MS
Product
Mattermost Server
489
CVEs
0
On KEV
9.9
Max CVSS
3
New 30D
Severity mix
Critical 17High 85Medium 345Low 42
Watch
Add Mattermost Server to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2026-24458 | 7.5 | Mar 16 | DoS attack via login attempts with multi-megabyte passwords Affected: 10.11.0 before 10.11.11; 11.2.0 before 11.2.3; 11.3.0 before 11.3.1 |
| CVE-2025-55070 | 7.5 | Nov 14 | Lack of MFA enforcement in WebSocket connections Affected: before 11.0.0 |
| CVE-2025-35965 | 7.5 | Apr 24 | DoS in Mattermost Playbooks via Excessive Task Actions Affected: 9.11.0 before 9.11.11; 10.4.0 before 10.4.3; 10.5.0 |
| CVE-2025-41395 | 7.5 | Apr 24 | Webapp DoS via malicious retrospective post in Playbooks Affected: 9.11.0 before 9.11.11; 10.4.0 before 10.4.3; 10.5.0 before 10.5.1 |
| CVE-2025-25279 | 7.5 | Feb 24 | Arbitrary file read in Mattermost Boards via import & export board archive Affected: 9.11.0 before 9.11.8; 10.2.0 before 10.2.3; 10.3.0 before 10.3.3; 10.4.0 before 10.4.2 |
| CVE-2025-20621 | 7.5 | Jan 16 | Webapp crash via object that can't be cast to String in Attachment Field Affected: 9.11.0 before 9.11.6; 10.0.0 before 10.0.4; 10.1.0 before 10.1.4; 10.2.0 |
| CVE-2024-47401 | 7.5 | Oct 29 | DoS via Amplified GraphQL Response in Playbooks Affected: 9.5.0 before 9.5.10; 9.10.0 before 9.10.3; 9.11.0 before 9.11.2 |
| CVE-2023-49607 | 7.5 | Dec 12 | Mattermost fails to validate the type of the "reminder" body request parameter allowing an attacker to crash the Playbook Plugin when updating the status dialog Affected: through 7.8.14; 8.0.0 through 8.1.5; 9.0.0 through 9.0.3; 9.1.0 through 9.1.2; 9.2.0 through 9.2.1; 9.1.1 |
| CVE-2023-45847 | 7.5 | Dec 12 | Mattermost fails to to check the length when setting the title in a run checklist in Playbooks, allowing an attacker to send a specially crafted request and crash the Playbooks… Affected: through 7.8.14; 8.0.0 through 8.1.5; 9.0.0 through 9.0.3; 9.1.1 through 9.1.2; 9.2.0 through 9.2.1 |
| CVE-2023-5330 | 7.5 | Oct 9 | Mattermost fails to enforce a limit for the size of the cache entry for OpenGraph data allowing an attacker to send a specially crafted request to the /api/v4/opengraph filling… Affected: before 7.8.11; 8.0.0 before 8.0.3; 8.1.0 before 8.1.2 |
| CVE-2023-3590 | 7.5 | Jul 17 | Mattermost fails to delete card attachments in Boards, allowing an attacker to access deleted attachments Affected: 7.10.0 before 7.10.3 |
| CVE-2023-1831 | 7.5 | Apr 17 | Mattermost fails to redact from audit logs the user password during user creation and the user password hash in other operations if the experimental audit logging configuration… Affected: before 7.7.3; 7.8.0 before 7.8.2; 7.9.0 |
| CVE-2022-0903 | 7.5 | Mar 10 | A call stack overflow bug in the SAML login feature in Mattermost server in versions up to and including 6.3.2 allows an attacker to crash the server via submitting a maliciously… Affected: before 5.37.8; 6.0.0 before 6.1.3; 6.2.0 before 6.2.3; 6.3.0 before 6.3.3 |
