Companies/Mattermost/CVEs

Mattermost CVEs

311 vulnerabilities mapped to Mattermost’s software or packages, 0 of them in CISA’s Known Exploited Vulnerabilities catalog, newest first. Not a statement that the hosted service was exposed.

CVEs mapped to a company Rewindex tracks (by CVE affected-product data, NVD CPE, vendor advisories and package feeds), every entry in CISA’s Known Exploited Vulnerabilities catalog, and CVEs named in a tracked status incident. Other CVEs are not listed. Same list on the all-vendor CVE index.

• 2026-10-22

  CVE-2026-13411 Null condition in Playbooks import crashes the plugin

  CVSS 4.3 mediumEPSS 0.32%

• 2026-10-16

  CVE-2026-18799 Mattermost Server fails to restrict Slack import account binding, allowing team admins to forge posts as existing users

  CVSS 4.3 mediumEPSS 0.20%

• 2026-10-16

  CVE-2026-16251 Mattermost local image proxy allows server memory exhaustion via unbounded image response buffering

  CVSS 6.5 mediumEPSS 0.28%

• 2026-10-16

  CVE-2026-18256 Private team metadata disclosure via the team search API

  CVSS 4.3 mediumEPSS 0.16%

• 2026-10-16

  CVE-2026-18223 Mattermost invitation tokens not bound to invited email address allowing unauthorized team and private channel access

  CVSS 5.0 mediumEPSS 0.16%

• 2026-10-16

  CVE-2026-19076 Mattermost fails to reject OAuth application sessions in account type switch, allowing account takeover via bearer token

  CVSS 4.4 mediumEPSS 0.20%

• 2026-10-16

  CVE-2026-18560 Improper order of authorisations in Mattermost GetFile API leads to an authenticated user to determine a post’s quarantined status

  CVSS 4.3 mediumEPSS 0.18%

• 2026-10-16

  CVE-2026-16453 Mattermost SAML RelayState forgery allows unauthorized team membership

  CVSS 7.1 highEPSS 0.19%

• 2026-10-16

  CVE-2026-19600 Mattermost logs plaintext authentication tokens in debug-level server logs on failed auth attempts

  CVSS 4.5 mediumEPSS 0.24%

• 2026-10-16

  CVE-2026-19621 Mattermost leaks interactive-message integration secrets to non-admin users via post-deletion events and thread reads

  CVSS 6.5 mediumEPSS 0.25%

• 2026-10-16

  CVE-2026-19603 Private channel ID disclosure via user status endpoints

  CVSS 4.3 mediumEPSS 0.18%

• 2026-10-16

  CVE-2026-18795 Missing server side validation allowed user to quarantine a DM and GM post

  CVSS 6.4 mediumEPSS 0.15%

• 2026-10-16

  CVE-2026-19867 Uncapped mention keys in user notification properties allow CPU exhaustion during post processing

  CVSS 4.3 mediumEPSS 0.21%

• 2026-10-16

  CVE-2026-19601 Disclosure of AD/LDAP bind password via Test Connection

  CVSS 4.9 mediumEPSS 0.23%

• 2026-10-16

  CVE-2026-18551 Mattermost guest account privilege escalation via member roles API

  CVSS 6.5 mediumEPSS 0.22%

• 2026-10-16

  CVE-2026-19541 Outgoing OAuth connection client secret exposure during connection validation

  CVSS 6.5 mediumEPSS 0.22%

• 2026-09-22

  CVE-2026-96260 Mattermost server missing request body size limit on plugin routes allows denial of service by an authenticated user

  CVSS 6.5 mediumEPSS 0.42%

• 2026-09-22

  CVE-2026-96259 Mattermost server-side request forgery via OAuth endpoints configurable by a System Administrator

  CVSS 5.5 mediumEPSS 0.26%

• 2026-09-22

  CVE-2026-95666 Unbounded post ID array in the bulk reactions endpoint allows denial of service

  CVSS 4.3 mediumEPSS 0.37%

• 2026-09-17

  CVE-2026-12284 Mattermost Desktop App Missing IPC Sender Validation in Calls Leave Handler

  CVSS 3.8 lowEPSS 0.16%

• 2026-09-17

  CVE-2026-75588 Mattermost Desktop App plugin popout scheme validation bypass

  CVSS 2.6 lowEPSS 0.22%

• 2026-09-16

  CVE-2026-75025 Mattermost Desktop local network access from server-rendered content

  CVSS 4.7 mediumEPSS 0.16%

• 2026-09-14

  CVE-2026-91181 Data Retention Teams Endpoint Leaks Private Team Invite ID

  CVSS 6.5 mediumEPSS 0.39%

• 2026-09-14

  CVE-2026-12985 Mattermost DCR redirect URI allowlist bypass via improper URL component validation

  CVSS 6.8 mediumEPSS 0.27%

• 2026-09-14

  CVE-2026-82920 Mattermost ABAC parent policy bypass via policy update endpoint

  CVSS 5.5 mediumEPSS 0.26%

• 2026-09-14

  CVE-2026-86348 MS Calendar plugin: unrecovered handler panics from malformed post-action requests could crash the plugin process

  CVSS 4.3 mediumEPSS 0.37%

• 2026-09-14

  CVE-2026-86349 Mattermost Server Algorithmic DoS via Unbounded Markdown Block Nesting

  CVSS 4.3 mediumEPSS 0.37%

• 2026-09-14

  CVE-2026-10556 Unauthenticated webhook request with null notification entry could crash the Microsoft Calendar plugin.

