# Mattermost CVEs > Mattermost: 311 CVEs mapped to its software or packages (0 in CISA KEV), newest first, with CVSS and EPSS. Canonical: https://rewindex.com/company/mattermost/cves Last updated: 2026-10-22T10:46:05Z 311 CVEs map to Mattermost (0 in CISA KEV), newest first. Page 1. Query: `?sev=critical|high|medium|low&kev=yes|no&min_cvss=0..10&q=&page=N`. Company profile: [Mattermost](https://rewindex.com/company/mattermost.md) Scope: CVEs mapped to a company Rewindex tracks (by CVE affected-product data, NVD CPE, vendor advisories and package feeds), every entry in CISA’s Known Exploited Vulnerabilities catalog, and CVEs named in a tracked status incident. Other CVEs are not listed. A mapped CVE is not a statement that Mattermost’s hosted service was exposed. | Published (UTC) | CVE | Title | CVSS | KEV | | --- | --- | --- | --- | --- | | 2026-10-22 | [CVE-2026-13411](https://rewindex.com/cve/CVE-2026-13411.md) | Null condition in Playbooks import crashes the plugin | 4.3 medium | | | 2026-10-16 | [CVE-2026-18799](https://rewindex.com/cve/CVE-2026-18799.md) | Mattermost Server fails to restrict Slack import account binding, allowing team admins to forge posts as existing users | 4.3 medium | | | 2026-10-16 | [CVE-2026-16251](https://rewindex.com/cve/CVE-2026-16251.md) | Mattermost local image proxy allows server memory exhaustion via unbounded image response buffering | 6.5 medium | | | 2026-10-16 | [CVE-2026-18256](https://rewindex.com/cve/CVE-2026-18256.md) | Private team metadata disclosure via the team search API | 4.3 medium | | | 2026-10-16 | [CVE-2026-18223](https://rewindex.com/cve/CVE-2026-18223.md) | Mattermost invitation tokens not bound to invited email address allowing unauthorized team and private channel access | 5.0 medium | | | 2026-10-16 | [CVE-2026-19076](https://rewindex.com/cve/CVE-2026-19076.md) | Mattermost fails to reject OAuth application sessions in account type switch, allowing account takeover via bearer token | 4.4 medium | | | 2026-10-16 | [CVE-2026-18560](https://rewindex.com/cve/CVE-2026-18560.md) | Improper order of authorisations in Mattermost GetFile API leads to an authenticated user to determine a post’s quarantined status | 4.3 medium | | | 2026-10-16 | [CVE-2026-16453](https://rewindex.com/cve/CVE-2026-16453.md) | Mattermost SAML RelayState forgery allows unauthorized team membership | 7.1 high | | | 2026-10-16 | [CVE-2026-19600](https://rewindex.com/cve/CVE-2026-19600.md) | Mattermost logs plaintext authentication tokens in debug-level server logs on failed auth attempts | 4.5 medium | | | 2026-10-16 | [CVE-2026-19621](https://rewindex.com/cve/CVE-2026-19621.md) | Mattermost leaks interactive-message integration secrets to non-admin users via post-deletion events and thread reads | 6.5 medium | | | 2026-10-16 | [CVE-2026-19603](https://rewindex.com/cve/CVE-2026-19603.md) | Private channel ID disclosure via user status endpoints | 4.3 medium | | | 2026-10-16 | [CVE-2026-18795](https://rewindex.com/cve/CVE-2026-18795.md) | Missing server side validation allowed user to quarantine a DM and GM post | 6.4 medium | | | 2026-10-16 | [CVE-2026-19867](https://rewindex.com/cve/CVE-2026-19867.md) | Uncapped mention keys in user notification properties allow CPU