| CVE-2017-18917 | 7.5 | Jun 19 | An issue was discovered in Mattermost Server before 3.8.2, 3.7.5, and 3.6.7 Affected: 3.6.0 before 3.6.7; 3.7.0 before 3.7.5; 3.8.0 before 3.8.2 |
| CVE-2016-11069 | 7.5 | Jun 19 | An issue was discovered in Mattermost Server before 3.2.0 Affected: before 3.2.0 |
| CVE-2016-11066 | 7.5 | Jun 19 | An issue was discovered in Mattermost Server before 3.2.0 Affected: before 3.2.0 |
| CVE-2015-9548 | 7.5 | Jun 19 | An issue was discovered in Mattermost Server before 1.2.0 Affected: before 1.2.0 |
| CVE-2017-18909 | 7.5 | Jun 19 | An issue was discovered in Mattermost Server before 3.9.0 when SAML is used Affected: before 3.9.0 |
| CVE-2019-20888 | 7.5 | Jun 19 | An issue was discovered in Mattermost Server before 5.7, 5.6.3, 5.5.2, and 4.10.5 Affected: before 4.10.5; 5.5.0 before 5.5.2; 5.6.0 before 5.6.3; 5.7.0; 5.7.0; 5.7.0; +3 more |
| CVE-2019-20886 | 7.5 | Jun 19 | An issue was discovered in Mattermost Server before 5.8.0 Affected: before 5.8.0 |
| CVE-2019-20885 | 7.5 | Jun 19 | An issue was discovered in Mattermost Server before 5.8.0 Affected: before 5.8.0 |
| CVE-2019-20880 | 7.5 | Jun 19 | An issue was discovered in Mattermost Server before 5.8.0, 5.7.2, 5.6.5, and 4.10.7 Affected: before 4.10.7; 5.6.0 before 5.6.5; 5.7.0 before 5.7.2; 5.8.0; 5.8.0; 5.8.0; +1 more |
| CVE-2018-21262 | 7.5 | Jun 19 | An issue was discovered in Mattermost Server before 4.7.3 Affected: before 4.7.3 |
| CVE-2018-21258 | 7.5 | Jun 19 | An issue was discovered in Mattermost Server before 5.1 Affected: before 5.1.0 |
| CVE-2018-21248 | 7.5 | Jun 19 | An issue was discovered in Mattermost Server before 5.4.0 Affected: before 5.4.0 |
| CVE-2017-18871 | 7.5 | Jun 19 | An issue was discovered in Mattermost Server before 4.5.0, 4.4.5, 4.3.4, and 4.2.2 Affected: before 4.2.2; 4.3.0 before 4.3.4; 4.4.0 before 4.4.5; 4.5.0; 4.5.0; 4.5.0; +1 more |
| CVE-2019-20874 | 7.5 | Jun 19 | An issue was discovered in Mattermost Server before 5.9.0, 5.8.1, 5.7.3, and 4.10.8 Affected: before 4.10.8; 5.7.0 before 5.7.3; 5.8.0 before 5.8.1; 5.9.0; 5.9.0; 5.9.0; +1 more |
| CVE-2019-20871 | 7.5 | Jun 19 | An issue was discovered in Mattermost Server before 5.9.0, 5.8.1, 5.7.3, and 4.10.8 Affected: before 4.10.8; 5.7.0 before 5.7.3; 5.8.0 before 5.8.1; 5.9.0; 5.9.0; 5.9.0; +1 more |
| CVE-2019-20868 | 7.5 | Jun 19 | An issue was discovered in Mattermost Server before 5.11.0 Affected: before 4.10.8; 5.7.0 before 5.7.3; 5.8.0 before 5.8.1; 5.9.0; 5.9.0; 5.9.0; +1 more |
| CVE-2019-20863 | 7.5 | Jun 19 | An issue was discovered in Mattermost Server before 5.13.0 Affected: before 5.13.0 |
| CVE-2019-20862 | 7.5 | Jun 19 | An issue was discovered in Mattermost Server before 5.13.0 Affected: before 5.13.0 |
