MS
Product
Mattermost Server
489
CVEs
0
On KEV
9.9
Max CVSS
3
New 30D
Severity mix
Critical 17High 85Medium 345Low 42
Watch
Add Mattermost Server to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2025-49222 | 6.8 | Aug 21 | Mattermost Shared Channel Upload Type Validation Bypass Affected: 9.11.0 before 9.11.18; 10.5.0 before 10.5.9; 10.8.0 before 10.8.4; 10.9.0 before 10.9.3; 10.10.0 |
| CVE-2026-2462 | 6.6 | Mar 16 | Admin RCE via Malicious Plugin Upload on CI Test Instances Affected: 10.11.0 before 10.11.11; 11.2.0 before 11.2.3; 11.3.0 before 11.3.1 |
| CVE-2026-19621 | 6.5 | Oct 16 | Mattermost leaks interactive-message integration secrets to non-admin users via post-deletion events and thread reads Affected: 11.7.0 before 11.7.10; 11.8.0 before 11.8.6; 11.9.0 before 11.9.2; 11.10.0 |
| CVE-2026-96260 | 6.5 | Sep 22 | Mattermost server missing request body size limit on plugin routes allows denial of service by an authenticated user Affected: 11.7.0 before 11.7.11; 11.8.0 before 11.8.6; 11.9.0 before 11.9.2; 11.10.0 before 11.10.2 |
| CVE-2026-91181 | 6.5 | Sep 14 | Data Retention Teams Endpoint Leaks Private Team Invite ID Affected: 10.11.0 before 10.11.23; 11.7.0 before 11.7.8; 11.8.0 before 11.8.5; 11.9.0 before 11.9.1 |
| CVE-2026-9812 | 6.5 | Sep 14 | Missing property field ownership validation in Playbooks run property update endpoint Affected: 10.11.0 before 10.11.23; 11.7.0 before 11.7.8; 11.8.0 before 11.8.5; 11.9.0 before 11.9.1 |
| CVE-2026-5132 | 6.5 | Sep 14 | Unbounded zlib decompression in Calls SDP WebSocket messages Affected: 10.11.0 before 10.11.23; 11.7.0 before 11.7.8; 11.8.0 before 11.8.5; 11.9.0 before 11.9.1 |
| CVE-2026-15814 | 6.5 | Sep 14 | Uploading a crafted image causes excessive memory allocation in the Mattermost Server Affected: 10.11.0 before 10.11.23; 11.7.0 before 11.7.8; 11.8.0 before 11.8.5; 11.9.0 before 11.9.1 |
| CVE-2026-9859 | 6.5 | Aug 17 | Mattermost Boards plugin didn’t enforce role-based authorization on board channel link allowing board editors to expose boards to arbitrary channels Affected: 10.11.0 before 10.11.22; 11.7.0 before 11.7.7; 11.8.0 before 11.8.4 |
| CVE-2026-10080 | 6.5 | Aug 17 | Boards plugin panics on WebSocket command with non-string field types Affected: 10.11.0 before 10.11.22; 11.7.0 before 11.7.7; 11.8.0 before 11.8.4 |
| CVE-2026-14298 | 6.5 | Aug 13 | Boards archive import endpoint allows resource exhaustion via zip bomb and file size limit bypass in Mattermost Affected: 10.11.0 before 10.11.23; 11.7.0 before 11.7.8; 11.8.0 before 11.8.5; 11.9.0 before 11.9.1 |
| CVE-2026-10819 | 6.5 | Jul 27 | Mattermost Server Denial of Service via Animated GIF Emoji Upload Affected: 10.11.0 before 10.11.21; 11.6.0 before 11.6.6; 11.7.0 before 11.7.5; 11.8.0 before 11.8.2 |
