CVEs for Mattermost
311 matching vulnerabilities, 0 of them in CISA’s Known Exploited Vulnerabilities catalog, newest first.
CVEs mapped to a company Rewindex tracks (by CVE affected-product data, NVD CPE, vendor advisories and package feeds), every entry in CISA’s Known Exploited Vulnerabilities catalog, and CVEs named in a tracked status incident. Other CVEs are not listed.
Dates are the CVE publish date (or the KEV date added). Times are shown in UTC.
Each column is one week (Monday start, UTC), stacked by CVSS severity, by published date or the KEV date added. Dots mark entries added to CISA KEV that week. The last week is still in progress.
CVE-2025-55035 Mattermost Desktop DoS when user has basic authentication server configured
CVSS 6.1 mediumEPSS 0.32%Mattermost
CVE-2025-58073 Arbitrary Mattermost Team can be joined by manipulating the OAuth state
CVSS 8.1 highEPSS 0.42%Mattermost
CVE-2025-41410 Slack import bypasses email verification for team access controls
CVSS 5.4 mediumEPSS 0.30%Mattermost
CVE-2025-10545 Guest user can add unauthorized team users to private channels
CVSS 3.1 lowEPSS 0.33%Mattermost
CVE-2025-54499 Insecure string comparison enables timing attacks
CVSS 3.1 lowEPSS 0.27%Mattermost
CVE-2025-41443 Guest user can discover active public channels
CVSS 4.3 mediumEPSS 0.31%Mattermost
CVE-2025-11579 DoS via Out Of Memory Crash
CVSS 5.3 mediumEPSS 0.37%Mattermost
CVE-2025-9084 Open redirect in OAuth login
CVSS 3.1 lowEPSS 0.17%Mattermost
CVE-2025-9078 Weak cache keys lead to post IDOR and link preview poisoning
CVSS 4.3 mediumEPSS 0.15%Mattermost
CVE-2025-8402 Nil pointer dereference in bulk import crashes server
CVSS 4.9 mediumEPSS 0.32%Mattermost
CVE-2025-6465 Path traversal in image upload with preview overwrite
CVSS 4.3 mediumEPSS 0.77%Mattermost
CVE-2025-47870 Team invite ID leaked to team admin with no member invite privileges
CVSS 4.3 mediumEPSS 0.22%Mattermost
CVE-2025-49222 Mattermost Shared Channel Upload Type Validation Bypass
CVSS 6.8 mediumEPSS 0.30%Mattermost
CVE-2025-8023 Path Traversal in Template Upload Allows Uploading Files Outside Target Directory
CVSS 6.8 mediumEPSS 0.41%Mattermost
CVE-2025-47700 AI plugin APIs can be triggered using post actions
CVSS 3.5 lowEPSS 0.19%Mattermost
CVE-2025-49810 Thread summarization allows persistent access to channel
CVSS 3.5 lowEPSS 0.20%Mattermost
CVE-2025-36530 Import Path Traversal Enables Unauthorized Unsigned Plugin Installation
CVSS 6.8 mediumEPSS 0.49%Mattermost
CVE-2025-8285 Unauthorized Channel Subscription Creation in Mattermost Confluence Plugin
CVSS 4.0 mediumEPSS 0.20%Mattermost
CVE-2025-53910 Unauthorized Channel Subscription Edit in Mattermost Confluence Plugin
CVSS 4.0 mediumEPSS 0.20%Mattermost
CVE-2025-44001 Unauthorized Channel Subscription Read in Mattermost Confluence Plugin
CVSS 4.0 mediumEPSS 0.21%Mattermost
CVE-2025-6227 Invite token is used as part of the secure communication
CVSS 2.2 lowEPSS 0.22%Mattermost
CVE-2025-6233 Arbitrary file read by system admin via path traversal
CVSS 6.8 mediumEPSS 0.45%Mattermost
CVE-2025-6226 IDOR in CreatePost API allows for timeboxed message disclosure
CVSS 6.5 mediumEPSS 0.37%Mattermost
CVE-2025-3228 Unauthorized Guest user access to Playbook
CVSS 4.3 mediumEPSS 0.29%Mattermost
CVE-2025-3227 Unauthorized channel member management through playbook runs
CVSS 4.3 mediumEPSS 0.25%Mattermost
CVE-2025-4981 Path Traversal Leading to RCE by Any Authenticated Mattermost User
CVSS 9.9 criticalEPSS 1.0%Mattermost
CVE-2025-4128 Mattermost Guest User Information Disclosure Vulnerability
CVSS 3.1 lowEPSS 0.22%Mattermost
CVE-2025-4573 LDAP Injection in Mattermost Enterprise Edition When Using Active Directory
CVSS 4.1 mediumEPSS 0.28%Mattermost
CVE-2025-2571 Google OAuth Authentication Bypass for Converted Bot Accounts
CVSS 4.2 mediumEPSS 0.21%Mattermost
- CVE records from the CVE Program (cve.org). CVE® is a registered trademark of The MITRE Corporation. (opens in new tab)
- This product uses data from the NVD API but is not endorsed or certified by the NVD. (opens in new tab)
- Known Exploited Vulnerabilities catalog from CISA. (opens in new tab)
- EPSS scores from FIRST (Exploit Prediction Scoring System). (opens in new tab)