CVEs for Mattermost
311 matching vulnerabilities, 0 of them in CISA’s Known Exploited Vulnerabilities catalog, newest first.
CVEs mapped to a company Rewindex tracks (by CVE affected-product data, NVD CPE, vendor advisories and package feeds), every entry in CISA’s Known Exploited Vulnerabilities catalog, and CVEs named in a tracked status incident. Other CVEs are not listed.
Dates are the CVE publish date (or the KEV date added). Times are shown in UTC.
Each column is one week (Monday start, UTC), stacked by CVSS severity, by published date or the KEV date added. Dots mark entries added to CISA KEV that week. The last week is still in progress.
CVE-2026-13411 Null condition in Playbooks import crashes the plugin
CVSS 4.3 mediumEPSS 0.32%Mattermost
CVE-2026-18256 Private team metadata disclosure via the team search API
CVSS 4.3 mediumEPSS 0.16%Mattermost
CVE-2026-16453 Mattermost SAML RelayState forgery allows unauthorized team membership
CVSS 7.1 highEPSS 0.19%Mattermost
CVE-2026-19603 Private channel ID disclosure via user status endpoints
CVSS 4.3 mediumEPSS 0.18%Mattermost
CVE-2026-18795 Missing server side validation allowed user to quarantine a DM and GM post
CVSS 6.4 mediumEPSS 0.15%Mattermost
CVE-2026-19601 Disclosure of AD/LDAP bind password via Test Connection
CVSS 4.9 mediumEPSS 0.23%Mattermost
CVE-2026-18551 Mattermost guest account privilege escalation via member roles API
CVSS 6.5 mediumEPSS 0.22%Mattermost
CVE-2026-19541 Outgoing OAuth connection client secret exposure during connection validation
CVSS 6.5 mediumEPSS 0.22%Mattermost
CVE-2026-95666 Unbounded post ID array in the bulk reactions endpoint allows denial of service
CVSS 4.3 mediumEPSS 0.37%Mattermost
CVE-2026-75588 Mattermost Desktop App plugin popout scheme validation bypass
CVSS 2.6 lowEPSS 0.22%Mattermost
CVE-2026-75025 Mattermost Desktop local network access from server-rendered content
CVSS 4.7 mediumEPSS 0.16%Mattermost
CVE-2026-91181 Data Retention Teams Endpoint Leaks Private Team Invite ID
CVSS 6.5 mediumEPSS 0.39%Mattermost
CVE-2026-82920 Mattermost ABAC parent policy bypass via policy update endpoint
CVSS 5.5 mediumEPSS 0.26%Mattermost
CVE-2026-86349 Mattermost Server Algorithmic DoS via Unbounded Markdown Block Nesting
CVSS 4.3 mediumEPSS 0.37%Mattermost
CVE-2026-13417 Boards plugin denial of service via unvalidated block fields.properties
CVSS 4.3 mediumEPSS 0.37%Mattermost
CVE-2026-8821 Playbooks run owner channel membership permission bypass
CVSS 7.1 highEPSS 0.29%Mattermost
CVE-2026-5132 Unbounded zlib decompression in Calls SDP WebSocket messages
CVSS 6.5 mediumEPSS 0.42%Mattermost
CVE-2026-10542 Playbooks channel action update validation issue
CVSS 5.0 mediumEPSS 0.12%Mattermost
CVE-2026-14344 Inconsistent authorization checks in Mattermost Boards endpoints
CVSS 4.3 mediumEPSS 0.25%Mattermost
CVE-2026-12882 Mattermost Markdown autolink parsing denial of service
CVSS 4.3 mediumEPSS 0.37%Mattermost
CVE-2026-14259 Board archive import bypasses team board creation permissions
CVSS 4.3 mediumEPSS 0.25%Mattermost
CVE-2026-10080 Boards plugin panics on WebSocket command with non-string field types
CVSS 6.5 mediumEPSS 0.42%Mattermost
CVE-2026-10527 Boards plugin retains Board Admin rights for users demoted to System Guest
CVSS 6.3 mediumEPSS 0.26%Mattermost
CVE-2026-16047 Board channel linking without read channel permission validation
CVSS 4.3 mediumEPSS 0.27%Mattermost
CVE-2026-16046 Missing run-state validation on finished playbook runs
CVSS 3.5 lowEPSS 0.25%Mattermost
- CVE records from the CVE Program (cve.org). CVE® is a registered trademark of The MITRE Corporation. (opens in new tab)
- This product uses data from the NVD API but is not endorsed or certified by the NVD. (opens in new tab)
- Known Exploited Vulnerabilities catalog from CISA. (opens in new tab)
- EPSS scores from FIRST (Exploit Prediction Scoring System). (opens in new tab)