Companies/Mattermost/CVEs

Mattermost CVEs

311 vulnerabilities mapped to Mattermost’s software or packages, 0 of them in CISA’s Known Exploited Vulnerabilities catalog, newest first. Not a statement that the hosted service was exposed.

CVEs mapped to a company Rewindex tracks (by CVE affected-product data, NVD CPE, vendor advisories and package feeds), every entry in CISA’s Known Exploited Vulnerabilities catalog, and CVEs named in a tracked status incident. Other CVEs are not listed. Same list on the all-vendor CVE index.

• 2026-05-18

  CVE-2026-3471 Opening a window with {{javascript:alert()}} as URL causes crash in the Mattermost Desktop App

  CVSS 6.5 mediumEPSS 0.18%

• 2026-05-18

  CVE-2026-4643 Calling window.close() from server-side content causes crash in the Mattermost Desktop App

  CVSS 3.5 lowEPSS 0.17%

• 2026-05-18

  CVE-2026-6333 SSRF via Host Header Spoofing in Custom Slash Commands

  CVSS 3.5 lowEPSS 0.14%

• 2026-05-18

  CVE-2026-6345 Prevent password disclosure and force reset during Slack import

  CVSS 6.5 mediumEPSS 0.23%

• 2026-05-18

  CVE-2026-6346 Sensitive credentials exposed in plaintext in Mattermost support packets

  CVSS 8.7 highEPSS 0.30%

• 2026-05-18

  CVE-2026-28732 Slash command trigger-word update allowed command hijacking

  CVSS 4.3 mediumEPSS 0.15%

• 2026-05-18

  CVE-2026-6343 Mattermost Playbooks Plugin fails to enforce view permissions in list endpoints, allowing unauthorized access to public playbooks

  CVSS 4.3 mediumEPSS 0.16%

• 2026-05-18

  CVE-2026-6347 Mattermost Calls plugin exposes TURN server credentials in plaintext in support packets

  CVSS 7.6 highEPSS 0.27%

• 2026-05-18

  CVE-2026-5163 Missing authorization check in AI message rewrite endpoint allows access to private thread content

  CVSS 6.5 mediumEPSS 0.21%

• 2026-05-18

  CVE-2026-3117 Instance and webhook GitLab plugin commands were able to be run by non-admin users

  CVSS 6.5 mediumEPSS 0.23%

• 2026-05-18

  CVE-2026-4286 Playbooks Plugin fails to validate team transfers, allowing unauthorized removal of member access via playbook update

  CVSS 3.1 lowEPSS 0.14%

• 2026-05-18

  CVE-2026-6339 Missing request origin validation on burn-on-read reveal endpoint

  CVSS 4.3 mediumEPSS 0.11%

• 2026-05-18

  CVE-2026-6340 Memory Exhaustion via Malicious 7zip File Upload

  CVSS 4.3 mediumEPSS 0.24%

• 2026-05-18

  CVE-2026-6341 Incomplete group locking implementation

  CVSS 4.3 mediumEPSS 0.15%

• 2026-05-18

  CVE-2026-6342 Group prefix matching bypass for subscriptions

  CVSS 4.3 mediumEPSS 0.15%

• 2026-05-18

  CVE-2026-3495 Unescaped variables during error page composition

  CVSS 3.8 lowEPSS 0.14%

• 2026-05-18

  CVE-2026-4273 Insufficient token rotation validation in remote cluster invite confirmation

  CVSS 3.7 lowEPSS 0.14%

• 2026-05-18

  CVE-2026-3637 Mattermost fails to enforce create_post permission when editing posts

  CVSS 4.3 mediumEPSS 0.15%

• 2026-05-18

  CVE-2026-2325 Improper Input Validation in MS Teams Meetings API Handler

  CVSS 4.3 mediumEPSS 0.24%

• 2026-05-18

  CVE-2026-28759 Insufficient authorization in shared channel membership sync allows remote cluster to remove users from arbitrary channels

  CVSS 4.3 mediumEPSS 0.15%

• 2026-05-18

  CVE-2026-6334 OAuth authorization code client binding not enforced during token redemption in Mattermost

  CVSS 3.1 lowEPSS 0.12%

• 2026-05-15

  CVE-2026-4053 post edit time limit is not enforced on some post update operations

  CVSS 3.1 lowEPSS 0.16%

• 2026-05-15

  CVE-2026-4054 SVG content served through Mattermost image proxy despite Content-Type restrictions causes client-side denial of service

  CVSS 4.3 mediumEPSS 0.24%

• 2026-04-15

  CVE-2026-3590 Race Condition in Guest Magic Link Authentication Allows Token Reuse

  CVSS 6.5 mediumEPSS 0.15%

• 2026-04-15

  CVE-2026-28741 CSRF Protection Bypass Allows Updating a User's Authentication Method

