MS
Product
Mattermost Server
501
CVEs
0
On KEV
9.9
Max CVSS
15
New 30D
Severity mix
Critical 17High 86Medium 356Low 41
Watch
Add Mattermost Server to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2026-4858 | 9.9 | May 21 | Path traversal in integration action URL leading to arbitrary API execution via system admin’s auth token. Affected: 10.11.0 before 10.11.15; 11.4.0 before 11.4.5; 11.5.0 before 11.5.4; 11.6.0 |
| CVE-2025-12421 | 9.9 | Nov 27 | Account Takeover via Code Exchange Endpoint Affected: 10.5.0 before 10.5.13; 10.11.0 before 10.11.5; 10.12.0 before 10.12.2; 11.0.0 before 11.0.3 |
| CVE-2025-12419 | 9.9 | Nov 27 | Account takeover on OAuth/OpenID-enabled servers Affected: 10.5.0 before 10.5.13; 10.11.0 before 10.11.5; 10.12.0 before 10.12.2; 11.0.0 before 11.0.4 |
| CVE-2025-4981 | 9.9 | Jun 20 | Path Traversal Leading to RCE by Any Authenticated Mattermost User Affected: 9.11.0 before 9.11.16; 10.5.0 before 10.5.6; 10.6.0 before 10.6.6; 10.7.0 before 10.7.3; 10.8.0; 10.8.0; +2 more |
| CVE-2023-6458 | 9.8 | Dec 6 | Client side path traversal due to lack of route parameters validation Affected: before 7.8.14; 8.0.0 before 8.1.5; 9.0.0 before 9.0.3; 9.1.0 before 9.1.2 |
| CVE-2017-18920 | 9.8 | Jun 19 | An issue was discovered in Mattermost Server before 3.6.2 Affected: before 3.6.2 |
| CVE-2017-18915 | 9.8 | Jun 19 | An issue was discovered in Mattermost Server before 3.8.2, 3.7.5, and 3.6.7 Affected: 3.6.0 before 3.6.7; 3.7.0 before 3.7.5; 3.8.0 before 3.8.2 |
| CVE-2017-18908 | 9.8 | Jun 19 | An issue was discovered in Mattermost Server before 4.0.0, 3.10.2, and 3.9.2 Affected: before 3.9.2; 3.10.0 before 3.10.2 |
| CVE-2016-11074 | 9.8 | Jun 19 | An issue was discovered in Mattermost Server before 3.0.0 Affected: before 3.0.0 |
| CVE-2017-18912 | 9.8 | Jun 19 | An issue was discovered in Mattermost Server before 3.8.2, 3.7.5, and 3.6.7 Affected: before 3.6.7; 3.7.0 before 3.7.5; 3.8.0 before 3.8.2 |
| CVE-2017-18900 | 9.8 | Jun 19 | An issue was discovered in Mattermost Server before 4.1.0, 4.0.4, and 3.10.3 Affected: before 3.10.3; 4.0.0 before 4.0.4 |
| CVE-2017-18888 | 9.8 | Jun 19 | An issue was discovered in Mattermost Server before 4.3.0, 4.2.1, and 4.1.2 Affected: before 4.1.2; 4.2.0 before 4.2.1; 4.3.0; 4.3.0; 4.3.0; 4.3.0 |
| CVE-2017-18885 | 9.8 | Jun 19 | An issue was discovered in Mattermost Server before 4.3.0, 4.2.1, and 4.1.2 Affected: before 4.1.2; 4.2.0 before 4.2.1; 4.3.0; 4.3.0; 4.3.0; 4.3.0 |
| CVE-2018-21251 | 9.8 | Jun 19 | An issue was discovered in Mattermost Server before 5.2 and 5.1.1 Affected: before 5.1.1; 5.2.0; 5.2.0; 5.2.0; 5.2.0; 5.2.0; +1 more |
| CVE-2026-12985 | 9.3 | Sep 14 | Mattermost DCR redirect URI allowlist bypass via improper URL component validation Affected: 11.7.0 before 11.7.8; 11.8.0 before 11.8.5; 11.9.0 before 11.9.1 |
| CVE-2017-18911 | 9.1 | Jun 19 | An issue was discovered in Mattermost Server before 3.8.2, 3.7.5, and 3.6.7 Affected: before 3.6.7; 3.7.0 before 3.7.5; 3.8.0 before 3.8.2 |
| CVE-2017-18883 | 9.1 | Jun 19 | An issue was discovered in Mattermost Server before 4.3.0, 4.2.1, and 4.1.2, when serving as an OAuth 2.0 Service Provider Affected: before 4.1.2; 4.2.0 before 4.2.1; 4.3.0; 4.3.0; 4.3.0; 4.3.0 |
