aug 17 | Insufficient server-side validation of board member role fields permits privilege escalation Affected: 10.11.0 before 10.11.22; 11.7.0 before 11.7.7; 11.8.0 before 11.8.4 |
| CVE-2025-14273 | 8.3 | Dec 22 | Mattermost Jira plugin user spoofing enables Jira request forgery. Affected: 10.11.0 before 10.11.8; 10.12.0 before 10.12.4; 11.0.0 before 11.0.6; 11.1.0 before 11.1.1 |
| CVE-2023-4478 | 8.2 | Aug 25 | Mattermost fails to restrict which parameters' values it takes from the request during signup allowing an attacker to register users as inactive, thus blocking them from later… Affected: before 7.8.9; 7.9.0 before 7.10.5; 8.0.0 |
| CVE-2023-3591 | 8.2 | Jul 17 | Mattermost fails to invalidate previously generated password reset tokens when a new reset token was created Affected: 7.8.0 before 7.8.7; 7.9.0 before 7.9.5; 7.10.0 before 7.10.3 |
| CVE-2026-28741 | 8.1 | Apr 15 | CSRF Protection Bypass Allows Updating a User's Authentication Method Affected: 10.11.0 before 10.11.13; 11.3.0 before 11.3.3; 11.4.0 before 11.4.3; 11.5.0 before 11.5.1 |
| CVE-2025-58073 | 8.1 | Oct 16 | Arbitrary Mattermost Team can be joined by manipulating the OAuth state Affected: 10.5.0 before 10.5.11; 10.10.0 before 10.10.3; 10.11.0 before 10.11.3 |
| CVE-2025-58075 | 8.1 | Oct 16 | Arbitrary Mattermost Team can be joined by manipulating the SAML RelayState Affected: 10.5.0 before 10.5.11; 10.10.0 before 10.10.3; 10.11.0 before 10.11.3 |
| CVE-2023-3581 | 8.1 | Jul 17 | Mattermost fails to properly validate the origin of a websocket connection allowing a MITM attacker on Mattermost to access the websocket APIs Affected: 7.8.0 before 7.8.7; 7.9.0 before 7.9.5; 7.10.0 before 7.10.3 |
| CVE-2017-18906 | 8.1 | Jun 19 | An issue was discovered in Mattermost Server before 4.0.0, 3.10.2, and 3.9.2, when Single Sign-On OAuth2 is used Affected: before 3.9.2; 3.10.0 before 3.10.2 |
| CVE-2017-18894 | 8.1 | Jun 19 | An issue was discovered in Mattermost Server before 4.2.0, 4.1.1, and 4.0.5, when used as an OAuth 2.0 service provider Affected: before 4.0.5; 4.1.0 before 4.1.1; 4.2.0; 4.2.0; 4.2.0; 4.2.0 |
| CVE-2017-18884 | 8.1 | Jun 19 | An issue was discovered in Mattermost Server before 4.3.0, 4.2.1, and 4.1.2 Affected: before 4.1.2; 4.2.0 before 4.2.1; 4.3.0; 4.3.0; 4.3.0; 4.3.0 |
| CVE-2026-6961 | 7.6 | Jun 12 | CVE-2026-6961: Path traversal via unsanitized FileInfo.Name in Mattermost federation sync Affected: 10.11.0 before 10.11.17; 11.5.0 before 11.5.5; 11.6.0 before 11.6.2 |
| CVE-2026-6347 | 7.6 | May 18 | Mattermost Calls plugin exposes TURN server credentials in plaintext in support packets Affected: 10.11.0 before 10.11.14; 11.4.0 before 11.4.4; 11.5.0 before 11.5.2 |
| CVE-2026-5740 | 7.5 | May 22 | Unauthenticated WebSocket binary frame causes denial of service in Mattermost Server Affected: 10.11.0 before 10.11.15; 11.4.0 before 11.4.5; 11.5.0 before 11.5.4; 11.6.0 before 11.6.1 |
| CVE-2026-5308 | 7.5 | May 22 | Missing request body size limits on Zoom plugin HTTP endpoints Affected: 10.11.0 before 10.11.15; 11.4.0 before 11.4.5; 11.5.0 before 11.5.4; 11.6.0 before 11.6.1 |
| CVE-2026-20719 | 7.5 | Mar 25 | DoS via URL Previews Rendering Malicious SVGs Affected: 10.11.0 before 10.11.12; 11.2.0 before 11.2.4; 11.3.0 before 11.3.2; 11.4.0 before 11.4.1 |
| CVE-2026-24458 | 7.5 | Mar 16 | DoS attack via login attempts with multi-megabyte passwords Affected: 10.11.0 before 10.11.11; 11.2.0 before 11.2.3; 11.3.0 before 11.3.1 |
| CVE-2025-55070 | 7.5 | Nov 14 | Lack of MFA enforcement in WebSocket connections Affected: before 11.0.0 |
