MA
Product
Mattermost
370
CVEs
0
On KEV
9.9
Max CVSS
23
New 30D
Severity mix
Critical 8High 46Medium 279Low 41
Watch
Add Mattermost to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2026-6341 | 4.3 | May 18 | Incomplete group locking implementation Affected: through 11.1.5; through 10.13.11; through 11.3.4 |
| CVE-2026-6342 | 4.3 | May 18 | Group prefix matching bypass for subscriptions Affected: through 11.1.5; through 10.13.11; through 11.3.4 |
| CVE-2026-4273 | 4.3 | May 18 | Insufficient token rotation validation in remote cluster invite confirmation Affected: 11.5.0 through 11.5.1; 10.11.0 through 10.11.13 |
| CVE-2026-3637 | 4.3 | May 18 | Mattermost fails to enforce create_post permission when editing posts Affected: 11.5.0 through 11.5.1; 10.11.0 through 10.11.13; 11.4.0 through 11.4.3 |
| CVE-2026-28759 | 4.3 | May 18 | Insufficient authorization in shared channel membership sync allows remote cluster to remove users from arbitrary channels Affected: 11.5.0 through 11.5.1; 10.11.0 through 10.11.13; 11.4.0 through 11.4.3 |
| CVE-2026-4053 | 4.3 | May 15 | post edit time limit is not enforced on some post update operations Affected: 11.5.0 through 11.5.1; 10.11.0 through 10.11.13 |
| CVE-2026-3115 | 4.3 | Mar 26 | Guest users can view group member IDs without respecting view restrictions Affected: 11.2.0 through 11.2.2; 10.11.0 through 10.11.10; 11.4.0 through 11.4.0; 11.3.0 through 11.3.1 |
| CVE-2026-1629 | 4.3 | Mar 16 | Permalink Preview Information Disclosure After Permission Revocation Affected: 10.11.0 through 10.11.10 |
| CVE-2026-26304 | 4.3 | Mar 16 | Permission Bypass in Playbook Run Creation Affected: 11.3.0 through 11.3.0; 11.2.0 through 11.2.2 |
| CVE-2026-24692 | 4.3 | Mar 16 | Guest users can bypass read permissions via search API Affected: 11.3.0 through 11.3.0; 11.2.0 through 11.2.2; 10.11.0 through 10.11.10 |
| CVE-2026-2455 | 4.3 | Mar 16 | SSRF bypass via IPv4-mapped IPv6 literals Affected: 11.3.0 through 11.3.0; 11.2.0 through 11.2.2; 10.11.0 through 10.11.10 |
| CVE-2026-21386 | 4.3 | Mar 16 | Private channel enumeration via /mute slash command Affected: 11.3.0 through 11.3.0; 11.2.0 through 11.2.2; 10.11.0 through 10.11.10 |
| CVE-2026-25780 | 4.3 | Mar 16 | Memory Exhaustion via Malformed DOC File Upload Affected: 11.3.0 through 11.3.0; 11.2.0 through 11.2.2; 10.11.0 through 10.11.10 |
| CVE-2026-4265 | 4.3 | Mar 16 | Guest user can upload files without permission across teams Affected: 11.3.0 through 11.3.0; 11.2.0 through 11.2.2; 10.11.0 through 10.11.10 |
| CVE-2026-25783 | 4.3 | Mar 16 | Denial of service via malformed User-Agent header in getBrowserVersion Affected: 11.3.0 through 11.3.0; 11.2.0 through 11.2.2; 10.11.0 through 10.11.10 |
| CVE-2026-2578 | 4.3 | Mar 16 | Information Disclosure via WebSocket Event When Deleting Unrevealed Burn on Read Posts Affected: 11.3.0 through 11.3.0 |
| CVE-2026-26246 | 4.3 | Mar 16 | Memory Exhaustion via Malformed PSD File Upload Affected: 11.3.0 through 11.3.0; 11.2.0 through 11.2.2; 10.11.0 through 10.11.10 |
