Mattermost CVEs
311 vulnerabilities mapped to Mattermost’s software or packages, 0 of them in CISA’s Known Exploited Vulnerabilities catalog, newest first. Not a statement that the hosted service was exposed.
CVEs mapped to a company Rewindex tracks (by CVE affected-product data, NVD CPE, vendor advisories and package feeds), every entry in CISA’s Known Exploited Vulnerabilities catalog, and CVEs named in a tracked status incident. Other CVEs are not listed. Same list on the all-vendor CVE index.
Each column is one week (Monday start, UTC), stacked by CVSS severity, by published date or the KEV date added. Dots mark entries added to CISA KEV that week. The last week is still in progress.
CVE-2026-21386 Private channel enumeration via /mute slash command
CVSS 4.3 mediumEPSS 0.19%
CVE-2026-25780 Memory Exhaustion via Malformed DOC File Upload
CVSS 4.3 mediumEPSS 0.28%
CVE-2026-4265 Guest user can upload files without permission across teams
CVSS 4.3 mediumEPSS 0.23%
CVE-2026-25783 Denial of service via malformed User-Agent header in getBrowserVersion
CVSS 4.3 mediumEPSS 0.30%
CVE-2026-24458 DoS attack via login attempts with multi-megabyte passwords
CVSS 7.5 highEPSS 0.28%
CVE-2026-2462 Admin RCE via Malicious Plugin Upload on CI Test Instances
CVSS 6.6 mediumEPSS 0.34%
CVE-2026-2578 Information Disclosure via WebSocket Event When Deleting Unrevealed Burn on Read Posts
CVSS 4.3 mediumEPSS 0.23%
CVE-2026-26246 Memory Exhaustion via Malformed PSD File Upload
CVSS 4.3 mediumEPSS 0.22%
CVE-2026-2458 Unauthorized channel enumeration in private teams after member removal
CVSS 4.3 mediumEPSS 0.17%
CVE-2026-2457 WebSocket Message Spoofing via Permalink Embed Manipulation
CVSS 4.3 mediumEPSS 0.11%
CVE-2026-2463 Unauthorized access to invite ID during team creation
CVSS 4.3 mediumEPSS 0.17%
CVE-2026-2476 MS Teams plugin sensitive config values not properly masked in support packets
CVSS 7.6 highEPSS 0.18%
CVE-2026-2456 Denial of Service via Unbounded Memory Allocation in Integration Actions
CVSS 5.3 mediumEPSS 0.17%
CVE-2025-14573 Team Admin Bypass of Invite Permissions via allow_open_invite Field
CVSS 3.8 lowEPSS 0.18%
CVE-2026-1046 Arbitrary application execution via unvalidated server-controlled URLs in Help menu
CVSS 7.6 highEPSS 0.26%
CVE-2025-14350 Information disclosure via channel mentions in posts
CVSS 4.3 mediumEPSS 0.19%
CVE-2025-13821 User profile update exposes password hash and MFA secrets
CVSS 5.7 mediumEPSS 0.24%
CVE-2026-0997 Mattermost Zoom Plugin channel preference API lacks authorization checks
CVSS 4.3 mediumEPSS 0.18%
CVE-2026-0999 Authentication bypass via userID login when email and username login are disabled
CVSS 5.4 mediumEPSS 0.20%
CVE-2026-20796 Time-of-check time-of-use vulnerability in common teams API
CVSS 3.1 lowEPSS 0.22%
CVE-2025-14435 Application-Level DoS via infinite re-render loop in user profile handling
CVSS 6.8 mediumEPSS 0.31%
CVE-2025-14822 DoS from quadratic complexity in model.ParseHashtags
CVSS 3.1 lowEPSS 0.35%
CVE-2025-64641 Mattermost Jira plugin crafted action leaks Jira issue details
CVSS 4.1 mediumEPSS 0.18%
CVE-2025-13767 Unauthorized Read Access to Private Channel Posts via Mattermost Jira Plugin
CVSS 4.3 mediumEPSS 0.19%
CVE-2025-14273 Mattermost Jira plugin user spoofing enables Jira request forgery.
CVSS 7.2 highEPSS 0.26%
CVE-2025-13324 Lack of Invalidation of Legacy Remote Cluster Invite Tokens After Confirmation
CVSS 3.7 lowEPSS 0.20%
CVE-2025-12689 DoS in Calls plugin via malformed UTF-8 in WebSocket request
CVSS 6.5 mediumEPSS 0.29%
CVE-2025-62690 Open redirect in error page when link opened in new tab
CVSS 3.1 lowEPSS 0.15%
CVE-2025-62190 CSRF Allows Call Initiation and Message Delivery
CVSS 4.3 mediumEPSS 0.12%
CVE-2025-13870 Unauthorized access and subscription vulnerability in Boards
CVSS 3.1 lowEPSS 0.22%
CVE-2025-12421 Account Takeover via Code Exchange Endpoint
CVSS 9.9 criticalEPSS 0.42%
CVE-2025-12559 Information Disclosure in Common Teams API
CVSS 4.3 mediumEPSS 0.22%
CVE-2025-12419 Account takeover on OAuth/OpenID-enabled servers
CVSS 9.9 criticalEPSS 0.34%
CVE-2025-55074 Channel member objects leak read status
CVSS 3.0 lowEPSS 0.18%
CVE-2025-11794 Password hash and MFA secret returned in user email verification endpoint
CVSS 4.9 mediumEPSS 0.30%
CVE-2025-55073 MS Teams plugin OAuth allows editing arbitrary posts
CVSS 5.4 mediumEPSS 0.20%
CVE-2025-55070 Lack of MFA enforcement in WebSocket connections
CVSS 6.5 mediumEPSS 0.32%
CVE-2025-41436 Unauthorized access to archived channel content via threads interface
CVSS 3.1 lowEPSS 0.18%
CVE-2025-11776 Guest user can discover archived public channels
CVSS 4.3 mediumEPSS 0.21%
CVE-2025-59480 Inadequate validation of SSO redirect credentials permits credential theft
CVSS 6.1 mediumEPSS 0.15%
CVE-2025-11777 Cross-team channel membership access
CVSS 3.1 lowEPSS 0.20%
All vendors’ CVEs · JSON · Markdown
- CVE records from the CVE Program (cve.org). CVE® is a registered trademark of The MITRE Corporation. (opens in new tab)
- This product uses data from the NVD API but is not endorsed or certified by the NVD. (opens in new tab)
- Known Exploited Vulnerabilities catalog from CISA. (opens in new tab)
- EPSS scores from FIRST (Exploit Prediction Scoring System). (opens in new tab)