exhaustion during post processing | 4.3 medium | | | 2026-10-16 | [CVE-2026-19601](https://rewindex.com/cve/CVE-2026-19601.md) | Disclosure of AD/LDAP bind password via Test Connection | 4.9 medium | | | 2026-10-16 | [CVE-2026-18551](https://rewindex.com/cve/CVE-2026-18551.md) | Mattermost guest account privilege escalation via member roles API | 6.5 medium | | | 2026-10-16 | [CVE-2026-19541](https://rewindex.com/cve/CVE-2026-19541.md) | Outgoing OAuth connection client secret exposure during connection validation | 6.5 medium | | | 2026-09-22 | [CVE-2026-96260](https://rewindex.com/cve/CVE-2026-96260.md) | Mattermost server missing request body size limit on plugin routes allows denial of service by an authenticated user | 6.5 medium | | | 2026-09-22 | [CVE-2026-96259](https://rewindex.com/cve/CVE-2026-96259.md) | Mattermost server-side request forgery via OAuth endpoints configurable by a System Administrator | 5.5 medium | | | 2026-09-22 | [CVE-2026-95666](https://rewindex.com/cve/CVE-2026-95666.md) | Unbounded post ID array in the bulk reactions endpoint allows denial of service | 4.3 medium | | | 2026-09-17 | [CVE-2026-12284](https://rewindex.com/cve/CVE-2026-12284.md) | Mattermost Desktop App Missing IPC Sender Validation in Calls Leave Handler | 3.8 low | | | 2026-09-17 | [CVE-2026-75588](https://rewindex.com/cve/CVE-2026-75588.md) | Mattermost Desktop App plugin popout scheme validation bypass | 2.6 low | | | 2026-09-16 | [CVE-2026-75025](https://rewindex.com/cve/CVE-2026-75025.md) | Mattermost Desktop local network access from server-rendered content | 4.7 medium | | | 2026-09-14 | [CVE-2026-91181](https://rewindex.com/cve/CVE-2026-91181.md) | Data Retention Teams Endpoint Leaks Private Team Invite ID | 6.5 medium | | | 2026-09-14 | [CVE-2026-12985](https://rewindex.com/cve/CVE-2026-12985.md) | Mattermost DCR redirect URI allowlist bypass via improper URL component validation | 6.8 medium | | | 2026-09-14 | [CVE-2026-82920](https://rewindex.com/cve/CVE-2026-82920.md) | Mattermost ABAC parent policy bypass via policy update endpoint | 5.5 medium | | | 2026-09-14 | [CVE-2026-86348](https://rewindex.com/cve/CVE-2026-86348.md) | MS Calendar plugin: unrecovered handler panics from malformed post-action requests could crash the plugin process | 4.3 medium | | | 2026-09-14 | [CVE-2026-86349](https://rewindex.com/cve/CVE-2026-86349.md) | Mattermost Server Algorithmic DoS via Unbounded Markdown Block Nesting | 4.3 medium | | | 2026-09-14 | [CVE-2026-10556](https://rewindex.com/cve/CVE-2026-10556.md) | Unauthenticated webhook request with null notification entry could crash the Microsoft Calendar plugin. | 5.3 medium | | | 2026-09-14 | [CVE-2026-13417](https://rewindex.com/cve/CVE-2026-13417.md) | Boards plugin denial of service via unvalidated block fields.properties | 4.3 medium | | | 2026-09-14 | [CVE-2026-9812](https://rewindex.com/cve/CVE-2026-9812.md) | Missing property field ownership validation in Playbooks run property update endpoint | 6.5 medium | | | 2026-09-14 | [CVE-2026-8821](https://rewindex.com/cve/CVE-2026-8821.md) | Playbooks run owner channel membership permission bypass | 7.1 high | | | 2026-09-14 | [CVE-2026-5132](https://rewindex.com/cve/CVE-2026-5132.md) | Unbounded