| CVE-2026-2458 | 4.3 | Mar 16 | Unauthorized channel enumeration in private teams after member removal Affected: 11.3.0 through 11.3.0; 11.2.0 through 11.2.2; 10.11.0 through 10.11.10 |
| CVE-2026-2457 | 4.3 | Mar 16 | WebSocket Message Spoofing via Permalink Embed Manipulation Affected: 11.3.0 through 11.3.0; 11.2.0 through 11.2.2; 10.11.0 through 10.11.10 |
| CVE-2026-2461 | 4.3 | Mar 16 | Missing authorization check allows unauthorized modification of other users' comments on a board Affected: through 11.0.3; through 11.2.2; through 10.10.11 |
| CVE-2026-2463 | 4.3 | Mar 16 | Unauthorized access to invite ID during team creation Affected: 11.3.0 through 11.3.0; 11.2.0 through 11.2.2; 10.11.0 through 10.11.10 |
| CVE-2026-2476 | 4.3 | Mar 16 | MS Teams plugin sensitive config values not properly masked in support packets Affected: through 2.0.3 |
| CVE-2025-14350 | 4.3 | Feb 16 | Information disclosure via channel mentions in posts Affected: 11.1.0 through 11.1.2; 10.11.0 through 10.11.9; 11.2.0 through 11.2.1 |
| CVE-2026-0997 | 4.3 | Feb 16 | Mattermost Zoom Plugin channel preference API lacks authorization checks Affected: 11.1.0 through 11.1.2; 10.11.0 through 10.11.9; 11.2.0 through 11.2.1 |
| CVE-2026-0998 | 4.3 | Feb 16 | Mattermost Zoom Plugin allows unauthorized meeting creation and post modification via insufficient API access controls Affected: 11.1.0 through 11.1.2; 10.11.0 through 10.11.9; 11.2.0 through 11.2.1 |
| CVE-2026-0999 | 4.3 | Feb 16 | Authentication bypass via userID login when email and username login are disabled Affected: 11.1.0 through 11.1.2; 10.11.0 through 10.11.9; 11.2.0 through 11.2.1 |
| CVE-2026-22892 | 4.3 | Feb 13 | Insufficient Authorization in Mattermost Jira Plugin Allows Unauthorized Access to Post Attachments Affected: 11.1.0 through 11.1.2; 10.11.0 through 10.11.9; 11.2.0 through 11.2.1 |
| CVE-2025-13767 | 4.3 | Dec 24 | Unauthorized Read Access to Private Channel Posts via Mattermost Jira Plugin Affected: 11.1.0 through 11.1.0; 11.0.0 through 11.0.5; 10.12.0 through 10.12.3; 10.11.0 through 10.11.7 |
| CVE-2025-62190 | 4.3 | Dec 17 | CSRF Allows Call Initiation and Message Delivery Affected: 11.0.0 through 11.0.4; 10.12.0 through 10.12.2; 10.11.0 through 10.11.6 |
| CVE-2025-13870 | 4.3 | Dec 2 | Unauthorized access and subscription vulnerability in Boards Affected: 10.11.0 through 10.11.4; 10.5.0 through 10.5.12 |
| CVE-2025-12756 | 4.3 | Dec 1 | Insecure Direct Object Reference in Mattermost Boards Plugin Enables Unauthorised Comment Deletion Affected: 11.0.0 through 11.0.2; 10.12.0 through 10.12.1; 10.11.0 through 10.11.4; 10.5.0 through 10.5.12 |
| CVE-2025-12559 | 4.3 | Nov 27 | Information Disclosure in Common Teams API Affected: 11.0.0 through 11.0.2; 10.12.0 through 10.12.1; 10.11.0 through 10.11.4; 10.5.0 through 10.5.12 |