| CVE-2026-7387 | 8.8 | Jun 12 | Mattermost group syncable endpoints allow privilege escalation via scheme_admin Affected: 10.11.0 before 10.11.17; 11.5.0 before 11.5.5; 11.6.0 before 11.6.2 |
| CVE-2026-3108 | 8.8 | Mar 26 | Terminal Escape Injection in mmctl Report Posts Command Affected: 10.11.0 before 10.11.11; 11.2.0 before 11.2.3; 11.3.0 before 11.3.2; 11.4.0 |
| CVE-2025-25068 | 8.8 | Mar 21 | Bypassing MFA Enforcement on Plugin Endpoints Affected: 9.11.0 before 9.11.9; 10.3.0 before 10.3.4; 10.4.0 before 10.4.3; 10.5.0 before 10.5.1 |
| CVE-2025-25274 | 8.8 | Mar 21 | Unauthorized Command Execution in Archived Channels Affected: 9.11.0 before 9.11.9; 10.3.0 before 10.3.4; 10.4.0 before 10.4.3 |
| CVE-2025-1412 | 8.8 | Feb 24 | Session Persistence After User-to-Bot Conversion Affected: 9.11.0 before 9.11.7; 10.4.0 before 10.4.2 |
| CVE-2024-2450 | 8.8 | Mar 15 | Mattermost versions 8.1.x before 8.1.10, 9.2.x before 9.2.6, 9.3.x before 9.3.2, and 9.4.x before 9.4.3 fail to correctly verify account ownership when switching from email to… Affected: 8.1.0 before 8.1.10; 9.2.0 before 9.2.6; 9.3.0 before 9.3.2; 9.4.0 before 9.4.3; 9.5.0 |
| CVE-2023-45316 | 8.8 | Dec 12 | Reflected client side path traversal leading to CSRF in Playbooks Affected: through 7.8.14; 8.0.0 through 8.1.5; 9.0.0 through 9.0.3; 9.1.1 through 9.1.2; 9.2.0 through 9.2.1 |
| CVE-2023-2515 | 8.8 | May 12 | Privilege escalation to system admin via personal access tokens Affected: before 7.1.8; 7.2.0 before 7.7.4; 7.8.0 before 7.8.3; 7.9.0 before 7.9.2 |
| CVE-2022-1384 | 8.8 | Apr 19 | Mattermost version 6.4.x and earlier fails to properly check the plugin version when a plugin is installed from the Marketplace, which allows an authenticated and an authorized… Affected: before 6.5.0 |
| CVE-2017-18903 | 8.8 | Jun 19 | An issue was discovered in Mattermost Server before 4.0.0, 3.10.2, and 3.9.2 Affected: before 3.9.2; 3.10.0 before 3.10.2 |
| CVE-2017-18886 | 8.8 | Jun 19 | An issue was discovered in Mattermost Server before 4.3.0, 4.2.1, and 4.1.2 Affected: before 4.1.2; 4.2.0 before 4.2.1; 4.3.0; 4.3.0; 4.3.0; 4.3.0 |
| CVE-2018-21264 | 8.8 | Jun 19 | An issue was discovered in Mattermost Server before 4.7.0, 4.6.2, and 4.5.2 Affected: before 4.5.2; 4.6.0 before 4.6.2; 4.7.0; 4.7.0; 4.7.0; 4.7.0 |
| CVE-2018-21263 | 8.8 | Jun 19 | An issue was discovered in Mattermost Server before 4.7.0, 4.6.2, and 4.5.2 Affected: before 4.5.2; 4.6.0 before 4.6.2; 4.7.0; 4.7.0; 4.7.0; 4.7.0 |
| CVE-2019-20865 | 8.8 | Jun 19 | An issue was discovered in Mattermost Server before 5.12.0, 5.11.1, 5.10.2, 5.9.2, and 4.10.10 Affected: before 4.10.10; 5.9.0 before 5.9.2; 5.10.0 before 5.10.2; 5.11.0 before 5.11.1; 5.12.0; 5.12.0; +4 more |
| CVE-2019-20841 | 8.8 | Jun 19 | An issue was discovered in Mattermost Server before 5.18.0, 5.17.2, 5.16.4, 5.15.4, and 5.9.7 Affected: before 5.9.7; 5.15.0 before 5.15.4; 5.16.0 before 5.16.4; 5.17.0 before 5.17.2; 5.18.0; 5.18.0; +2 more |
| CVE-2026-6346 | 8.7 | May 18 | Sensitive credentials exposed in plaintext in Mattermost support packets Affected: 10.11.0 before 10.11.14; 11.4.0 before 11.4.4; 11.5.0 before 11.5.2 |
| CVE-2026-2454 | 8.6 | Mar 16 | DoS in Calls plugin via malformed msgpack in websocket request. Affected: 10.11.0 before 10.11.11; 11.2.0 before 11.2.3; 11.3.0 before 11.3.1 |