| CVE-2026-6850 | 6.5 | Jul 13 | Crafted message attachment causes client-side denial of service via markdown parser regex backtracking in Mattermost Affected: 10.11.0 before 10.11.20; 11.6.0 before 11.6.5; 11.7.0 before 11.7.3 |
| CVE-2026-10106 | 6.5 | Jul 13 | Unauthorized users can trigger interactive post actions in private channels via action cookie channel mismatch in Mattermost Affected: 10.11.0 before 10.11.20; 11.6.0 before 11.6.5; 11.7.0 before 11.7.3 |
| CVE-2026-9571 | 6.5 | Jul 13 | Deactivated user accounts can continue to obtain valid OAuth access tokens via refresh token grant in Mattermost Affected: 10.11.0 before 10.11.20; 11.6.0 before 11.6.5; 11.7.0 before 11.7.3 |
| CVE-2026-4339 | 6.5 | Jun 26 | SSRF via unvalidated attachment URLs in Mattermost Agents plugin MCP server Affected: 10.11.0 before 10.11.19; 11.5.0 before 11.5.7; 11.6.0 before 11.6.4 |
| CVE-2026-7184 | 6.5 | Jun 12 | Mattermost Remote Cluster PATCH API Leaks Authentication Tokens Affected: 10.11.0 before 10.11.17; 11.5.0 before 11.5.5; 11.6.0 before 11.6.2 |
| CVE-2026-4915 | 6.5 | May 25 | Server panic via outgoing webhook responses Affected: 10.11.0 before 10.11.15; 11.4.0 before 11.4.5; 11.5.0 before 11.5.4; 11.6.0 before 11.6.1 |
| CVE-2026-5755 | 6.5 | May 22 | Denial of service via crafted TIFF file upload Affected: 10.11.0 before 10.11.15; 11.4.0 before 11.4.5; 11.5.0 before 11.5.3; 11.6.0 before 11.6.1 |
| CVE-2026-6345 | 6.5 | May 18 | Prevent password disclosure and force reset during Slack import Affected: 10.11.0 before 10.11.14; 11.4.0 before 11.4.4; 11.5.0 before 11.5.2 |
| CVE-2026-5163 | 6.5 | May 18 | Missing authorization check in AI message rewrite endpoint allows access to private thread content Affected: 11.5.0 before 11.5.2 |
| CVE-2026-3117 | 6.5 | May 18 | Instance and webhook GitLab plugin commands were able to be run by non-admin users Affected: 10.13.0 through 10.13.11; 11.1.0 through 11.1.5; 11.3.0 through 11.3.4 |
| CVE-2026-6340 | 6.5 | May 18 | Memory Exhaustion via Malicious 7zip File Upload Affected: 10.11.0 before 10.11.14; 11.4.0 before 11.4.4; 11.5.0 before 11.5.2 |
| CVE-2026-2325 | 6.5 | May 18 | Improper Input Validation in MS Teams Meetings API Handler Affected: 10.11.0 before 10.11.14; 11.4.0 before 11.4.4; 11.5.0 before 11.5.2 |
| CVE-2026-4054 | 6.5 | May 15 | SVG content served through Mattermost image proxy despite Content-Type restrictions causes client-side denial of service Affected: 10.11.0 before 10.11.14; 11.4.0 before 11.4.4; 11.5.0 before 11.5.2 |
| CVE-2026-3590 | 6.5 | Apr 15 | Race Condition in Guest Magic Link Authentication Allows Token Reuse Affected: 10.11.0 before 10.11.13; 11.3.0 before 11.3.3; 11.4.0 before 11.4.3; 11.5.0 before 11.5.1 |
| CVE-2026-21388 | 6.5 | Apr 9 | Unbounded Request Body Read in MS Teams Plugin {{/lifecycle}} Webhook Endpoint Affected: through 2.3.1 |
