MA
Product
Mattermost
323
CVEs
0
On KEV
9.9
Max CVSS
23
New 30D
Severity mix
Critical 8High 35Medium 243Low 37
Watch
Add Mattermost to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2026-0999 | 4.3 | Feb 16 | Authentication bypass via userID login when email and username login are disabled Affected: 11.1.0 through 11.1.2; 10.11.0 through 10.11.9; 11.2.0 through 11.2.1 |
| CVE-2026-22892 | 4.3 | Feb 13 | Insufficient Authorization in Mattermost Jira Plugin Allows Unauthorized Access to Post Attachments Affected: 11.1.0 through 11.1.2; 10.11.0 through 10.11.9; 11.2.0 through 11.2.1 |
| CVE-2025-13767 | 4.3 | Dec 24 | Unauthorized Read Access to Private Channel Posts via Mattermost Jira Plugin Affected: 11.1.0 through 11.1.0; 11.0.0 through 11.0.5; 10.12.0 through 10.12.3; 10.11.0 through 10.11.7 |
| CVE-2025-62190 | 4.3 | Dec 17 | CSRF Allows Call Initiation and Message Delivery Affected: 11.0.0 through 11.0.4; 10.12.0 through 10.12.2; 10.11.0 through 10.11.6 |
| CVE-2025-13870 | 4.3 | Dec 2 | Unauthorized access and subscription vulnerability in Boards Affected: 10.11.0 through 10.11.4; 10.5.0 through 10.5.12 |
| CVE-2025-12756 | 4.3 | Dec 1 | Insecure Direct Object Reference in Mattermost Boards Plugin Enables Unauthorised Comment Deletion Affected: 11.0.0 through 11.0.2; 10.12.0 through 10.12.1; 10.11.0 through 10.11.4; 10.5.0 through 10.5.12 |
| CVE-2025-12559 | 4.3 | Nov 27 | Information Disclosure in Common Teams API Affected: 11.0.0 through 11.0.2; 10.12.0 through 10.12.1; 10.11.0 through 10.11.4; 10.5.0 through 10.5.12 |
| CVE-2025-41436 | 4.3 | Nov 14 | Unauthorized access to archived channel content via threads interface Affected: <11.0 through <11.0 |
| CVE-2025-11776 | 4.3 | Nov 14 | Guest user can discover archived public channels Affected: <11 through <11 |
| CVE-2025-11777 | 4.3 | Nov 13 | Cross-team channel membership access Affected: 10.11.0 through 10.11.3; 10.5.0 through 10.5.11 |
| CVE-2025-10545 | 4.3 | Oct 16 | Guest user can add unauthorized team users to private channels Affected: 10.5.0 through 10.5.10; 10.11.0 through 10.11.2 |
| CVE-2025-41443 | 4.3 | Oct 16 | Guest user can discover active public channels Affected: 10.5.0 through 10.5.12; 10.11.0 through 10.11.2 |
| CVE-2025-9078 | 4.3 | Sep 15 | Weak cache keys lead to post IDOR and link preview poisoning Affected: 10.8.0 through 10.8.3; 10.5.0 through 10.5.8; 9.11.0 through 9.11.17; 10.10.0 through 10.10.1; 10.9.0 through 10.9.3 |
| CVE-2025-6465 | 4.3 | Aug 21 | Path traversal in image upload with preview overwrite Affected: 10.8.0 through 10.8.3; 10.5.0 through 10.5.8; 10.10.0; 10.9.0 through 10.9.3 |
| CVE-2025-47870 | 4.3 | Aug 21 | Team invite ID leaked to team admin with no member invite privileges Affected: 10.8.0 through 10.8.3; 10.5.0 through 10.5.8; 9.11.0 through 9.11.17; 10.9.0 through 10.9.2 |
| CVE-2025-49810 | 4.3 | Aug 21 | Thread summarization allows persistent access to channel Affected: 10.5.0 through 10.5.8 |
| CVE-2025-3228 | 4.3 | Jun 20 | Unauthorized Guest user access to Playbook Affected: 10.5.0 through 10.5.5; 9.11.0 through 9.11.15; 10.8.0; 10.7.0 through 10.7.2; 10.6.0 through 10.6.5 |
