MA
Product
Mattermost
379
CVEs
0
On KEV
9.9
Max CVSS
23
New 30D
Severity mix
Critical 8High 47Medium 287Low 41
Watch
Add Mattermost to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2025-4128 | 4.3 | Jun 11 | Mattermost Guest User Information Disclosure Vulnerability Affected: 10.5.0 through 10.5.4; 9.11.0 through 9.11.13 |
| CVE-2025-3611 | 4.3 | May 30 | Improper Access Control in Mattermost allows System Managers to view team details despite role restrictions Affected: 10.7.0; 10.5.0 through 10.5.3; 9.11.0 through 9.11.12 |
| CVE-2025-2527 | 4.3 | May 15 | Improper access control to group information Affected: 10.5.0 through 10.5.2; 9.11.0 through 9.11.11 |
| CVE-2025-3446 | 4.3 | May 15 | Members Without Guest Invite Permissions Can Add Guests to Teams Affected: 10.6.0 through 10.6.1; 10.5.0 through 10.5.2; 10.4.0 through 10.4.4; 9.11.0 through 9.11.11 |
| CVE-2025-41423 | 4.3 | Apr 24 | Unauthorized Playbooks Post Deletion in Mattermost Playbooks Plugin Affected: 10.4.0 through 10.4.2; 10.5.0; 9.11.0 through 9.11.10 |
| CVE-2025-2564 | 4.3 | Apr 16 | Unauthorized View Access to Archived Channel Member Info Affected: 10.5.0 through 10.5.1; 10.4.0 through 10.4.3; 9.11.0 through 9.11.9 |
| CVE-2025-27571 | 4.3 | Apr 16 | Channel metadata visible in archived channels despite configuration setting Affected: 10.5.0 through 10.5.1; 10.4.0 through 10.4.3; 9.11.0 through 9.11.9 |
| CVE-2025-24839 | 4.3 | Apr 16 | Unauthorized AI bot activation via Wrangler plugin Affected: 10.5.0 through 10.5.1; 10.4.0 through 10.4.3; 9.11.0 through 9.11.9 |
| CVE-2025-2424 | 4.3 | Apr 14 | Leaked Metadata of Deleted Files via Bookmark Creation Affected: 10.5.0 through 10.5.1; 9.11.0 through 9.11.9 |
| CVE-2025-24920 | 4.3 | Mar 21 | Unauthorized Bookmark Creation and Modification in Archived Channels Affected: 10.4.0 through 10.4.2; 10.3.0 through 10.3.3; 9.11.0 through 9.11.8; 10.5.0 |
| CVE-2025-27933 | 4.3 | Mar 21 | Unauthorized Private-to-Public Channel Conversion Affected: 10.4.0 through 10.4.2; 10.3.0 through 10.3.3; 9.11.0 through 9.11.8 |
| CVE-2025-1472 | 4.3 | Mar 19 | Unauthorized View Access to Site Statistics and Team Statistics Affected: 9.11.0 through 9.11.8 |
| CVE-2025-24526 | 4.3 | Feb 24 | Channel export permitted on archived channel when viewing archived channels is disabled Affected: 10.1.0 through 10.1.3; 10.4.0 through 10.4.1; 9.11.0 through 9.11.7; 10.3.0 through 10.3.2; 10.2.0 through 10.2.2 |
| CVE-2025-0476 | 4.3 | Jan 15 | Mobile crash via file with specially crafted filename Affected: through 2.22.0 |
| CVE-2024-12247 | 4.3 | Dec 5 | Improper propagation of permission scheme updates across cluster nodes Affected: 9.7.0 through 9.7.5; 9.8.0 through 9.8.2; 9.9.0 through 9.9.2 |
| CVE-2024-52032 | 4.3 | Nov 9 | Private channel names leaking when Elasticsearch is enabled Affected: 10.0.0; 9.11.0 through 9.11.2 |
| CVE-2024-42000 | 4.3 | Nov 9 | Unauthorized Access to view channels' details Affected: 9.10.0 through 9.10.2; 9.11.0 through 9.11.1; 9.5.0 through 9.5.9; 10.0.0 |
| CVE-2024-50052 | 4.3 | Oct 29 | Arbitrary post deletion via Playbooks /ignore-thread endpoint Affected: 9.10.0 through 9.10.2; 9.11.0 through 9.11.1; 9.5.0 through 9.5.9 |
| CVE-2024-10241 | 4.3 | Oct 29 | Private channel names leaked with Ctrl+K when ElasticSearch is enabled Affected: 9.5.0 through 9.5.9 |
