MA
Product
Mattermost
294
CVEs
0
On KEV
9.9
Max CVSS
22
New 30D
Severity mix
Critical 7High 34Medium 222Low 31
Watch
Add Mattermost to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2026-7387 | 8.8 | Jun 12 | Mattermost group syncable endpoints allow privilege escalation via scheme_admin Affected: 11.6.0 through 11.6.1; 11.5.0 through 11.5.4; 10.11.0 through 10.11.15; 10.11.0 through 10.11.16 |
| CVE-2026-3524 | 8.8 | Apr 6 | Authorization Bypass in Mattermost Legal Hold Plugin Due to Missing Return After Permission Check Affected: through 1.1.4 |
| CVE-2026-3108 | 8.8 | Mar 26 | Terminal Escape Injection in mmctl Report Posts Command Affected: 11.2.0 through 11.2.2; 10.11.0 through 10.11.10; 11.4.0 through 11.4.0; 11.3.0 through 11.3.1 |
| CVE-2024-40886 | 8.8 | Aug 22 | Mattermost versions 9.9.x <= 9.9.1, 9.5.x <= 9.5.7, 9.10.x <= 9.10.0, 9.8.x <= 9.8.2 fail to sanitize user inputs in the frontend that are used for redirection which allows for a… Affected: 9.5.0 before 9.5.8; 9.8.0 before 9.8.3; 9.9.0 before 9.9.2; 9.10.0 before 9.10.1 |
| CVE-2023-7114 | 8.8 | Dec 29 | Mattermost version 2.10.0 and earlier fails to sanitize deeplink paths, which allows an attacker to perform CSRF attacks against the server Affected: before 2.10.1; before 2.10.1 |
| CVE-2026-6346 | 8.7 | May 18 | Sensitive credentials exposed in plaintext in Mattermost support packets Affected: 11.5.0 through 11.5.1; 10.11.0 through 10.11.13; 11.4.0 through 11.4.3 |
| CVE-2024-39832 | 8.7 | Aug 1 | Mattermost versions 9.9.x <= 9.9.0, 9.5.x <= 9.5.6, 9.7.x <= 9.7.5, 9.8.x <= 9.8.1 fail to properly safeguard an error handling which allows a malicious remote to permanently… Affected: 9.5.0 before 9.5.7; 9.7.0 before 9.7.6; 9.8.0 before 9.8.2; 9.9.0 |
| CVE-2026-2454 | 8.6 | Mar 16 | DoS in Calls plugin via malformed msgpack in websocket request. Affected: 11.3.0 through 11.3.0; 11.2.0 through 11.2.2; 10.11.0 through 10.11.10 |
| CVE-2026-9816 | 8.3 | Aug 17 | Insufficient server-side validation of board member role fields permits privilege escalation Affected: 11.7.0 through 11.7.6; 10.11.0 through 10.11.21; 11.8.0 through 11.8.3 |
| CVE-2025-14273 | 8.3 | Dec 22 | Mattermost Jira plugin user spoofing enables Jira request forgery. Affected: 11.1.0 through 11.1.0; 11.0.0 through 11.0.5; 10.12.0 through 10.12.3; 10.11.0 through 10.11.7 |
| CVE-2026-28741 | 8.1 | Apr 15 | CSRF Protection Bypass Allows Updating a User's Authentication Method Affected: 10.11.0 through 10.11.12; 11.5.0 through 11.5.0; 11.4.0 through 11.4.2; 11.3.0 through 11.3.2 |
| CVE-2025-58073 | 8.1 | Oct 16 | Arbitrary Mattermost Team can be joined by manipulating the OAuth state Affected: 10.11.0 through 10.11.1; 10.10.0 through 10.10.2; 10.5.0 through 10.5.10 |
| CVE-2025-58075 | 8.1 | Oct 16 | Arbitrary Mattermost Team can be joined by manipulating the SAML RelayState Affected: 10.11.0 through 10.11.1; 10.10.0 through 10.10.2; 10.5.0 through 10.5.10 |
| CVE-2023-3615 | 8.1 | Jul 17 | Mattermost iOS app fails to properly validate the server certificate while initializing the TLS connection allowing a network attacker to intercept the WebSockets connection Affected: before 2.5.1 |
| CVE-2026-6517 | 7.7 | Jun 15 | Mattermost Desktop App fails to restrict the allow list of domains which NTLM credentials are passed Affected: through 5.5.13 |
| CVE-2026-6961 | 7.6 | Jun 12 | CVE-2026-6961: Path traversal via unsanitized FileInfo.Name in Mattermost federation sync Affected: 11.6.0 through 11.6.1; 11.5.0 through 11.5.4; 10.11.0 through 10.11.15; 10.11.0 through 10.11.16 |
| CVE-2026-6347 | 7.6 | May 18 | Mattermost Calls plugin exposes TURN server credentials in plaintext in support packets Affected: 11.5.0 through 11.5.1; 10.11.0 through 10.11.13; 11.4.0 through 11.4.3 |