| CVE-2025-3227 | 4.3 | Jun 20 | Unauthorized channel member management through playbook runs Affected: 10.5.0 through 10.5.5; 9.11.0 through 9.11.15; 10.8.0; 10.7.0 through 10.7.2; 10.6.0 through 10.6.5 |
| CVE-2025-4128 | 4.3 | Jun 11 | Mattermost Guest User Information Disclosure Vulnerability Affected: 10.5.0 through 10.5.4; 9.11.0 through 9.11.13 |
| CVE-2025-3611 | 4.3 | May 30 | Improper Access Control in Mattermost allows System Managers to view team details despite role restrictions Affected: 10.7.0; 10.5.0 through 10.5.3; 9.11.0 through 9.11.12 |
| CVE-2025-2527 | 4.3 | May 15 | Improper access control to group information Affected: 10.5.0 through 10.5.2; 9.11.0 through 9.11.11 |
| CVE-2025-3446 | 4.3 | May 15 | Members Without Guest Invite Permissions Can Add Guests to Teams Affected: 10.6.0 through 10.6.1; 10.5.0 through 10.5.2; 10.4.0 through 10.4.4; 9.11.0 through 9.11.11 |
| CVE-2024-43813 | 4.3 | Aug 22 | Mattermost versions 9.5.x <= 9.5.7, 9.10.x <= 9.10.0 fail to enforce proper access controls which allows any authenticated user, including guests, to mark any channel inside any… Affected: 9.5.0 before 9.5.8; 9.10.0 before 9.10.1 |
| CVE-2024-29977 | 4.3 | Aug 1 | Mattermost versions 9.9.x <= 9.9.0, 9.5.x <= 9.5.6 fail to properly validate synced reactions, when shared channels are enabled, which allows a malicious remote to create… Affected: 9.5.0 before 9.5.7; 9.9.0 |
| CVE-2023-6202 | 4.3 | Nov 27 | Mattermost fails to perform proper authorization in the /plugins/focalboard/api/v2/users endpoint allowing an attacker who is a guest user and knows the ID of another user to get… Affected: through 7.8.12; 8.0.0 through 8.1.3 |
| CVE-2023-45223 | 4.3 | Nov 27 | Mattermost fails to properly validate the "Show Full Name" option in a few endpoints in Mattermost Boards, allowing a member to get the full name of another user even if the Show… Affected: through 7.8.12; 8.0.0 through 8.1.3 |
| CVE-2023-43754 | 4.3 | Nov 27 | Mattermost fails to check whether the “Allow users to view archived channels” setting is enabled during permalink previews display, allowing members to view permalink previews… Affected: through 7.8.12; 8.0.0 through 8.1.3; 9.0.0 through 9.0.1; 9.1.0 |
| CVE-2023-47865 | 4.3 | Nov 27 | Mattermost fails to check if hardened mode is enabled when overriding the username and/or the icon when posting a post Affected: through 7.8.12; 8.0.0 through 8.1.3 |
| CVE-2023-5967 | 4.3 | Nov 6 | Mattermost fails to properly validate requests to the Calls plugin, allowing an attacker sending a request without a User Agent header to cause a panic and crash the Calls plugin Affected: through 7.8.11; 8.0.0 through 8.0.3; 8.1.0 through 8.1.2 |
| CVE-2023-5522 | 4.3 | Oct 17 | Mattermost Mobile fails to limit the maximum number of Markdown elements in a post allowing an attacker to send a post with hundreds of emojis to a channel and freeze the mobile… Affected: before 2.8.0; before 2.8.0 |