| CVE-2024-9155 | 4.3 | Sep 26 | Insufficient Authorization On Unlinked Channel Files Affected: 9.10.0 through 9.10.1; 9.9.0 through 9.9.2; 9.5.0 through 9.5.8 |
| CVE-2024-47145 | 4.3 | Sep 26 | Unauthorized access on archived channels via file links Affected: 9.5.0 through 9.5.8 |
| CVE-2024-43813 | 4.3 | Aug 22 | Mattermost versions 9.5.x <= 9.5.7, 9.10.x <= 9.10.0 fail to enforce proper access controls which allows any authenticated user, including guests, to mark any channel inside any… Affected: 9.5.0 before 9.5.8; 9.10.0 before 9.10.1 |
| CVE-2024-29977 | 4.3 | Aug 1 | Mattermost versions 9.9.x <= 9.9.0, 9.5.x <= 9.5.6 fail to properly validate synced reactions, when shared channels are enabled, which allows a malicious remote to create… Affected: 9.5.0 before 9.5.7; 9.9.0 |
| CVE-2023-6202 | 4.3 | Nov 27 | Mattermost fails to perform proper authorization in the /plugins/focalboard/api/v2/users endpoint allowing an attacker who is a guest user and knows the ID of another user to get… Affected: through 7.8.12; 8.0.0 through 8.1.3 |
| CVE-2023-45223 | 4.3 | Nov 27 | Mattermost fails to properly validate the "Show Full Name" option in a few endpoints in Mattermost Boards, allowing a member to get the full name of another user even if the Show… Affected: through 7.8.12; 8.0.0 through 8.1.3 |
| CVE-2023-43754 | 4.3 | Nov 27 | Mattermost fails to check whether the “Allow users to view archived channels” setting is enabled during permalink previews display, allowing members to view permalink previews… Affected: through 7.8.12; 8.0.0 through 8.1.3; 9.0.0 through 9.0.1; 9.1.0 |
| CVE-2023-47865 | 4.3 | Nov 27 | Mattermost fails to check if hardened mode is enabled when overriding the username and/or the icon when posting a post Affected: through 7.8.12; 8.0.0 through 8.1.3 |
| CVE-2023-5967 | 4.3 | Nov 6 | Mattermost fails to properly validate requests to the Calls plugin, allowing an attacker sending a request without a User Agent header to cause a panic and crash the Calls plugin Affected: through 7.8.11; 8.0.0 through 8.0.3; 8.1.0 through 8.1.2 |
| CVE-2023-5522 | 4.3 | Oct 17 | Mattermost Mobile fails to limit the maximum number of Markdown elements in a post allowing an attacker to send a post with hundreds of emojis to a channel and freeze the mobile… Affected: before 2.8.0; before 2.8.0 |
| CVE-2023-5160 | 4.3 | Oct 2 | Mattermost fails to check the Show Full Name option at the /api/v4/teams/TEAM_ID/top/team_members endpoint allowing a member to get the full name of another user even if the Show… Affected: 7.0.0 before 7.8.10; 8.0.0 before 8.1.1 |
| CVE-2023-5194 | 4.3 | Sep 29 | Mattermost fails to properly validate permissions when demoting and deactivating a user allowing for a system/user manager to demote / deactivate another manager Affected: 7.0.0 before 7.8.10; 8.0.0 before 8.1.1 |
| CVE-2023-4105 | 4.3 | Aug 11 | Mattermost fails to delete the attachments when deleting a message in a thread allowing a simple user to still be able to access and download the attachment of a deleted message Affected: 7.8.0 before 7.8.8; 7.9.0 before 7.9.6; 7.10.0 before 7.10.4 |
| CVE-2023-2785 | 4.3 | Jun 16 | Mattermost fails to properly truncate the postgres error log message of a search query failure allowing an attacker to cause the creation of large log files which can result in… Affected: 7.1.0 through 7.1.9; 7.8.0 through 7.8.4; 7.9.0 through 7.9.3; 7.10.0 |