| CVE-2025-41436 | 4.3 | Nov 14 | Unauthorized access to archived channel content via threads interface Affected: <11.0 through <11.0 |
| CVE-2025-11776 | 4.3 | Nov 14 | Guest user can discover archived public channels Affected: <11 through <11 |
| CVE-2025-11777 | 4.3 | Nov 13 | Cross-team channel membership access Affected: 10.11.0 through 10.11.3; 10.5.0 through 10.5.11 |
| CVE-2025-10545 | 4.3 | Oct 16 | Guest user can add unauthorized team users to private channels Affected: 10.5.0 through 10.5.10; 10.11.0 through 10.11.2 |
| CVE-2025-41443 | 4.3 | Oct 16 | Guest user can discover active public channels Affected: 10.5.0 through 10.5.12; 10.11.0 through 10.11.2 |
| CVE-2025-9078 | 4.3 | Sep 15 | Weak cache keys lead to post IDOR and link preview poisoning Affected: 10.8.0 through 10.8.3; 10.5.0 through 10.5.8; 9.11.0 through 9.11.17; 10.10.0 through 10.10.1; 10.9.0 through 10.9.3 |
| CVE-2025-6465 | 4.3 | Aug 21 | Path traversal in image upload with preview overwrite Affected: 10.8.0 through 10.8.3; 10.5.0 through 10.5.8; 10.10.0; 10.9.0 through 10.9.3 |
| CVE-2025-47870 | 4.3 | Aug 21 | Team invite ID leaked to team admin with no member invite privileges Affected: 10.8.0 through 10.8.3; 10.5.0 through 10.5.8; 9.11.0 through 9.11.17; 10.9.0 through 10.9.2 |
| CVE-2025-49810 | 4.3 | Aug 21 | Thread summarization allows persistent access to channel Affected: 10.5.0 through 10.5.8 |
| CVE-2025-3228 | 4.3 | Jun 20 | Unauthorized Guest user access to Playbook Affected: 10.5.0 through 10.5.5; 9.11.0 through 9.11.15; 10.8.0; 10.7.0 through 10.7.2; 10.6.0 through 10.6.5 |
| CVE-2025-3227 | 4.3 | Jun 20 | Unauthorized channel member management through playbook runs Affected: 10.5.0 through 10.5.5; 9.11.0 through 9.11.15; 10.8.0; 10.7.0 through 10.7.2; 10.6.0 through 10.6.5 |
| CVE-2025-4128 | 4.3 | Jun 11 | Mattermost Guest User Information Disclosure Vulnerability Affected: 10.5.0 through 10.5.4; 9.11.0 through 9.11.13 |
| CVE-2025-3611 | 4.3 | May 30 | Improper Access Control in Mattermost allows System Managers to view team details despite role restrictions Affected: 10.7.0; 10.5.0 through 10.5.3; 9.11.0 through 9.11.12 |
| CVE-2025-2527 | 4.3 | May 15 | Improper access control to group information Affected: 10.5.0 through 10.5.2; 9.11.0 through 9.11.11 |
| CVE-2025-3446 | 4.3 | May 15 | Members Without Guest Invite Permissions Can Add Guests to Teams Affected: 10.6.0 through 10.6.1; 10.5.0 through 10.5.2; 10.4.0 through 10.4.4; 9.11.0 through 9.11.11 |
| CVE-2025-41423 | 4.3 | Apr 24 | Unauthorized Playbooks Post Deletion in Mattermost Playbooks Plugin Affected: 10.4.0 through 10.4.2; 10.5.0; 9.11.0 through 9.11.10 |
| CVE-2025-2564 | 4.3 | Apr 16 | Unauthorized View Access to Archived Channel Member Info Affected: 10.5.0 through 10.5.1; 10.4.0 through 10.4.3; 9.11.0 through 9.11.9 |
| CVE-2025-27571 | 4.3 | Apr 16 | Channel metadata visible in archived channels despite configuration setting Affected: 10.5.0 through 10.5.1; 10.4.0 through 10.4.3; 9.11.0 through 9.11.9 |