  CVSS 6.8 mediumEPSS 0.13%

• 2026-04-15

  CVE-2026-27769 Connected Workspaces: Malicious remote server can manipulate arbitrary user's status

  CVSS 2.7 lowEPSS 0.17%

• 2026-04-09

  CVE-2026-24661 Unbounded Request Body Read in MS Teams Plugin {{/changes}} Webhook Endpoint

  CVSS 3.7 lowEPSS 0.31%

• 2026-04-09

  CVE-2026-21388 Unbounded Request Body Read in MS Teams Plugin {{/lifecycle}} Webhook Endpoint

  CVSS 3.7 lowEPSS 0.31%

• 2026-04-06

  CVE-2026-3524 Authorization Bypass in Mattermost Legal Hold Plugin Due to Missing Return After Permission Check

  CVSS 8.3 highEPSS 0.38%

• 2026-04-03

  CVE-2026-28736 Focalboard IDOR in file content endpoint allows cross-user file access (unsupported product, no fix)

  CVSS 4.3 mediumEPSS 0.22%

• 2026-04-03

  CVE-2026-25773 Focalboard Second-Order SQL Injection in category reorder endpoint allows data exfiltration (unsupported product, no fix)

  CVSS 8.1 highEPSS 0.31%

• 2026-03-26

  CVE-2026-3112 Arbitrary File Read via Advanced Logging Support Packet

  CVSS 6.8 mediumEPSS 0.44%

• 2026-03-26

  CVE-2026-3109 Missing timestamp validation in Zoom webhook handler

  CVSS 2.2 lowEPSS 0.30%

• 2026-03-26

  CVE-2026-3115 Guest users can view group member IDs without respecting view restrictions

  CVSS 4.3 mediumEPSS 0.24%

• 2026-03-26

  CVE-2026-3114 Zip Bomb Denial of Service via Unrestricted Archive Decompression

  CVSS 6.5 mediumEPSS 0.36%

• 2026-03-26

  CVE-2026-3116 Improper Input Validation in Zoom Plugin Webhook Handler

  CVSS 4.9 mediumEPSS 0.36%

• 2026-03-26

  CVE-2026-3113 mmctl export download command doesn’t restrict permissions to created file to file owner

  CVSS 5.0 mediumEPSS 0.13%

• 2026-03-26

  CVE-2026-3108 Terminal Escape Injection in mmctl Report Posts Command

  CVSS 8.0 highEPSS 0.28%

• 2026-03-26

  CVE-2026-4274 Insufficient authorization in shared channel membership sync grants team-level access instead of channel-level access

  CVSS 5.4 mediumEPSS 0.14%

• 2026-03-25

  CVE-2026-27659 CSRF vulnerability in UpdateAccessControlPolicyActiveStatus endpoint

  CVSS 4.6 mediumEPSS 0.12%

• 2026-03-25

  CVE-2026-20719 DoS via URL Previews Rendering Malicious SVGs

  CVSS 4.3 mediumEPSS 0.36%

• 2026-03-25

  CVE-2026-27656 Account Takeover via Substring Matching in OpenID Connect Authentication

  CVSS 5.7 mediumEPSS 0.18%

• 2026-03-25

  CVE-2026-26233 Denial of Service via HTTP/2 single packet attack on login endpoint

  CVSS 4.3 mediumEPSS 0.31%

• 2026-03-16

  CVE-2026-1629 Permalink Preview Information Disclosure After Permission Revocation

  CVSS 4.3 mediumEPSS 0.23%

• 2026-03-16

  CVE-2026-26230 Team Admin Privilege Escalation to Demote Members to Guest

  CVSS 3.8 lowEPSS 0.16%

• 2026-03-16

  CVE-2026-2454 DoS in Calls plugin via malformed msgpack in websocket request.

  CVSS 5.8 mediumEPSS 0.29%

• 2026-03-16

  CVE-2026-26304 Permission Bypass in Playbook Run Creation

  CVSS 4.3 mediumEPSS 0.16%

• 2026-03-16

  CVE-2026-24692 Guest users can bypass read permissions via search API

  CVSS 4.3 mediumEPSS 0.17%

• 2026-03-16

  CVE-2026-22545 Password Change Bypass via Auth Switch Endpoint

  CVSS 3.1 lowEPSS 0.15%

• 2026-03-16

  CVE-2026-2455 SSRF bypass via IPv4-mapped IPv6 literals

  CVSS 4.3 mediumEPSS 0.17%

All vendors’ CVEs · JSON · Markdown

• CVE records from the CVE Program (cve.org). CVE® is a registered trademark of The MITRE Corporation. (opens in new tab)
• This product uses data from the NVD API but is not endorsed or certified by the NVD. (opens in new tab)
• Known Exploited Vulnerabilities catalog from CISA. (opens in new tab)
• EPSS scores from FIRST (Exploit Prediction Scoring System). (opens in new tab)