| CVE-2023-5160 | 4.3 | Oct 2 | Mattermost fails to check the Show Full Name option at the /api/v4/teams/TEAM_ID/top/team_members endpoint allowing a member to get the full name of another user even if the Show… Affected: 7.0.0 before 7.8.10; 8.0.0 before 8.1.1 |
| CVE-2023-5194 | 4.3 | Sep 29 | Mattermost fails to properly validate permissions when demoting and deactivating a user allowing for a system/user manager to demote / deactivate another manager Affected: 7.0.0 before 7.8.10; 8.0.0 before 8.1.1 |
| CVE-2023-4105 | 4.3 | Aug 11 | Mattermost fails to delete the attachments when deleting a message in a thread allowing a simple user to still be able to access and download the attachment of a deleted message Affected: 7.8.0 before 7.8.8; 7.9.0 before 7.9.6; 7.10.0 before 7.10.4 |
| CVE-2023-2785 | 4.3 | Jun 16 | Mattermost fails to properly truncate the postgres error log message of a search query failure allowing an attacker to cause the creation of large log files which can result in… Affected: 7.1.0 through 7.1.9; 7.8.0 through 7.8.4; 7.9.0 through 7.9.3; 7.10.0 |
| CVE-2023-2791 | 4.3 | Jun 16 | When creating a playbook run via the /dialog API, Mattermost fails to validate all parameters, allowing an authenticated attacker to edit an arbitrary channel post Affected: 7.7.0 through 7.7.3; 7.8.0 through 7.8.2; 7.9.0 through 7.9.1; 7.10.0 |
| CVE-2023-2786 | 4.3 | Jun 16 | Mattermost fails to properly check the permissions when executing commands allowing a member with no permissions to post a message in a channel to actually post it by executing… Affected: 7.1.0 through 7.1.9; 7.8.0 through 7.8.4; 7.9.0 through 7.9.3; 7.10.0 |
| CVE-2023-2783 | 4.3 | Jun 16 | Mattermost Apps Framework fails to verify that a secret provided in the incoming webhook request allowing an attacker to modify the contents of the post sent by the Apps Affected: 7.8.0 through 7.8.4; 7.9.0 through 7.9.3; 7.10.0 |
| CVE-2023-1562 | 4.3 | Mar 22 | Mattermost fails to check the "Show Full Name" setting when rendering the result for the /plugins/focalboard/api/v2/users API call, allowing an attacker to learn the full name of… Affected: before 7.5.0 |
| CVE-2022-2408 | 4.3 | Jul 14 | The Guest account feature in Mattermost version 6.7.0 and earlier fails to properly restrict the permissions, which allows a guest user to fetch a list of all public channels in… Affected: before 6.3.8; 6.4.0 through 6.5.1; 6.6.0; 6.6.1; 6.7.0 |
| CVE-2026-15754 | 4.2 | Aug 17 | Missing per-channel team-scope check in ABAC access control policy unassign allows cross-team policy removal Affected: 11.7.0 through 11.7.6; 11.8.0 through 11.8.3 |
| CVE-2025-2571 | 4.2 | May 30 | Google OAuth Authentication Bypass for Converted Bot Accounts Affected: 10.7.0; 10.6.0 through 10.6.2; 10.5.0 through 10.5.3; 9.11.0 through 9.11.12 |
| CVE-2025-64641 | 4.1 | Dec 24 | Mattermost Jira plugin crafted action leaks Jira issue details Affected: 11.1.0 through 11.1.0; 11.0.0 through 11.0.5; 10.12.0 through 10.12.3; 10.11.0 through 10.11.7 |
| CVE-2025-4573 | 4.1 | Jun 11 | LDAP Injection in Mattermost Enterprise Edition When Using Active Directory Affected: 10.7.0 through 10.7.1; 10.6.0 through 10.6.3; 10.5.0 through 10.5.4; 9.11.0 through 9.11.13 |