Path traversal in integration action URL leading to arbitrary API execution via system admin’s auth token.

Account Takeover via Code Exchange Endpoint

Account takeover on OAuth/OpenID-enabled servers

Mattermost versions 9.9.x <= 9.9.0, 9.5.x <= 9.5.6, 9.7.x <= 9.7.5 and 9.8.x <= 9.8.1 fail to disallow unsolicited invites to expose access to local channels, when shared channels…

Mattermost DCR redirect URI allowlist bypass via improper URL component validation

Mattermost fails to invalidate existing authorization codes when deauthorizing an OAuth2 app, allowing an attacker possessing an authorization code to generate an access token

An issue was discovered in Mattermost Mobile Apps before 1.26.0

Mattermost group syncable endpoints allow privilege escalation via scheme_admin

Authorization Bypass in Mattermost Legal Hold Plugin Due to Missing Return After Permission Check

Terminal Escape Injection in mmctl Report Posts Command

Mattermost versions 9.9.x <= 9.9.1, 9.5.x <= 9.5.7, 9.10.x <= 9.10.0, 9.8.x <= 9.8.2 fail to sanitize user inputs in the frontend that are used for redirection which allows for a…

Mattermost version 2.10.0 and earlier fails to sanitize deeplink paths, which allows an attacker to perform CSRF attacks against the server

Sensitive credentials exposed in plaintext in Mattermost support packets

Mattermost versions 9.9.x <= 9.9.0, 9.5.x <= 9.5.6, 9.7.x <= 9.7.5, 9.8.x <= 9.8.1 fail to properly safeguard an error handling which allows a malicious remote to permanently…

DoS in Calls plugin via malformed msgpack in websocket request.

Insufficient server-side validation of board member role fields permits privilege escalation

Mattermost Jira plugin user spoofing enables Jira request forgery.

CSRF Protection Bypass Allows Updating a User's Authentication Method

Mattermost iOS app fails to properly validate the server certificate while initializing the TLS connection allowing a network attacker to intercept the WebSockets connection

Mattermost Desktop App fails to restrict the allow list of domains which NTLM credentials are passed

CVE-2026-6961: Path traversal via unsanitized FileInfo.Name in Mattermost federation sync

Mattermost Calls plugin exposes TURN server credentials in plaintext in support packets

Unauthenticated WebSocket binary frame causes denial of service in Mattermost Server

Missing request body size limits on Zoom plugin HTTP endpoints

DoS via URL Previews Rendering Malicious SVGs

DoS attack via login attempts with multi-megabyte passwords

Lack of MFA enforcement in WebSocket connections

Mattermost fails to limit the amount of data extracted from compressed archives during board import in Mattermost Boards allowing an attacker to consume excessive resources,…

Mattermost fails to properly limit the characters allowed in different fields of a block in Mattermost Boards allowing a attacker to consume excessive resources, possibly leading…

Mattermost fails to sanitize post metadata during audit logging resulting in permalinks contents being logged

Mattermost Sever fails to redact the DB username and password before emitting an application log during server initialization

Mattermost 6.0.2 and earlier fails to sufficiently sanitize user's password in audit logs when user creation fails

An issue was discovered in Mattermost Mobile Apps before 1.31.2 on iOS

Mattermost: Delegated admins could patch protected default system roles

Mattermost versions 9.9.x <= 9.9.1, 9.5.x <= 9.5.7, 9.10.x <= 9.10.0 and 9.8.x <= 9.8.2 fail to restrict which roles can promote a user as system admin which allows a System Role…

Mattermost SAML RelayState forgery allows unauthorized team membership

Playbooks run owner channel membership permission bypass

Improper file ownership validation in the Boards API allows unauthorised file access

Mattermost Agents plugin logs unsanitized OpenAI API keys on authentication errors

Admin RCE via Malicious Plugin Upload on CI Test Instances

Unbounded memory consumption during PDF text extraction

Mattermost allows authenticated users to trigger excessive memory allocation via crafted msgpack binary WebSocket frames

Insufficient length validation when parsing Zoom chat transcriptions

Mattermost local image proxy allows server memory exhaustion via unbounded image response buffering

Mattermost leaks interactive-message integration secrets to non-admin users via post-deletion events and thread reads

Mattermost guest account privilege escalation via member roles API

Outgoing OAuth connection client secret exposure during connection validation

Mattermost server missing request body size limit on plugin routes allows denial of service by an authenticated user

Data Retention Teams Endpoint Leaks Private Team Invite ID

Missing property field ownership validation in Playbooks run property update endpoint