| CVE-2025-41395 | 7.5 | Apr 24 | Mattermost versions 10.4.x <= 10.4.2, 10.5.x <= 10.5.0, 9.11.x <= 9.11.10 fail to properly validate the props used by the RetrospectivePost custom post type in the Playbooks… Affected: 9.11.0 before 9.11.11; 10.4.0 before 10.4.3; 10.5.0 before 10.5.1 |
| CVE-2025-35965 | 7.5 | Apr 24 | Mattermost versions 10.4.x <= 10.4.2, 10.5.x <= 10.5.0, 9.11.x <= 9.11.10 fail to validate the uniqueness and quantity of task actions within the UpdateRunTaskActions GraphQL… Affected: 9.11.0 before 9.11.11; 10.4.0 before 10.4.3; 10.5.0 |
| CVE-2025-25279 | 7.5 | Feb 24 | Mattermost versions 10.4.x <= 10.4.1, 9.11.x <= 9.11.7, 10.3.x <= 10.3.2, 10.2.x <= 10.2.2 fail to properly validate board blocks when importing boards which allows an attacker… Affected: 9.11.0 before 9.11.8; 10.2.0 before 10.2.3; 10.3.0 before 10.3.3; 10.4.0 before 10.4.2 |
| CVE-2025-20621 | 7.5 | Jan 16 | Mattermost versions 10.2.x <= 10.2.0, 9.11.x <= 9.11.5, 10.0.x <= 10.0.3, 10.1.x <= 10.1.3 fail to properly handle posts with attachments containing fields that cannot be cast to… Affected: 9.11.0 before 9.11.6; 10.0.0 before 10.0.4; 10.1.0 before 10.1.4; 10.2.0 |
| CVE-2024-47401 | 7.5 | Oct 29 | Mattermost versions 9.10.x <= 9.10.2, 9.11.x <= 9.11.1 and 9.5.x <= 9.5.9 fail to prevent detailed error messages from being displayed in Playbooks which allows an attacker to… Affected: 9.5.0 before 9.5.10; 9.10.0 before 9.10.3; 9.11.0 before 9.11.2 |
| CVE-2023-49607 | 7.5 | Dec 12 | Mattermost fails to validate the type of the "reminder" body request parameter allowing an attacker to crash the Playbook Plugin when updating the status dialog Affected: through 7.8.14; 8.0.0 through 8.1.5; 9.0.0 through 9.0.3; 9.1.0 through 9.1.2; 9.2.0 through 9.2.1; 9.1.1 |
| CVE-2023-45847 | 7.5 | Dec 12 | Mattermost fails to to check the length when setting the title in a run checklist in Playbooks, allowing an attacker to send a specially crafted request and crash the Playbooks… Affected: through 7.8.14; 8.0.0 through 8.1.5; 9.0.0 through 9.0.3; 9.1.1 through 9.1.2; 9.2.0 through 9.2.1 |
| CVE-2023-5330 | 7.5 | Oct 9 | Mattermost fails to enforce a limit for the size of the cache entry for OpenGraph data allowing an attacker to send a specially crafted request to the /api/v4/opengraph filling… Affected: before 7.8.11; 8.0.0 before 8.0.3; 8.1.0 before 8.1.2 |
| CVE-2023-3590 | 7.5 | Jul 17 | Mattermost fails to delete card attachments in Boards, allowing an attacker to access deleted attachments Affected: 7.10.0 before 7.10.3 |
| CVE-2023-1831 | 7.5 | Apr 17 | Mattermost fails to redact from audit logs the user password during user creation and the user password hash in other operations if the experimental audit logging configuration… Affected: before 7.7.3; 7.8.0 before 7.8.2; 7.9.0 |
| CVE-2022-0903 | 7.5 | Mar 10 | A call stack overflow bug in the SAML login feature in Mattermost server in versions up to and including 6.3.2 allows an attacker to crash the server via submitting a maliciously… Affected: before 5.37.8; 6.0.0 before 6.1.3; 6.2.0 before 6.2.3; 6.3.0 before 6.3.3 |
| CVE-2017-18917 | 7.5 | Jun 19 | An issue was discovered in Mattermost Server before 3.8.2, 3.7.5, and 3.6.7 Affected: 3.6.0 before 3.6.7; 3.7.0 before 3.7.5; 3.8.0 before 3.8.2 |
| CVE-2016-11069 | 7.5 | Jun 19 | An issue was discovered in Mattermost Server before 3.2.0 Affected: before 3.2.0 |
| CVE-2016-11066 | 7.5 | Jun 19 | An issue was discovered in Mattermost Server before 3.2.0 Affected: before 3.2.0 |
| CVE-2015-9548 | 7.5 | Jun 19 | An issue was discovered in Mattermost Server before 1.2.0 Affected: before 1.2.0 |