| CVE-2019-20859 | 7.5 | Jun 19 | An issue was discovered in Mattermost Server before 5.15.0 Affected: before 4.10.8; 5.7.0 before 5.7.3; 5.8.0 before 5.8.1; 5.9.0; 5.9.0; 5.9.0; +1 more |
| CVE-2019-20858 | 7.5 | Jun 19 | An issue was discovered in Mattermost Server before 5.15.0 Affected: before 5.15.0 |
| CVE-2019-20857 | 7.5 | Jun 19 | An issue was discovered in Mattermost Server before 5.16.0 Affected: before 5.16.0 |
| CVE-2019-20855 | 7.5 | Jun 19 | An issue was discovered in Mattermost Server before 5.16.1, 5.15.2, 5.14.5, and 5.9.6 Affected: before 5.9.6; 5.14.0 before 5.14.5; 5.15.0 before 5.15.2; 5.16.0 before 5.16.1 |
| CVE-2019-20854 | 7.5 | Jun 19 | An issue was discovered in Mattermost Server before 5.17.0 Affected: before 5.17.0 |
| CVE-2020-14459 | 7.5 | Jun 19 | An issue was discovered in Mattermost Server before 5.19.0 Affected: before 5.19.0 |
| CVE-2020-14458 | 7.5 | Jun 19 | An issue was discovered in Mattermost Server before 5.19.0 Affected: before 5.19.0 |
| CVE-2020-14453 | 7.5 | Jun 19 | An issue was discovered in Mattermost Server before 5.21.0 Affected: before 5.21.0 |
| CVE-2020-14450 | 7.5 | Jun 19 | An issue was discovered in Mattermost Server before 5.22.0 Affected: before 5.22.0 |
| CVE-2020-14448 | 7.5 | Jun 19 | An issue was discovered in Mattermost Server before 5.23.0 Affected: before 5.23.0 |
| CVE-2020-14447 | 7.5 | Jun 19 | An issue was discovered in Mattermost Server before 5.23.0 Affected: before 5.23.0 |
| CVE-2019-20846 | 7.5 | Jun 19 | An issue was discovered in Mattermost Server before 5.18.0 Affected: before 5.18.0 |
| CVE-2019-20845 | 7.5 | Jun 19 | An issue was discovered in Mattermost Server before 5.18.0 Affected: before 5.18.0 |
| CVE-2019-20843 | 7.5 | Jun 19 | An issue was discovered in Mattermost Server before 5.18.0, 5.17.2, 5.16.4, 5.15.4, and 5.9.7 Affected: before 5.9.7; 5.15.0 before 5.15.4; 5.16.0 before 5.16.4; 5.17.0 before 5.17.2; 5.18.0; 5.18.0; +2 more |
| CVE-2019-20881 | 7.3 | Jun 19 | An issue was discovered in Mattermost Server before 5.8.0 Affected: before 5.8.0 |
| CVE-2026-6739 | 7.2 | Jun 12 | Mattermost: Delegated admins could patch protected default system roles Affected: 10.11.0 before 10.11.17; 11.5.0 before 11.5.5; 11.6.0 before 11.6.2 |
| CVE-2025-9079 | 7.2 | Sep 19 | Admin RCE via prepackaged plugins by way of misconfigured imports directory Affected: 9.11.0 before 9.11.18; 10.5.0 before 10.5.9; 10.8.0 before 10.8.4; 10.9.0 before 10.9.4; 10.10.0 before 10.10.2 |
| CVE-2019-20842 | 7.2 | Jun 19 | An issue was discovered in Mattermost Server before 5.18.0, 5.17.2, 5.16.4, 5.15.4, and 5.9.7 Affected: before 5.9.7; 5.15.0 before 5.15.4; 5.16.0 before 5.16.4; 5.17.0 before 5.17.2; 5.18.0; 5.18.0; +2 more |
| CVE-2026-8821 | 7.1 | Sep 14 | Playbooks run owner channel membership permission bypass Affected: 10.11.0 before 10.11.23; 11.7.0 before 11.7.8; 11.8.0 before 11.8.5; 11.9.0 before 11.9.1 |