  CVSS 5.3 mediumEPSS 0.42%

• 2026-09-14

  CVE-2026-13417 Boards plugin denial of service via unvalidated block fields.properties

  CVSS 4.3 mediumEPSS 0.37%

• 2026-09-14

  CVE-2026-9812 Missing property field ownership validation in Playbooks run property update endpoint

  CVSS 6.5 mediumEPSS 0.37%

• 2026-09-14

  CVE-2026-8821 Playbooks run owner channel membership permission bypass

  CVSS 7.1 highEPSS 0.29%

• 2026-09-14

  CVE-2026-5132 Unbounded zlib decompression in Calls SDP WebSocket messages

  CVSS 6.5 mediumEPSS 0.42%

• 2026-09-14

  CVE-2026-15814 Uploading a crafted image causes excessive memory allocation in the Mattermost Server

  CVSS 6.5 mediumEPSS 0.42%

• 2026-09-14

  CVE-2026-10542 Playbooks channel action update validation issue

  CVSS 5.0 mediumEPSS 0.12%

• 2026-09-14

  CVE-2026-14344 Inconsistent authorization checks in Mattermost Boards endpoints

  CVSS 4.3 mediumEPSS 0.25%

• 2026-09-14

  CVE-2026-12882 Mattermost Markdown autolink parsing denial of service

  CVSS 4.3 mediumEPSS 0.37%

• 2026-09-14

  CVE-2026-11993 Fix authenticated members disabling file content indexing server-wide via extraction pool exhaustion

  CVSS 4.3 mediumEPSS 0.37%

• 2026-09-14

  CVE-2026-14259 Board archive import bypasses team board creation permissions

  CVSS 4.3 mediumEPSS 0.25%

• 2026-08-17

  CVE-2026-75587 Plaintext pre-auth secret exposure via Desktop App diagnostics report

  CVSS 3.6 lowEPSS 0.13%

• 2026-08-17

  CVE-2026-9693 Mattermost thread memberships persist after team removal, exposing private channel thread metadata on re-invite

  CVSS 3.5 lowEPSS 0.27%

• 2026-08-17

  CVE-2026-9859 Mattermost Boards plugin didn’t enforce role-based authorization on board channel link allowing board editors to expose boards to arbitrary channels

  CVSS 6.5 mediumEPSS 0.34%

• 2026-08-17

  CVE-2026-9816 Insufficient server-side validation of board member role fields permits privilege escalation

  CVSS 8.3 highEPSS 0.35%

• 2026-08-17

  CVE-2026-10080 Boards plugin panics on WebSocket command with non-string field types

  CVSS 6.5 mediumEPSS 0.42%

• 2026-08-17

  CVE-2026-10527 Boards plugin retains Board Admin rights for users demoted to System Guest

  CVSS 6.3 mediumEPSS 0.26%

• 2026-08-17

  CVE-2026-15754 Missing per-channel team-scope check in ABAC access control policy unassign allows cross-team policy removal

  CVSS 4.2 mediumEPSS 0.25%

• 2026-08-17

  CVE-2026-16044 Insufficient validation of guest board admin privileges on archive import

  CVSS 3.9 lowEPSS 0.29%

• 2026-08-17

  CVE-2026-16045 Delegated OAuth tokens could revoke unrelated OAuth application authorizations

  CVSS 2.7 lowEPSS 0.33%

• 2026-08-17

  CVE-2026-16049 _GitLab Plugin allows cross-channel post injection and phishing via missing channel permission checks in issue API endpoints_

  CVSS 3.9 lowEPSS 0.29%

• 2026-08-17

  CVE-2026-16047 Board channel linking without read channel permission validation

  CVSS 4.3 mediumEPSS 0.27%

• 2026-08-17

  CVE-2026-16046 Missing run-state validation on finished playbook runs

  CVSS 3.5 lowEPSS 0.25%

All vendors’ CVEs · JSON · Markdown

• CVE records from the CVE Program (cve.org). CVE® is a registered trademark of The MITRE Corporation. (opens in new tab)
• This product uses data from the NVD API but is not endorsed or certified by the NVD. (opens in new tab)
• Known Exploited Vulnerabilities catalog from CISA. (opens in new tab)
• EPSS scores from FIRST (Exploit Prediction Scoring System). (opens in new tab)