MS
Product
Mattermost Server
501
CVEs
0
On KEV
9.9
Max CVSS
15
New 30D
Severity mix
Critical 17High 86Medium 356Low 41
Watch
Add Mattermost Server to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2026-7387 | 8.8 | Jun 12 | Mattermost group syncable endpoints allow privilege escalation via scheme_admin Affected: 10.11.0 before 10.11.17; 11.5.0 before 11.5.5; 11.6.0 before 11.6.2 |
| CVE-2026-3108 | 8.8 | Mar 26 | Terminal Escape Injection in mmctl Report Posts Command Affected: 10.11.0 before 10.11.11; 11.2.0 before 11.2.3; 11.3.0 before 11.3.2; 11.4.0 |
| CVE-2025-25068 | 8.8 | Mar 21 | Bypassing MFA Enforcement on Plugin Endpoints Affected: 9.11.0 before 9.11.9; 10.3.0 before 10.3.4; 10.4.0 before 10.4.3; 10.5.0 before 10.5.1 |
| CVE-2025-25274 | 8.8 | Mar 21 | Unauthorized Command Execution in Archived Channels Affected: 9.11.0 before 9.11.9; 10.3.0 before 10.3.4; 10.4.0 before 10.4.3 |
| CVE-2025-1412 | 8.8 | Feb 24 | Session Persistence After User-to-Bot Conversion Affected: 9.11.0 before 9.11.7; 10.4.0 before 10.4.2 |
| CVE-2024-2450 | 8.8 | Mar 15 | Mattermost versions 8.1.x before 8.1.10, 9.2.x before 9.2.6, 9.3.x before 9.3.2, and 9.4.x before 9.4.3 fail to correctly verify account ownership when switching from email to… Affected: 8.1.0 before 8.1.10; 9.2.0 before 9.2.6; 9.3.0 before 9.3.2; 9.4.0 before 9.4.3; 9.5.0 |
| CVE-2023-45316 | 8.8 | Dec 12 | Reflected client side path traversal leading to CSRF in Playbooks Affected: through 7.8.14; 8.0.0 through 8.1.5; 9.0.0 through 9.0.3; 9.1.1 through 9.1.2; 9.2.0 through 9.2.1 |
| CVE-2023-2515 | 8.8 | May 12 | Mattermost fails to restrict a user with permissions to edit other users and to create personal access tokens from elevating their privileges to system admin Affected: before 7.1.8; 7.2.0 before 7.7.4; 7.8.0 before 7.8.3; 7.9.0 before 7.9.2 |
| CVE-2022-1384 | 8.8 | Apr 19 | Mattermost version 6.4.x and earlier fails to properly check the plugin version when a plugin is installed from the Marketplace, which allows an authenticated and an authorized… Affected: before 6.5.0 |
| CVE-2017-18903 | 8.8 | Jun 19 | An issue was discovered in Mattermost Server before 4.0.0, 3.10.2, and 3.9.2 Affected: before 3.9.2; 3.10.0 before 3.10.2 |
| CVE-2017-18886 | 8.8 | Jun 19 | An issue was discovered in Mattermost Server before 4.3.0, 4.2.1, and 4.1.2 Affected: before 4.1.2; 4.2.0 before 4.2.1; 4.3.0; 4.3.0; 4.3.0; 4.3.0 |
| CVE-2018-21264 | 8.8 | Jun 19 | An issue was discovered in Mattermost Server before 4.7.0, 4.6.2, and 4.5.2 Affected: before 4.5.2; 4.6.0 before 4.6.2; 4.7.0; 4.7.0; 4.7.0; 4.7.0 |
| CVE-2018-21263 | 8.8 | Jun 19 | An issue was discovered in Mattermost Server before 4.7.0, 4.6.2, and 4.5.2 Affected: before 4.5.2; 4.6.0 before 4.6.2; 4.7.0; 4.7.0; 4.7.0; 4.7.0 |
| CVE-2019-20865 | 8.8 | Jun 19 | An issue was discovered in Mattermost Server before 5.12.0, 5.11.1, 5.10.2, 5.9.2, and 4.10.10 Affected: before 4.10.10; 5.9.0 before 5.9.2; 5.10.0 before 5.10.2; 5.11.0 before 5.11.1; 5.12.0; 5.12.0; +4 more |
| CVE-2019-20841 | 8.8 | Jun 19 | An issue was discovered in Mattermost Server before 5.18.0, 5.17.2, 5.16.4, 5.15.4, and 5.9.7 Affected: before 5.9.7; 5.15.0 before 5.15.4; 5.16.0 before 5.16.4; 5.17.0 before 5.17.2; 5.18.0; 5.18.0; +2 more |
| CVE-2026-6346 | 8.7 | May 18 | Sensitive credentials exposed in plaintext in Mattermost support packets Affected: 10.11.0 before 10.11.14; 11.4.0 before 11.4.4; 11.5.0 before 11.5.2 |