| CVE-2026-9816 | 8.3 | Aug 17 | Insufficient server-side validation of board member role fields permits privilege escalation Affected: 10.11.0 before 10.11.22; 11.7.0 before 11.7.7; 11.8.0 before 11.8.4 |
| CVE-2025-14273 | 8.3 | Dec 22 | Mattermost Jira plugin user spoofing enables Jira request forgery. Affected: 10.11.0 before 10.11.8; 10.12.0 before 10.12.4; 11.0.0 before 11.0.6; 11.1.0 before 11.1.1 |
| CVE-2023-4478 | 8.2 | Aug 25 | Parameter tampering in the registration resulting in blocked accounts to be created Affected: before 7.8.9; 7.9.0 before 7.10.5; 8.0.0 |
| CVE-2023-3591 | 8.2 | Jul 17 | Lack of previous password reset tokens on new token creation Affected: 7.8.0 before 7.8.7; 7.9.0 before 7.9.5; 7.10.0 before 7.10.3 |
| CVE-2026-28741 | 8.1 | Apr 15 | CSRF Protection Bypass Allows Updating a User's Authentication Method Affected: 10.11.0 before 10.11.13; 11.3.0 before 11.3.3; 11.4.0 before 11.4.3; 11.5.0 before 11.5.1 |
| CVE-2025-58073 | 8.1 | Oct 16 | Arbitrary Mattermost Team can be joined by manipulating the OAuth state Affected: 10.5.0 before 10.5.11; 10.10.0 before 10.10.3; 10.11.0 before 10.11.3 |
| CVE-2025-58075 | 8.1 | Oct 16 | Arbitrary Mattermost Team can be joined by manipulating the SAML RelayState Affected: 10.5.0 before 10.5.11; 10.10.0 before 10.10.3; 10.11.0 before 10.11.3 |
| CVE-2023-3581 | 8.1 | Jul 17 | WebSockets accept connections from HTTPS origin Affected: 7.8.0 before 7.8.7; 7.9.0 before 7.9.5; 7.10.0 before 7.10.3 |
| CVE-2017-18906 | 8.1 | Jun 19 | An issue was discovered in Mattermost Server before 4.0.0, 3.10.2, and 3.9.2, when Single Sign-On OAuth2 is used Affected: before 3.9.2; 3.10.0 before 3.10.2 |
| CVE-2017-18894 | 8.1 | Jun 19 | An issue was discovered in Mattermost Server before 4.2.0, 4.1.1, and 4.0.5, when used as an OAuth 2.0 service provider Affected: before 4.0.5; 4.1.0 before 4.1.1; 4.2.0; 4.2.0; 4.2.0; 4.2.0 |
| CVE-2017-18884 | 8.1 | Jun 19 | An issue was discovered in Mattermost Server before 4.3.0, 4.2.1, and 4.1.2 Affected: before 4.1.2; 4.2.0 before 4.2.1; 4.3.0; 4.3.0; 4.3.0; 4.3.0 |
| CVE-2026-6961 | 7.6 | Jun 12 | CVE-2026-6961: Path traversal via unsanitized FileInfo.Name in Mattermost federation sync Affected: 10.11.0 before 10.11.17; 11.5.0 before 11.5.5; 11.6.0 before 11.6.2 |
| CVE-2026-6347 | 7.6 | May 18 | Mattermost Calls plugin exposes TURN server credentials in plaintext in support packets Affected: 10.11.0 before 10.11.14; 11.4.0 before 11.4.4; 11.5.0 before 11.5.2 |
| CVE-2026-5740 | 7.5 | May 22 | Unauthenticated WebSocket binary frame causes denial of service in Mattermost Server Affected: 10.11.0 before 10.11.15; 11.4.0 before 11.4.5; 11.5.0 before 11.5.4; 11.6.0 before 11.6.1 |
| CVE-2026-5308 | 7.5 | May 22 | Missing request body size limits on Zoom plugin HTTP endpoints Affected: 10.11.0 before 10.11.15; 11.4.0 before 11.4.5; 11.5.0 before 11.5.4; 11.6.0 before 11.6.1 |
| CVE-2026-20719 | 7.5 | Mar 25 | DoS via URL Previews Rendering Malicious SVGs Affected: 10.11.0 before 10.11.12; 11.2.0 before 11.2.4; 11.3.0 before 11.3.2; 11.4.0 before 11.4.1 |
The 500 most important CVEs for this product (exploited first, then by severity)