zlib decompression in Calls SDP WebSocket messages | 6.5 medium | | | 2026-09-14 | [CVE-2026-15814](https://rewindex.com/cve/CVE-2026-15814.md) | Uploading a crafted image causes excessive memory allocation in the Mattermost Server | 6.5 medium | | | 2026-09-14 | [CVE-2026-10542](https://rewindex.com/cve/CVE-2026-10542.md) | Playbooks channel action update validation issue | 5.0 medium | | | 2026-09-14 | [CVE-2026-14344](https://rewindex.com/cve/CVE-2026-14344.md) | Inconsistent authorization checks in Mattermost Boards endpoints | 4.3 medium | | | 2026-09-14 | [CVE-2026-12882](https://rewindex.com/cve/CVE-2026-12882.md) | Mattermost Markdown autolink parsing denial of service | 4.3 medium | | | 2026-09-14 | [CVE-2026-11993](https://rewindex.com/cve/CVE-2026-11993.md) | Fix authenticated members disabling file content indexing server-wide via extraction pool exhaustion | 4.3 medium | | | 2026-09-14 | [CVE-2026-14259](https://rewindex.com/cve/CVE-2026-14259.md) | Board archive import bypasses team board creation permissions | 4.3 medium | | | 2026-08-17 | [CVE-2026-75587](https://rewindex.com/cve/CVE-2026-75587.md) | Plaintext pre-auth secret exposure via Desktop App diagnostics report | 3.6 low | | | 2026-08-17 | [CVE-2026-9693](https://rewindex.com/cve/CVE-2026-9693.md) | Mattermost thread memberships persist after team removal, exposing private channel thread metadata on re-invite | 3.5 low | | | 2026-08-17 | [CVE-2026-9859](https://rewindex.com/cve/CVE-2026-9859.md) | Mattermost Boards plugin didn’t enforce role-based authorization on board channel link allowing board editors to expose boards to arbitrary channels | 6.5 medium | | | 2026-08-17 | [CVE-2026-9816](https://rewindex.com/cve/CVE-2026-9816.md) | Insufficient server-side validation of board member role fields permits privilege escalation | 8.3 high | | | 2026-08-17 | [CVE-2026-10080](https://rewindex.com/cve/CVE-2026-10080.md) | Boards plugin panics on WebSocket command with non-string field types | 6.5 medium | | | 2026-08-17 | [CVE-2026-10527](https://rewindex.com/cve/CVE-2026-10527.md) | Boards plugin retains Board Admin rights for users demoted to System Guest | 6.3 medium | | | 2026-08-17 | [CVE-2026-15754](https://rewindex.com/cve/CVE-2026-15754.md) | Missing per-channel team-scope check in ABAC access control policy unassign allows cross-team policy removal | 4.2 medium | | | 2026-08-17 | [CVE-2026-16044](https://rewindex.com/cve/CVE-2026-16044.md) | Insufficient validation of guest board admin privileges on archive import | 3.9 low | | | 2026-08-17 | [CVE-2026-16045](https://rewindex.com/cve/CVE-2026-16045.md) | Delegated OAuth tokens could revoke unrelated OAuth application authorizations | 2.7 low | | | 2026-08-17 | [CVE-2026-16049](https://rewindex.com/cve/CVE-2026-16049.md) | \_GitLab Plugin allows cross-channel post injection and phishing via missing channel permission checks in issue API endpoints\_ | 3.9 low | | | 2026-08-17 | [CVE-2026-16047](https://rewindex.com/cve/CVE-2026-16047.md) | Board channel linking without read channel permission validation | 4.3 medium | | | 2026-08-17 | [CVE-2026-16046](https://rewindex.com/cve/CVE-2026-16046.md) | Missing run-state validation on finished playbook runs | 3.5 low | | Next