Companies/Mattermost/CVEs

Mattermost CVEs

311 vulnerabilities mapped to Mattermost’s software or packages, 0 of them in CISA’s Known Exploited Vulnerabilities catalog, newest first. Not a statement that the hosted service was exposed.

CVEs mapped to a company Rewindex tracks (by CVE affected-product data, NVD CPE, vendor advisories and package feeds), every entry in CISA’s Known Exploited Vulnerabilities catalog, and CVEs named in a tracked status incident. Other CVEs are not listed. Same list on the all-vendor CVE index.

• 2026-08-17

  CVE-2026-16048 Channel member roles accept out-of-scope roles

  CVSS 6.3 mediumEPSS 0.26%

• 2026-08-13

  CVE-2026-14298 Boards archive import endpoint allows resource exhaustion via zip bomb and file size limit bypass in Mattermost

  CVSS 6.5 mediumEPSS 0.42%

• 2026-07-28

  CVE-2026-7521 SAML certificate deletion allows path traversal to delete arbitrary files outside the config directory

  CVSS 5.5 mediumEPSS 0.44%

• 2026-07-27

  CVE-2026-10819 Mattermost Server Denial of Service via Animated GIF Emoji Upload

  CVSS 6.5 mediumEPSS 0.42%

• 2026-07-27

  CVE-2026-10600 Denial of service via unbounded document content extraction in Mattermost Server

  CVSS 4.3 mediumEPSS 0.37%

• 2026-07-17

  CVE-2026-8075 Posting a malicious markdown image crashes the Mattermost Desktop App

  CVSS 6.5 mediumEPSS 0.42%

• 2026-07-17

  CVE-2026-9602 Mattermost Desktop App crashes when malformed arguments are provided to some exposed IPC methods

  CVSS 5.7 mediumEPSS 0.42%

• 2026-07-13

  CVE-2026-6541 Unscoped updates to other playbooks' metric configuration

  CVSS 4.3 mediumEPSS 0.25%

• 2026-07-13

  CVE-2026-9820 Mattermost schemes teams endpoint exposes private team invite IDs

  CVSS 3.8 lowEPSS 0.26%

• 2026-07-13

  CVE-2026-9824 Remote cluster metadata enumeration via /share-channel autocomplete

  CVSS 4.3 mediumEPSS 0.27%

• 2026-07-13

  CVE-2026-9597 Deactivated guest accounts can authenticate via magic-link token in Mattermost REST API login endpoint

  CVSS 5.4 mediumEPSS 0.23%

• 2026-07-13

  CVE-2026-6850 Crafted message attachment causes client-side denial of service via markdown parser regex backtracking in Mattermost

  CVSS 6.5 mediumEPSS 0.42%

• 2026-07-13

  CVE-2026-10106 Unauthorized users can trigger interactive post actions in private channels via action cookie channel mismatch in Mattermost

  CVSS 6.5 mediumEPSS 0.30%

• 2026-07-13

  CVE-2026-10085 Ordinary group/direct message member can enable group_constrained and remove all channel participants

  CVSS 5.4 mediumEPSS 0.29%

• 2026-07-13

  CVE-2026-9708 Incoming webhook user attribution via unvalidated webhook owner

  CVSS 4.9 mediumEPSS 0.36%

• 2026-07-13

  CVE-2026-10103 Authenticated remote cluster can modify or delete posts it does not own in Mattermost Connected Workspaces shared channels

  CVSS 4.3 mediumEPSS 0.24%

• 2026-07-13

  CVE-2026-9571 Deactivated user accounts can continue to obtain valid OAuth access tokens via refresh token grant in Mattermost

  CVSS 5.9 mediumEPSS 0.30%

• 2026-06-26

  CVE-2026-4339 SSRF via unvalidated attachment URLs in Mattermost Agents plugin MCP server

  CVSS 6.5 mediumEPSS 0.14%

• 2026-06-26

  CVE-2026-9699 Mattermost Agents plugin logs unsanitized OpenAI API keys on authentication errors

  CVSS 6.8 mediumEPSS 0.46%

• 2026-06-26

  CVE-2026-3472 Markdown image rendering bypass in AI bot tool result posts in Mattermost

  CVSS 3.5 lowEPSS 0.27%

• 2026-06-26

  CVE-2026-13426 Client4 fails to validate path parameters

  CVSS 5.4 mediumEPSS 0.29%

• 2026-06-25

  CVE-2026-2299 Improper Access Control in Mattermost Google Drive Plugin File Creation Endpoint

  CVSS 4.2 mediumEPSS 0.20%

• 2026-06-22

  CVE-2026-8823 User Manager can demote bot accounts to guest without bot-management permission

  CVSS 3.8 lowEPSS 0.32%

• 2026-06-22

  CVE-2026-6062 IDOR in Jira plugin subscription edit endpoint

  CVSS 6.4 mediumEPSS 0.24%

• 2026-06-22

  CVE-2026-6673 Mattermost Jira plugin had unauthenticated {{/ac/installed}} lifecycle callback during pending Jira Cloud install