| CVE-2026-2454 | 8.6 | Mar 16 | DoS in Calls plugin via malformed msgpack in websocket request. Affected: 10.11.0 before 10.11.11; 11.2.0 before 11.2.3; 11.3.0 before 11.3.1 |
| CVE-2026-9816 | 8.3 | Aug 17 | Insufficient server-side validation of board member role fields permits privilege escalation Affected: 10.11.0 before 10.11.22; 11.7.0 before 11.7.7; 11.8.0 before 11.8.4 |
| CVE-2025-14273 | 8.3 | Dec 22 | Mattermost Jira plugin user spoofing enables Jira request forgery. Affected: 10.11.0 before 10.11.8; 10.12.0 before 10.12.4; 11.0.0 before 11.0.6; 11.1.0 before 11.1.1 |
| CVE-2023-4478 | 8.2 | Aug 25 | Mattermost fails to restrict which parameters' values it takes from the request during signup allowing an attacker to register users as inactive, thus blocking them from later… Affected: before 7.8.9; 7.9.0 before 7.10.5; 8.0.0 |
| CVE-2023-3591 | 8.2 | Jul 17 | Mattermost fails to invalidate previously generated password reset tokens when a new reset token was created Affected: 7.8.0 before 7.8.7; 7.9.0 before 7.9.5; 7.10.0 before 7.10.3 |
| CVE-2026-28741 | 8.1 | Apr 15 | CSRF Protection Bypass Allows Updating a User's Authentication Method Affected: 10.11.0 before 10.11.13; 11.3.0 before 11.3.3; 11.4.0 before 11.4.3; 11.5.0 before 11.5.1 |
| CVE-2025-58073 | 8.1 | Oct 16 | Arbitrary Mattermost Team can be joined by manipulating the OAuth state Affected: 10.5.0 before 10.5.11; 10.10.0 before 10.10.3; 10.11.0 before 10.11.3 |
| CVE-2025-58075 | 8.1 | Oct 16 | Arbitrary Mattermost Team can be joined by manipulating the SAML RelayState Affected: 10.5.0 before 10.5.11; 10.10.0 before 10.10.3; 10.11.0 before 10.11.3 |
| CVE-2023-3581 | 8.1 | Jul 17 | Mattermost fails to properly validate the origin of a websocket connection allowing a MITM attacker on Mattermost to access the websocket APIs Affected: 7.8.0 before 7.8.7; 7.9.0 before 7.9.5; 7.10.0 before 7.10.3 |
| CVE-2017-18906 | 8.1 | Jun 19 | An issue was discovered in Mattermost Server before 4.0.0, 3.10.2, and 3.9.2, when Single Sign-On OAuth2 is used Affected: before 3.9.2; 3.10.0 before 3.10.2 |
| CVE-2017-18894 | 8.1 | Jun 19 | An issue was discovered in Mattermost Server before 4.2.0, 4.1.1, and 4.0.5, when used as an OAuth 2.0 service provider Affected: before 4.0.5; 4.1.0 before 4.1.1; 4.2.0; 4.2.0; 4.2.0; 4.2.0 |
| CVE-2017-18884 | 8.1 | Jun 19 | An issue was discovered in Mattermost Server before 4.3.0, 4.2.1, and 4.1.2 Affected: before 4.1.2; 4.2.0 before 4.2.1; 4.3.0; 4.3.0; 4.3.0; 4.3.0 |
| CVE-2026-6961 | 7.6 | Jun 12 | CVE-2026-6961: Path traversal via unsanitized FileInfo.Name in Mattermost federation sync Affected: 10.11.0 before 10.11.17; 11.5.0 before 11.5.5; 11.6.0 before 11.6.2 |
| CVE-2026-6347 | 7.6 | May 18 | Mattermost Calls plugin exposes TURN server credentials in plaintext in support packets Affected: 10.11.0 before 10.11.14; 11.4.0 before 11.4.4; 11.5.0 before 11.5.2 |
| CVE-2026-5740 | 7.5 | May 22 | Unauthenticated WebSocket binary frame causes denial of service in Mattermost Server Affected: 10.11.0 before 10.11.15; 11.4.0 before 11.4.5; 11.5.0 before 11.5.4; 11.6.0 before 11.6.1 |
| CVE-2026-5308 | 7.5 | May 22 | Missing request body size limits on Zoom plugin HTTP endpoints Affected: 10.11.0 before 10.11.15; 11.4.0 before 11.4.5; 11.5.0 before 11.5.4; 11.6.0 before 11.6.1 |