page: [page 2](https://rewindex.com/company/mattermost/cves.md?page=2) --- _Sources: CVE records from the CVE Program (cve.org). CVE® is a registered trademark of The MITRE Corporation. (https://www.cve.org/) This product uses data from the NVD API but is not endorsed or certified by the NVD. (https://nvd.nist.gov/) Known Exploited Vulnerabilities catalog from CISA. (https://www.cisa.gov/known-exploited-vulnerabilities-catalog) EPSS scores from FIRST (Exploit Prediction Scoring System). (https://www.first.org/epss/)_ ## Charts ### Chart data: CVEs per week, last 52 weeks (Mattermost) Weeks start Monday, UTC. Bars: CVEs by published date (KEV date added if unpublished), by CVSS severity; kev_added: entries added to CISA KEV that week. Same filters as the list. The current week is partial. | Week of (UTC) | Critical | High | Medium | Low | Not scored | Added to KEV | | --- | --- | --- | --- | --- | --- | --- | | 2025-11-03 | 0 | 0 | 0 | 0 | 0 | 0 | | 2025-11-10 | 0 | 0 | 5 | 2 | 0 | 0 | | 2025-11-17 | 0 | 0 | 0 | 1 | 0 | 0 | | 2025-11-24 | 2 | 0 | 1 | 0 | 0 | 0 | | 2025-12-01 | 0 | 0 | 1 | 1 | 0 | 0 | | 2025-12-08 | 0 | 0 | 0 | 0 | 0 | 0 | | 2025-12-15 | 0 | 0 | 2 | 5 | 0 | 0 | | 2025-12-22 | 0 | 1 | 2 | 0 | 0 | 0 | | 2025-12-29 | 0 | 0 | 0 | 0 | 0 | 0 | | 2026-01-05 | 0 | 0 | 0 | 0 | 0 | 0 | | 2026-01-12 | 0 | 0 | 1 | 1 | 0 | 0 | | 2026-01-19 | 0 | 0 | 0 | 0 | 0 | 0 | | 2026-01-26 | 0 | 0 | 0 | 0 | 0 | 0 | | 2026-02-02 | 0 | 1 | 0 | 0 | 0 | 0 | | 2026-02-09 | 0 | 0 | 1 | 1 | 0 | 0 | | 2026-02-16 | 0 | 1 | 5 | 1 | 0 | 0 | | 2026-02-23 | 0 | 0 | 0 | 0 | 0 | 0 | | 2026-03-02 | 0 | 0 | 1 | 0 | 0 | 0 | | 2026-03-09 | 0 | 0 | 0 | 0 | 0 | 0 | | 2026-03-16 | 0 | 2 | 17 | 2 | 0 | 0 | | 2026-03-23 | 0 | 1 | 10 | 1 | 0 | 0 | | 2026-03-30 | 0 | 1 | 1 | 0 | 0 | 0 | | 2026-04-06 | 0 | 1 | 0 | 2 | 0 | 0 | | 2026-04-13 | 0 | 0 | 2 | 1 | 0 | 0 | | 2026-04-20 | 0 | 0 | 0 | 0 | 0 | 0 | | 2026-04-27 | 0 | 0 | 0 | 0 | 0 | 0 | | 2026-05-04 | 0 | 0 | 0 | 0 | 0 | 0 | | 2026-05-11 | 0 | 0 | 1 | 1 | 0 | 0 | | 2026-05-18 | 0 | 4 | 22 | 6 | 0 | 0 | | 2026-05-25 | 0 | 1 | 1 | 0 | 0 | 0 | | 2026-06-01 | 0 | 0 | 0 | 0 | 0 | 0 | | 2026-06-08 | 0 | 2 | 5 | 0 | 0 | 0 | | 2026-06-15 | 0 | 0 | 2 | 0 | 0 | 0 | | 2026-06-22 | 0 | 0 | 8 | 3 | 0 | 0 | | 2026-06-29 | 0 | 0 | 0 | 0 | 0 | 0 | | 2026-07-06 | 0 | 0 | 0 | 0 | 0 | 0 | | 2026-07-13 | 0 | 0 | 11 | 1 | 0 | 0 | | 2026-07-20 | 0 | 0 | 0 | 0 | 0 | 0 | | 2026-07-27 | 0 | 0 | 3 | 0 | 0 | 0 | | 2026-08-03 | 0 | 0 | 0 | 0 | 0 | 0 | | 2026-08-10 | 0 | 0 | 1 | 0 | 0 | 0 | | 2026-08-17 | 0 | 1 | 6 | 6 | 0 | 0 | | 2026-08-24 | 0 | 0 | 0 | 0 | 0 | 0 | | 2026-08-31 | 0 | 0 | 0 | 0 | 0 | 0 | | 2026-09-07 | 0 | 0 | 0 | 0 | 0 | 0 | | 2026-09-14 | 0 | 1 | 16 | 2 | 0 | 0 | | 2026-09-21 | 0 | 0 | 3 | 0 | 0 | 0 | | 2026-09-28 | 0 | 0 | 0 | 0 | 0 | 0 | | 2026-10-05 | 0 | 0 | 0 | 0 | 0 | 0 | | 2026-10-12 | 0 | 1 | 14 | 0 | 0 | 0 | | 2026-10-19 | 0 | 0 | 1 | 0 | 0 | 0 | | 2026-10-26 | 0 | 0 | 0 | 0 | 0 | 0 | --- Canonical: https://rewindex.com/company/mattermost/cves · Markdown: https://rewindex.com/company/mattermost/cves.md · JSON: https://rewindex.com/api/v1/companies/mattermost/cves · Data licensed CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/) · Generated 2026-10-26T03:13:32.407Z