| CVE-2026-5740 | 7.5 | May 22 | Unauthenticated WebSocket binary frame causes denial of service in Mattermost Server Affected: 11.6.0 through 11.6.0; 11.5.0 through 11.5.3; 11.4.0 through 11.4.4; 10.11.0 through 10.11.14 |
| CVE-2026-5308 | 7.5 | May 22 | Missing request body size limits on Zoom plugin HTTP endpoints Affected: 11.6.0 through 11.6.0; 11.5.0 through 11.5.3; 11.4.0 through 11.4.4; 10.11.0 through 10.11.14 |
| CVE-2026-20719 | 7.5 | Mar 25 | DoS via URL Previews Rendering Malicious SVGs Affected: 11.4.0 through 11.4.0; 11.3.0 through 11.3.1; 11.2.0 through 11.2.3; 10.11.0 through 10.11.11 |
| CVE-2026-24458 | 7.5 | Mar 16 | DoS attack via login attempts with multi-megabyte passwords Affected: 11.3.0 through 11.3.0; 11.2.0 through 11.2.2; 10.11.0 through 10.11.10 |
| CVE-2025-55070 | 7.5 | Nov 14 | Lack of MFA enforcement in WebSocket connections Affected: <11 through <11 |
| CVE-2023-48268 | 7.5 | Nov 27 | Mattermost fails to limit the amount of data extracted from compressed archives during board import in Mattermost Boards allowing an attacker to consume excessive resources,… Affected: through 7.8.12; 8.0.0 through 8.1.3; 9.0.0 through 9.0.1; 9.1.0 |
| CVE-2023-40703 | 7.5 | Nov 27 | Mattermost fails to properly limit the characters allowed in different fields of a block in Mattermost Boards allowing a attacker to consume excessive resources, possibly leading… Affected: through 7.8.12; 8.0.0 through 8.1.3; 9.0.0 through 9.0.1; 9.1.0 |
| CVE-2023-4108 | 7.5 | Aug 11 | Mattermost fails to sanitize post metadata during audit logging resulting in permalinks contents being logged Affected: 7.8.0 before 7.8.8; 7.9.0 before 7.9.6; 7.10.0 before 7.10.4 |
| CVE-2023-2514 | 7.5 | May 12 | Mattermost Sever fails to redact the DB username and password before emitting an application log during server initialization Affected: through 7.1.7; 7.7.0 through 7.7.3; 7.8.0 through 7.8.2; 7.9.0 through 7.9.1 |
| CVE-2021-37861 | 7.5 | Dec 9 | Mattermost 6.0.2 and earlier fails to sufficiently sanitize user's password in audit logs when user creation fails Affected: through 6.0.2 |
| CVE-2020-13891 | 7.5 | Jun 26 | An issue was discovered in Mattermost Mobile Apps before 1.31.2 on iOS Affected: before 1.31.2 |
| CVE-2026-6739 | 7.2 | Jun 12 | Mattermost: Delegated admins could patch protected default system roles Affected: 11.6.0 through 11.6.1; 11.5.0 through 11.5.4; 10.11.0 through 10.11.15; 10.11.0 through 10.11.16 |
| CVE-2025-9079 | 7.2 | Sep 19 | Admin RCE via prepackaged plugins by way of misconfigured imports directory Affected: 10.8.0 through 10.8.3; 10.5.0 through 10.5.8; 9.11.0 through 9.11.17; 10.10.0 through 10.10.1; 10.9.0 through 10.9.3 |
| CVE-2024-8071 | 7.2 | Aug 22 | Mattermost versions 9.9.x <= 9.9.1, 9.5.x <= 9.5.7, 9.10.x <= 9.10.0 and 9.8.x <= 9.8.2 fail to restrict which roles can promote a user as system admin which allows a System Role… Affected: 9.5.0 before 9.5.8; 9.8.0 before 9.8.3; 9.9.0 before 9.9.2; 9.10.0 before 9.10.1 |
| CVE-2026-16453 | 7.1 | Oct 16 | Mattermost SAML RelayState forgery allows unauthorized team membership Affected: 11.10.0 through 11.10.0; 11.7.0 through 11.7.9; 11.9.0 through 11.9.1; 11.8.0 through 11.8.5 |
| CVE-2026-8821 | 7.1 | Sep 14 | Playbooks run owner channel membership permission bypass Affected: 11.9.0 through 11.9.0; 11.8.0 through 11.8.4; 11.7.0 through 11.7.7; 10.11.0 through 10.11.22 |
| CVE-2026-3473 | 7.1 | May 22 | Improper file ownership validation in the Boards API allows unauthorised file access Affected: 11.6.0 through 11.6.0; 11.5.0 through 11.5.3; 11.4.0 through 11.4.4; 10.11.0 through 10.11.14 |
Showing 34