CVEs for Mattermost
311 matching vulnerabilities, 0 of them in CISA’s Known Exploited Vulnerabilities catalog, newest first.
CVEs mapped to a company Rewindex tracks (by CVE affected-product data, NVD CPE, vendor advisories and package feeds), every entry in CISA’s Known Exploited Vulnerabilities catalog, and CVEs named in a tracked status incident. Other CVEs are not listed.
Dates are the CVE publish date (or the KEV date added). Times are shown in UTC.
Each column is one week (Monday start, UTC), stacked by CVSS severity, by published date or the KEV date added. Dots mark entries added to CISA KEV that week. The last week is still in progress.
CVE-2026-21386 Private channel enumeration via /mute slash command
CVSS 4.3 mediumEPSS 0.19%Mattermost
CVE-2026-25780 Memory Exhaustion via Malformed DOC File Upload
CVSS 4.3 mediumEPSS 0.28%Mattermost
CVE-2026-4265 Guest user can upload files without permission across teams
CVSS 4.3 mediumEPSS 0.23%Mattermost
CVE-2026-25783 Denial of service via malformed User-Agent header in getBrowserVersion
CVSS 4.3 mediumEPSS 0.30%Mattermost
CVE-2026-24458 DoS attack via login attempts with multi-megabyte passwords
CVSS 7.5 highEPSS 0.28%Mattermost
CVE-2026-2462 Admin RCE via Malicious Plugin Upload on CI Test Instances
CVSS 6.6 mediumEPSS 0.34%Mattermost
CVE-2026-26246 Memory Exhaustion via Malformed PSD File Upload
CVSS 4.3 mediumEPSS 0.22%Mattermost
CVE-2026-2458 Unauthorized channel enumeration in private teams after member removal
CVSS 4.3 mediumEPSS 0.17%Mattermost
CVE-2026-2457 WebSocket Message Spoofing via Permalink Embed Manipulation
CVSS 4.3 mediumEPSS 0.11%Mattermost
CVE-2026-2463 Unauthorized access to invite ID during team creation
CVSS 4.3 mediumEPSS 0.17%Mattermost
CVE-2026-2456 Denial of Service via Unbounded Memory Allocation in Integration Actions
CVSS 5.3 mediumEPSS 0.17%Mattermost
CVE-2025-14573 Team Admin Bypass of Invite Permissions via allow_open_invite Field
CVSS 3.8 lowEPSS 0.18%Mattermost
CVE-2025-14350 Information disclosure via channel mentions in posts
CVSS 4.3 mediumEPSS 0.19%Mattermost
CVE-2025-13821 User profile update exposes password hash and MFA secrets
CVSS 5.7 mediumEPSS 0.24%Mattermost
CVE-2026-0997 Mattermost Zoom Plugin channel preference API lacks authorization checks
CVSS 4.3 mediumEPSS 0.18%Mattermost
CVE-2026-0999 Authentication bypass via userID login when email and username login are disabled
CVSS 5.4 mediumEPSS 0.20%Mattermost
CVE-2026-20796 Time-of-check time-of-use vulnerability in common teams API
CVSS 3.1 lowEPSS 0.22%Mattermost
CVE-2025-14435 Application-Level DoS via infinite re-render loop in user profile handling
CVSS 6.8 mediumEPSS 0.31%Mattermost
CVE-2025-14822 DoS from quadratic complexity in model.ParseHashtags
CVSS 3.1 lowEPSS 0.35%Mattermost
CVE-2025-64641 Mattermost Jira plugin crafted action leaks Jira issue details
CVSS 4.1 mediumEPSS 0.18%Mattermost
CVE-2025-13767 Unauthorized Read Access to Private Channel Posts via Mattermost Jira Plugin
CVSS 4.3 mediumEPSS 0.19%Mattermost
CVE-2025-14273 Mattermost Jira plugin user spoofing enables Jira request forgery.
CVSS 7.2 highEPSS 0.26%Mattermost
CVE-2025-12689 DoS in Calls plugin via malformed UTF-8 in WebSocket request
CVSS 6.5 mediumEPSS 0.29%Mattermost
CVE-2025-62690 Open redirect in error page when link opened in new tab
CVSS 3.1 lowEPSS 0.15%Mattermost
CVE-2025-62190 CSRF Allows Call Initiation and Message Delivery
CVSS 4.3 mediumEPSS 0.12%Mattermost
CVE-2025-13870 Unauthorized access and subscription vulnerability in Boards
CVSS 3.1 lowEPSS 0.22%Mattermost
CVE-2025-12421 Account Takeover via Code Exchange Endpoint
CVSS 9.9 criticalEPSS 0.42%Mattermost
CVE-2025-12559 Information Disclosure in Common Teams API
CVSS 4.3 mediumEPSS 0.22%Mattermost
CVE-2025-12419 Account takeover on OAuth/OpenID-enabled servers
CVSS 9.9 criticalEPSS 0.34%Mattermost
CVE-2025-55074 Channel member objects leak read status
CVSS 3.0 lowEPSS 0.18%Mattermost
CVE-2025-11794 Password hash and MFA secret returned in user email verification endpoint
CVSS 4.9 mediumEPSS 0.30%Mattermost
CVE-2025-55073 MS Teams plugin OAuth allows editing arbitrary posts
CVSS 5.4 mediumEPSS 0.20%Mattermost
CVE-2025-55070 Lack of MFA enforcement in WebSocket connections
CVSS 6.5 mediumEPSS 0.32%Mattermost
CVE-2025-11776 Guest user can discover archived public channels
CVSS 4.3 mediumEPSS 0.21%Mattermost
CVE-2025-59480 Inadequate validation of SSO redirect credentials permits credential theft
CVSS 6.1 mediumEPSS 0.15%Mattermost
CVE-2025-11777 Cross-team channel membership access
CVSS 3.1 lowEPSS 0.20%Mattermost
- CVE records from the CVE Program (cve.org). CVE® is a registered trademark of The MITRE Corporation. (opens in new tab)
- This product uses data from the NVD API but is not endorsed or certified by the NVD. (opens in new tab)
- Known Exploited Vulnerabilities catalog from CISA. (opens in new tab)
- EPSS scores from FIRST (Exploit Prediction Scoring System). (opens in new tab)