  CVSS 6.4 mediumEPSS 0.30%

• 2026-06-22

  CVE-2026-8074 Improper Permission Check Allows User Manager to Deactivate Bot Accounts

  CVSS 3.8 lowEPSS 0.32%

• 2026-06-22

  CVE-2026-9162 Global session revocation does not invalidate active WebSocket connections

  CVSS 4.3 mediumEPSS 0.33%

• 2026-06-22

  CVE-2026-5139 GitLab Plugin Allows Non-Admin Users to Modify Default Instance Configuration

  CVSS 5.4 mediumEPSS 0.29%

• 2026-06-15

  CVE-2026-8683 Overly long URLs crash the Mattermost Desktop App

  CVSS 6.5 mediumEPSS 0.20%

• 2026-06-15

  CVE-2026-6517 Mattermost Desktop App fails to restrict the allow list of domains which NTLM credentials are passed

  CVSS 6.3 mediumEPSS 0.19%

• 2026-06-12

  CVE-2026-6961 CVE-2026-6961: Path traversal via unsanitized FileInfo.Name in Mattermost federation sync

  CVSS 7.6 highEPSS 0.30%

• 2026-06-12

  CVE-2026-7387 Mattermost group syncable endpoints allow privilege escalation via scheme_admin

  CVSS 8.8 highEPSS 0.31%

• 2026-06-12

  CVE-2026-6046 Plugin bot username conflict allows user account to be used as bot identity in Mattermost Server

  CVSS 5.3 mediumEPSS 0.19%

• 2026-06-12

  CVE-2026-6689 *Missing* {{invite_user}} *permission check on team creation allows unprivileged users to set open-invite and allowed-domains team settings*

  CVSS 4.3 mediumEPSS 0.15%

• 2026-06-12

  CVE-2026-7184 Mattermost Remote Cluster PATCH API Leaks Authentication Tokens

  CVSS 6.5 mediumEPSS 0.26%

• 2026-06-12

  CVE-2026-6739 Mattermost: Delegated admins could patch protected default system roles

  CVSS 6.7 mediumEPSS 0.26%

• 2026-06-12

  CVE-2026-3433 Mattermost fails to scope role_updated websocket events to authorized team and channel members

  CVSS 4.3 mediumEPSS 0.18%

• 2026-05-27

  CVE-2026-6957 Path traversal in Mattermost Legal Hold plugin via unsanitized file name from federated peer allows arbitrary file write.

  CVSS 8.0 highEPSS 0.30%

• 2026-05-25

  CVE-2026-4915 Server panic via outgoing webhook responses

  CVSS 6.5 mediumEPSS 0.28%

• 2026-05-22

  CVE-2026-28735 GitHub OAuth Scope Validation

  CVSS 5.4 mediumEPSS 0.14%

• 2026-05-22

  CVE-2026-4635 Persistent notification timing attack causing server denial of service

  CVSS 6.5 mediumEPSS 0.17%

• 2026-05-22

  CVE-2026-3473 Improper file ownership validation in the Boards API allows unauthorised file access

  CVSS 5.9 mediumEPSS 0.15%

• 2026-05-22

  CVE-2026-4646 Insufficient input validation in GitHub plugin API causes denial of service

  CVSS 4.3 mediumEPSS 0.25%

• 2026-05-22

  CVE-2026-3636 Sanitize team member data returned by API

  CVSS 4.3 mediumEPSS 0.18%

• 2026-05-22

  CVE-2026-5740 Unauthenticated WebSocket binary frame causes denial of service in Mattermost Server

  CVSS 7.5 highEPSS 0.34%

• 2026-05-22

  CVE-2026-5308 Missing request body size limits on Zoom plugin HTTP endpoints

  CVSS 4.9 mediumEPSS 0.25%

• 2026-05-22

  CVE-2026-5755 Denial of service via crafted TIFF file upload

  CVSS 6.5 mediumEPSS 0.25%

• 2026-05-21

  CVE-2026-22880 Mobile SSO authentication flow allows credential theft via malicious server

  CVSS 6.1 mediumEPSS 0.12%

• 2026-05-21

  CVE-2026-4858 Path traversal in integration action URL leading to arbitrary API execution via system admin’s auth token.

  CVSS 8.0 highEPSS 0.33%

• 2026-05-21

  CVE-2026-4055 Insufficient permission validation on cross-team playbook run creation

  CVSS 4.3 mediumEPSS 0.15%

All vendors’ CVEs · JSON · Markdown

• CVE records from the CVE Program (cve.org). CVE® is a registered trademark of The MITRE Corporation. (opens in new tab)
• This product uses data from the NVD API but is not endorsed or certified by the NVD. (opens in new tab)
• Known Exploited Vulnerabilities catalog from CISA. (opens in new tab)
• EPSS scores from FIRST (Exploit Prediction Scoring System). (opens in new tab)