| CVE-2026-3114 | 6.5 | Mar 26 | Zip Bomb Denial of Service via Unrestricted Archive Decompression Affected: 10.11.0 before 10.11.12; 11.2.0 before 11.2.4; 11.3.0 before 11.3.2; 11.4.0 |
| CVE-2026-26233 | 6.5 | Mar 25 | Denial of Service via HTTP/2 single packet attack on login endpoint Affected: 10.11.0 before 10.11.12; 11.2.0 before 11.2.4; 11.3.0 before 11.3.2; 11.4.0 before 11.4.1 |
| CVE-2025-14435 | 6.5 | Jan 16 | Application-Level DoS via infinite re-render loop in user profile handling Affected: 10.11.0 before 10.11.9; 11.0.0 before 11.0.7; 11.1.0 before 11.1.2 |
| CVE-2025-14822 | 6.5 | Jan 16 | DoS from quadratic complexity in model.ParseHashtags Affected: 10.11.0 before 10.11.9 |
| CVE-2025-12689 | 6.5 | Dec 17 | DoS in Calls plugin via malformed UTF-8 in WebSocket request Affected: 10.11.0 before 10.11.7; 10.12.0 before 10.12.3; 11.0.0 before 11.0.5 |
| CVE-2025-9081 | 6.5 | Sep 19 | IDOR in board file download allows any user to download any file by UUID Affected: 9.11.0 before 9.11.17; 10.5.0 before 10.5.9 |
| CVE-2025-9076 | 6.5 | Sep 15 | Mattermost Server exposes sensitive user credentials during shared channel membership synchronization Affected: 10.10.0 before 10.10.2 |
| CVE-2025-6226 | 6.5 | Jul 18 | Mattermost versions 10.5.x <= 10.5.6, 10.8.x <= 10.8.1, 10.7.x <= 10.7.3, 9.11.x <= 9.11.16 fail to verify authorization when retrieving cached posts by PendingPostID which allows… Affected: 9.11.0 before 9.11.17; 10.5.0 before 10.5.7; 10.7.0 before 10.7.4; 10.8.0 before 10.8.2 |
| CVE-2025-31363 | 6.5 | Apr 16 | Mattermost versions 10.4.x <= 10.4.2, 10.5.x <= 10.5.0, 9.11.x <= 9.11.9 fail to restrict domains the LLM can request to contact upstream which allows an authenticated user… Affected: 9.11.0 before 9.11.10; 10.4.0 before 10.4.3; 10.5.0 |
| CVE-2025-30179 | 6.5 | Mar 21 | Mattermost versions 10.4.x <= 10.4.2, 10.3.x <= 10.3.3, 9.11.x <= 9.11.8 fail to enforce MFA on certain search APIs, which allows authenticated attackers to bypass MFA protections… Affected: 9.11.0 before 9.11.9; 10.3.0 before 10.3.4; 10.4.0 before 10.4.3 |
| CVE-2025-24490 | 6.5 | Feb 24 | Mattermost versions 10.4.x <= 10.4.1, 9.11.x <= 9.11.7, 10.3.x <= 10.3.2, 10.2.x <= 10.2.2 fail to use prepared statements in the SQL query of boards reordering which allows an… Affected: 9.11.0 before 9.11.8; 10.2.0 before 10.2.3; 10.3.0 before 10.3.3; 10.4.0 before 10.4.2 |
| CVE-2025-20051 | 6.5 | Feb 24 | Mattermost versions 10.4.x <= 10.4.1, 9.11.x <= 9.11.7, 10.3.x <= 10.3.2, 10.2.x <= 10.2.2 fail to properly validate input when patching and duplicating a board, which allows a… Affected: 9.11.0 before 9.11.8; 10.2.0 before 10.2.3; 10.3.0 before 10.3.3; 10.4.0 before 10.4.2 |
| CVE-2025-20088 | 6.5 | Jan 15 | Mattermost versions 10.2.x <= 10.2.0, 9.11.x <= 9.11.5, 10.0.x <= 10.0.3, 10.1.x <= 10.1.3 fail to properly validate post props which allows a malicious authenticated user to… Affected: 9.11.0 before 9.11.6; 10.0.0 before 10.0.4; 10.1.0 before 10.1.4; 10.2.0 |