| CVE-2026-20719 | 7.5 | Mar 25 | DoS via URL Previews Rendering Malicious SVGs Affected: 10.11.0 before 10.11.12; 11.2.0 before 11.2.4; 11.3.0 before 11.3.2; 11.4.0 before 11.4.1 |
| CVE-2026-24458 | 7.5 | Mar 16 | DoS attack via login attempts with multi-megabyte passwords Affected: 10.11.0 before 10.11.11; 11.2.0 before 11.2.3; 11.3.0 before 11.3.1 |
| CVE-2025-55070 | 7.5 | Nov 14 | Lack of MFA enforcement in WebSocket connections Affected: before 11.0.0 |
| CVE-2025-35965 | 7.5 | Apr 24 | DoS in Mattermost Playbooks via Excessive Task Actions Affected: 9.11.0 before 9.11.11; 10.4.0 before 10.4.3; 10.5.0 |
| CVE-2025-41395 | 7.5 | Apr 24 | Webapp DoS via malicious retrospective post in Playbooks Affected: 9.11.0 before 9.11.11; 10.4.0 before 10.4.3; 10.5.0 before 10.5.1 |
| CVE-2025-25279 | 7.5 | Feb 24 | Arbitrary file read in Mattermost Boards via import & export board archive Affected: 9.11.0 before 9.11.8; 10.2.0 before 10.2.3; 10.3.0 before 10.3.3; 10.4.0 before 10.4.2 |
| CVE-2025-20621 | 7.5 | Jan 16 | Webapp crash via object that can't be cast to String in Attachment Field Affected: 9.11.0 before 9.11.6; 10.0.0 before 10.0.4; 10.1.0 before 10.1.4; 10.2.0 |
| CVE-2024-47401 | 7.5 | Oct 29 | DoS via Amplified GraphQL Response in Playbooks Affected: 9.5.0 before 9.5.10; 9.10.0 before 9.10.3; 9.11.0 before 9.11.2 |
| CVE-2023-49607 | 7.5 | Dec 12 | Playbook plugin crash via missing interface type assertion Affected: through 7.8.14; 8.0.0 through 8.1.5; 9.0.0 through 9.0.3; 9.1.0 through 9.1.2; 9.2.0 through 9.2.1; 9.1.1 |
| CVE-2023-45847 | 7.5 | Dec 12 | Playbook Plugin Crash via Run Checklist Affected: through 7.8.14; 8.0.0 through 8.1.5; 9.0.0 through 9.0.3; 9.1.1 through 9.1.2; 9.2.0 through 9.2.1 |
| CVE-2023-5330 | 7.5 | Oct 9 | Mattermost fails to enforce a limit for the size of the cache entry for OpenGraph data allowing an attacker to send a specially crafted request to the /api/v4/opengraph filling… Affected: before 7.8.11; 8.0.0 before 8.0.3; 8.1.0 before 8.1.2 |
| CVE-2023-3590 | 7.5 | Jul 17 | Mattermost fails to delete card attachments in Boards, allowing an attacker to access deleted attachments Affected: 7.10.0 before 7.10.3 |
| CVE-2023-1831 | 7.5 | Apr 17 | Mattermost fails to redact from audit logs the user password during user creation and the user password hash in other operations if the experimental audit logging configuration… Affected: before 7.7.3; 7.8.0 before 7.8.2; 7.9.0 |
| CVE-2022-0903 | 7.5 | Mar 10 | A call stack overflow bug in the SAML login feature in Mattermost server in versions up to and including 6.3.2 allows an attacker to crash the server via submitting a maliciously… Affected: before 5.37.8; 6.0.0 before 6.1.3; 6.2.0 before 6.2.3; 6.3.0 before 6.3.3 |
| CVE-2017-18917 | 7.5 | Jun 19 | An issue was discovered in Mattermost Server before 3.8.2, 3.7.5, and 3.6.7 Affected: 3.6.0 before 3.6.7; 3.7.0 before 3.7.5; 3.8.0 before 3.8.2 |
| CVE-2016-11069 | 7.5 | Jun 19 | An issue was discovered in Mattermost Server before 3.2.0 Affected: before 3.2.0 |
| CVE-2016-11066 | 7.5 | Jun 19 | An issue was discovered in Mattermost Server before 3.2.0 Affected: before 3.2.0 |
| CVE-2015-9548 | 7.5 | Jun 19 | An issue was discovered in Mattermost Server before 1.2.0 Affected: before 1.2.0 |
The 500 most important CVEs for this product (exploited first, then by severity)