| CVE-2023-2791 | 4.3 | Jun 16 | When creating a playbook run via the /dialog API, Mattermost fails to validate all parameters, allowing an authenticated attacker to edit an arbitrary channel post Affected: 7.7.0 through 7.7.3; 7.8.0 through 7.8.2; 7.9.0 through 7.9.1; 7.10.0 |
| CVE-2023-2786 | 4.3 | Jun 16 | Mattermost fails to properly check the permissions when executing commands allowing a member with no permissions to post a message in a channel to actually post it by executing… Affected: 7.1.0 through 7.1.9; 7.8.0 through 7.8.4; 7.9.0 through 7.9.3; 7.10.0 |
| CVE-2023-2783 | 4.3 | Jun 16 | Mattermost Apps Framework fails to verify that a secret provided in the incoming webhook request allowing an attacker to modify the contents of the post sent by the Apps Affected: 7.8.0 through 7.8.4; 7.9.0 through 7.9.3; 7.10.0 |
| CVE-2023-1562 | 4.3 | Mar 22 | Mattermost fails to check the "Show Full Name" setting when rendering the result for the /plugins/focalboard/api/v2/users API call, allowing an attacker to learn the full name of… Affected: before 7.5.0 |
| CVE-2022-2408 | 4.3 | Jul 14 | The Guest account feature in Mattermost version 6.7.0 and earlier fails to properly restrict the permissions, which allows a guest user to fetch a list of all public channels in… Affected: before 6.3.8; 6.4.0 through 6.5.1; 6.6.0; 6.6.1; 6.7.0 |
| CVE-2026-15754 | 4.2 | Aug 17 | Missing per-channel team-scope check in ABAC access control policy unassign allows cross-team policy removal Affected: 11.7.0 through 11.7.6; 11.8.0 through 11.8.3 |
| CVE-2025-2571 | 4.2 | May 30 | Google OAuth Authentication Bypass for Converted Bot Accounts Affected: 10.7.0; 10.6.0 through 10.6.2; 10.5.0 through 10.5.3; 9.11.0 through 9.11.12 |
| CVE-2025-64641 | 4.1 | Dec 24 | Mattermost Jira plugin crafted action leaks Jira issue details Affected: 11.1.0 through 11.1.0; 11.0.0 through 11.0.5; 10.12.0 through 10.12.3; 10.11.0 through 10.11.7 |
| CVE-2025-4573 | 4.1 | Jun 11 | LDAP Injection in Mattermost Enterprise Edition When Using Active Directory Affected: 10.7.0 through 10.7.1; 10.6.0 through 10.6.3; 10.5.0 through 10.5.4; 9.11.0 through 9.11.13 |
| CVE-2025-13326 | 3.9 | Dec 17 | Mattermost Desktop App fails to enable Hardened Runtime when packaged for Mac App Store Affected: through 6.0.0 |
| CVE-2026-93846 New | 3.8 | Oct 26 | Team admin can escalate a team member's permissions via the team member roles endpoint Affected: 11.7.0 through 11.7.10 |
| CVE-2026-9820 | 3.8 | Jul 13 | Mattermost schemes teams endpoint exposes private team invite IDs Affected: 11.7.0 through 11.7.2; 10.11.0 through 10.11.19 |
| CVE-2026-8823 | 3.8 | Jun 22 | User Manager can demote bot accounts to guest without bot-management permission Affected: 11.7.0 through 11.7.0; 10.11.0 through 10.11.17 |
| CVE-2026-8074 | 3.8 | Jun 22 | Improper Permission Check Allows User Manager to Deactivate Bot Accounts Affected: 11.7.0 through 11.7.0; 10.11.0 through 10.11.17 |
| CVE-2026-6334 | 3.8 | May 18 | OAuth authorization code client binding not enforced during token redemption in Mattermost Affected: 11.5.0 through 11.5.1; 10.11.0 through 10.11.13 |
| CVE-2026-26230 | 3.8 | Mar 16 | Team Admin Privilege Escalation to Demote Members to Guest Affected: 10.11.0 through 10.11.10 |
| CVE-2025-53971 | 3.8 | Aug 21 | Channel and Team Membership APIs inadvertently allow loss of Member privileges. Affected: 10.5.0 through 10.5.8; 9.11.0 through 9.11.17 |