| CVE-2025-20086 | 6.5 | Jan 15 | Mattermost versions 10.2.x <= 10.2.0, 9.11.x <= 9.11.5, 10.0.x <= 10.0.3, 10.1.x <= 10.1.3 fail to properly validate post props which allows a malicious authenticated user to… Affected: 9.11.0 before 9.11.6; 10.0.0 before 10.0.4; 10.1.0 before 10.1.4; 10.2.0 |
| CVE-2025-21088 | 6.5 | Jan 15 | Mattermost versions 10.2.x <= 10.2.0, 9.11.x <= 9.11.5, 10.0.x <= 10.0.3, 10.1.x <= 10.1.3 fail to properly validate the style of proto supplied to an action's style in… Affected: 9.11.0 before 9.11.6; 10.0.0 before 10.0.4; 10.1.0 before 10.1.4; 10.2.0 |
| CVE-2025-20033 | 6.5 | Jan 9 | DoS via custom post type for sysconsole plugin readers Affected: 9.11.0 before 9.11.6; 10.0.0 before 10.0.4; 10.1.0 before 10.1.4; 10.2.0 before 10.2.1 |
| CVE-2024-54083 | 6.5 | Dec 16 | Mattermost versions 10.1.x <= 10.1.2, 10.0.x <= 10.0.2, 9.11.x <= 9.11.4, 9.5.x <= 9.5.12 fail to properly validate the type of callProps which allows a user to cause a client… Affected: 9.5.0 before 9.5.13; 9.11.0 before 9.11.5; 10.0.0 before 10.0.3; 10.1.0 before 10.1.3 |
| CVE-2024-47003 | 6.5 | Sep 26 | Mattermost versions 9.11.x <= 9.11.0 and 9.5.x <= 9.5.8 fail to validate that the message of the permalink post is a string, which allows an attacker to send a non-string value as… Affected: 9.5.0 before 9.5.9; 9.11.0; 9.11.0; 9.11.0; 9.11.0 |
| CVE-2024-4183 | 6.5 | Apr 26 | Mattermost versions 8.1.x before 8.1.12, 9.6.x before 9.6.1, 9.5.x before 9.5.3, 9.4.x before 9.4.5 fail to limit the number of active sessions, which allows an authenticated… Affected: 8.1.0 before 8.1.12; 9.4.0 before 9.4.5; 9.5.0 before 9.5.3; 9.6.0 before 9.6.1 |
| CVE-2024-22091 | 6.5 | Apr 26 | Mattermost versions 8.1.x <= 8.1.10, 9.6.x <= 9.6.0, 9.5.x <= 9.5.2 and 8.1.x <= 8.1.11 fail to limit the size of a request path that includes user inputs which allows an attacker… Affected: 8.1.0 before 8.1.12; 9.5.0 before 9.5.3; 9.6.0 before 9.6.1 |
| CVE-2024-2447 | 6.5 | Apr 5 | Mattermost versions 8.1.x before 8.1.11, 9.3.x before 9.3.3, 9.4.x before 9.4.4, and 9.5.x before 9.5.2 fail to authenticate the source of certain types of post actions, allowing… Affected: 8.1.0 before 8.1.11; 9.3.0 before 9.3.3; 9.4.0 before 9.4.4; 9.5.0 before 9.5.2 |
| CVE-2024-28949 | 6.5 | Apr 5 | Mattermost Server versions 9.5.x before 9.5.2, 9.4.x before 9.4.4, 9.3.x before 9.3.3, 8.1.x before 8.1.11 don't limit the number of user preferences which allows an attacker to… Affected: 8.1.0 before 8.1.11; 9.3.0 before 9.3.3; 9.4.0 before 9.4.4; 9.5.0 before 9.5.2 |
| CVE-2024-28053 | 6.5 | Mar 15 | Resource Exhaustion in Mattermost Server versions 8.1.x before 8.1.10 fails to limit the size of the payload that can be read and parsed allowing an attacker to send a very large… Affected: 8.1.0 before 8.1.10 |