MA
Product
Mattermost
290
CVEs
0
On KEV
9.9
Max CVSS
22
New 30D
Severity mix
Critical 7High 34Medium 222Low 31
Watch
Add Mattermost to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2025-13326 | 3.9 | Dec 17 | Mattermost Desktop App fails to enable Hardened Runtime when packaged for Mac App Store Affected: through 6.0.0 |
| CVE-2026-93846 New | 3.8 | Oct 26 | Team admin can escalate a team member's permissions via the team member roles endpoint Affected: 11.7.0 through 11.7.10 |
| CVE-2026-9820 | 3.8 | Jul 13 | Mattermost schemes teams endpoint exposes private team invite IDs Affected: 11.7.0 through 11.7.2; 10.11.0 through 10.11.19 |
| CVE-2026-8823 | 3.8 | Jun 22 | User Manager can demote bot accounts to guest without bot-management permission Affected: 11.7.0 through 11.7.0; 10.11.0 through 10.11.17 |
| CVE-2026-8074 | 3.8 | Jun 22 | Improper Permission Check Allows User Manager to Deactivate Bot Accounts Affected: 11.7.0 through 11.7.0; 10.11.0 through 10.11.17 |
| CVE-2026-6334 | 3.8 | May 18 | OAuth authorization code client binding not enforced during token redemption in Mattermost Affected: 11.5.0 through 11.5.1; 10.11.0 through 10.11.13 |
| CVE-2026-26230 | 3.8 | Mar 16 | Team Admin Privilege Escalation to Demote Members to Guest Affected: 10.11.0 through 10.11.10 |
| CVE-2025-22449 | 3.8 | Jan 9 | Access control flaw for team admins allows unauthorized team additions Affected: 9.11.0 through 9.11.5 |
| CVE-2026-12284 | 3.7 | Sep 17 | Mattermost Desktop App Missing IPC Sender Validation in Calls Leave Handler Affected: through 6.2.2 |
| CVE-2025-13324 | 3.7 | Dec 17 | Lack of Invalidation of Legacy Remote Cluster Invite Tokens After Confirmation Affected: 10.11.0 through 10.11.5; 11.0.0 through 11.0.4; 10.12.0 through 10.12.2 |
| CVE-2025-54499 | 3.7 | Oct 16 | Insecure string comparison enables timing attacks Affected: 10.5.0 through 10.5.10; 10.11.0 through 10.11.2 |
| CVE-2024-32939 | 3.7 | Aug 22 | Mattermost versions 9.9.x <= 9.9.1, 9.5.x <= 9.5.7, 9.10.x <= 9.10.0, 9.8.x <= 9.8.2, when shared channels are enabled, fail to redact remote users' original email addresses… Affected: 9.5.0 before 9.5.8; 9.8.0 before 9.8.3; 9.9.0 before 9.9.2; 9.10.0 before 9.10.1 |
| CVE-2026-93847 New | 3.5 | Oct 26 | Improper post type validation on scheduled post endpoints Affected: 11.7.0 through 11.7.10 |
| CVE-2026-9693 | 3.5 | Aug 17 | Mattermost thread memberships persist after team removal, exposing private channel thread metadata on re-invite Affected: 10.11.0 through 10.11.20; 11.7.0 through 11.7.5 |
| CVE-2026-3472 | 3.5 | Jun 26 | Markdown image rendering bypass in AI bot tool result posts in Mattermost Affected: 10.11.0 through 10.11.18; 11.6.0 through 11.6.3; 11.5.0 through 11.5.6 |
| CVE-2026-4643 | 3.5 | May 18 | Calling window.close() from server-side content causes crash in the Mattermost Desktop App Affected: through 6.0.1; through 5.4.13 |
| CVE-2026-22545 | 3.5 | Mar 16 | Password Change Bypass via Auth Switch Endpoint Affected: 10.11.0 through 10.11.10 |
| CVE-2025-55074 | 3.5 | Nov 18 | Channel member objects leak read status Affected: 10.11.0 through 10.11.3; 10.5.0 through 10.5.11 |
| CVE-2024-10214 | 3.5 | Oct 28 | Mattermost versions 9.11.X <= 9.11.1, 9.5.x <= 9.5.9 icorrectly issues two sessions when using desktop SSO - one in the browser and one in desktop with incorrect settings Affected: 9.5.0 through 9.5.9; 9.11.0 through 9.11.1 |
| CVE-2026-75587 | 3.3 | Aug 17 | Plaintext pre-auth secret exposure via Desktop App diagnostics report Affected: through 6.2.2 |
| CVE-2025-13321 | 3.3 | Dec 17 | Mattermost Desktop App logging sensitive information and fails to clear data on server deletion Affected: through 6.0.0 |
| CVE-2026-20796 | 3.1 | Feb 13 | Time-of-check time-of-use vulnerability in common teams API Affected: 10.11.0 through 10.11.9 |
| CVE-2025-13352 | 3.0 | Dec 17 | Mattermost GitHub Plugin allows unauthorized GitHub reactions via reaction forwarding hijacking Affected: 10.11.0 through 10.11.6 |
| CVE-2026-93848 New | 2.7 | Oct 26 | Mattermost OpenID discovery endpoint request bypasses outbound connection filtering, allowing SSRF by a System Administrator Affected: 11.7.0 through 11.7.10 |
| CVE-2026-27769 | 2.7 | Apr 15 | Connected Workspaces: Malicious remote server can manipulate arbitrary user's status Affected: 10.11.0 through 10.11.12 |
| CVE-2025-14573 | 2.7 | Feb 16 | Team Admin Bypass of Invite Permissions via allow_open_invite Field Affected: 10.11.0 through 10.11.9 |
| CVE-2024-39353 | 2.7 | Jul 3 | Mattermost versions 9.5.x <= 9.5.5 and 9.8.0 fail to sanitize the RemoteClusterFrame payloads before audit logging them which allows a high privileged attacker with access to the… Affected: 9.5.0 before 9.5.6; 9.8.0 |
| CVE-2023-5193 | 2.7 | Sep 29 | Mattermost fails to properly check permissions when retrieving a post allowing for a System Role with the permission to manage channels to read the posts of a DM conversation Affected: 7.0.0 before 7.8.10; 8.0.0 before 8.0.2; 8.1.0 before 8.1.1 |
| CVE-2023-5159 | 2.7 | Sep 29 | Mattermost fails to properly verify the permissions when managing/updating a bot allowing a User Manager role with user edit permissions to manage/update bots Affected: 7.0.0 before 7.8.10; 8.0.0 before 8.1.1 |
| CVE-2026-75588 | 2.6 | Sep 17 | Mattermost Desktop App plugin popout scheme validation bypass Affected: through 6.2.2 |
| CVE-2026-3109 | 2.2 | Mar 26 | Missing timestamp validation in Zoom webhook handler Affected: through 10.11.11 |
Showing 31