CVEs for Mattermost
311 matching vulnerabilities, 0 of them in CISA’s Known Exploited Vulnerabilities catalog, newest first.
CVEs mapped to a company Rewindex tracks (by CVE affected-product data, NVD CPE, vendor advisories and package feeds), every entry in CISA’s Known Exploited Vulnerabilities catalog, and CVEs named in a tracked status incident. Other CVEs are not listed.
Dates are the CVE publish date (or the KEV date added). Times are shown in UTC.
Each column is one week (Monday start, UTC), stacked by CVSS severity, by published date or the KEV date added. Dots mark entries added to CISA KEV that week. The last week is still in progress.
CVE-2026-16048 Channel member roles accept out-of-scope roles
CVSS 6.3 mediumEPSS 0.26%Mattermost
CVE-2026-10819 Mattermost Server Denial of Service via Animated GIF Emoji Upload
CVSS 6.5 mediumEPSS 0.42%Mattermost
CVE-2026-10600 Denial of service via unbounded document content extraction in Mattermost Server
CVSS 4.3 mediumEPSS 0.37%Mattermost
CVE-2026-8075 Posting a malicious markdown image crashes the Mattermost Desktop App
CVSS 6.5 mediumEPSS 0.42%Mattermost
CVE-2026-6541 Unscoped updates to other playbooks' metric configuration
CVSS 4.3 mediumEPSS 0.25%Mattermost
CVE-2026-9820 Mattermost schemes teams endpoint exposes private team invite IDs
CVSS 3.8 lowEPSS 0.26%Mattermost
CVE-2026-9824 Remote cluster metadata enumeration via /share-channel autocomplete
CVSS 4.3 mediumEPSS 0.27%Mattermost
CVE-2026-9708 Incoming webhook user attribution via unvalidated webhook owner
CVSS 4.9 mediumEPSS 0.36%Mattermost
CVE-2026-4339 SSRF via unvalidated attachment URLs in Mattermost Agents plugin MCP server
CVSS 6.5 mediumEPSS 0.14%Mattermost
CVE-2026-13426 Client4 fails to validate path parameters
CVSS 5.4 mediumEPSS 0.29%Mattermost
CVE-2026-2299 Improper Access Control in Mattermost Google Drive Plugin File Creation Endpoint
CVSS 4.2 mediumEPSS 0.20%Mattermost
CVE-2026-6062 IDOR in Jira plugin subscription edit endpoint
CVSS 6.4 mediumEPSS 0.24%Mattermost
CVE-2026-9162 Global session revocation does not invalidate active WebSocket connections
CVSS 4.3 mediumEPSS 0.33%Mattermost
CVE-2026-5139 GitLab Plugin Allows Non-Admin Users to Modify Default Instance Configuration
CVSS 5.4 mediumEPSS 0.29%Mattermost
CVE-2026-8683 Overly long URLs crash the Mattermost Desktop App
CVSS 6.5 mediumEPSS 0.20%Mattermost
CVE-2026-7184 Mattermost Remote Cluster PATCH API Leaks Authentication Tokens
CVSS 6.5 mediumEPSS 0.26%Mattermost
CVE-2026-6739 Mattermost: Delegated admins could patch protected default system roles
CVSS 6.7 mediumEPSS 0.26%Mattermost
CVE-2026-4915 Server panic via outgoing webhook responses
CVSS 6.5 mediumEPSS 0.28%Mattermost
CVE-2026-28735 GitHub OAuth Scope Validation
CVSS 5.4 mediumEPSS 0.14%Mattermost
CVE-2026-4635 Persistent notification timing attack causing server denial of service
CVSS 6.5 mediumEPSS 0.17%Mattermost
CVE-2026-4646 Insufficient input validation in GitHub plugin API causes denial of service
CVSS 4.3 mediumEPSS 0.25%Mattermost
CVE-2026-3636 Sanitize team member data returned by API
CVSS 4.3 mediumEPSS 0.18%Mattermost
CVE-2026-5308 Missing request body size limits on Zoom plugin HTTP endpoints
CVSS 4.9 mediumEPSS 0.25%Mattermost
CVE-2026-5755 Denial of service via crafted TIFF file upload
CVSS 6.5 mediumEPSS 0.25%Mattermost
CVE-2026-22880 Mobile SSO authentication flow allows credential theft via malicious server
CVSS 6.1 mediumEPSS 0.12%Mattermost
CVE-2026-4055 Insufficient permission validation on cross-team playbook run creation
CVSS 4.3 mediumEPSS 0.15%Mattermost
- CVE records from the CVE Program (cve.org). CVE® is a registered trademark of The MITRE Corporation. (opens in new tab)
- This product uses data from the NVD API but is not endorsed or certified by the NVD. (opens in new tab)
- Known Exploited Vulnerabilities catalog from CISA. (opens in new tab)
- EPSS scores from FIRST (Exploit Prediction Scoring System). (opens in new tab)