Login Request a demo
MS
Product
Mattermost Server
by Mattermost · last CVE Oct 16, 2026
501
CVEs
0
On KEV
9.9
Max CVSS
15
New 30D
Vulnerabilities501In the news0Timeline
Severity mix
Critical 17High 86Medium 356Low 41
Severity
All severities500Critical17High86Medium356Low41
Exploitation
On CISA KEV0Exploited in the wild0
Watch

Add Mattermost Server to your stack to get only the CVEs that touch what you run.

CVECVSSEPSSPublishedSummary · affected versions
CVE-2024-2447
6.5
0%
Apr 5
Mattermost versions 8.1.x before 8.1.11, 9.3.x before 9.3.3, 9.4.x before 9.4.4, and 9.5.x before 9.5.2 fail to authenticate the source of certain types of post actions, allowing…
Affected: 8.1.0 before 8.1.11; 9.3.0 before 9.3.3; 9.4.0 before 9.4.4; 9.5.0 before 9.5.2
CVE-2024-28949
6.5
1%
Apr 5
DoS via a large number of User Preferences
Affected: 8.1.0 before 8.1.11; 9.3.0 before 9.3.3; 9.4.0 before 9.4.4; 9.5.0 before 9.5.2
CVE-2024-28053
6.5
1%
Mar 15
Resource Exhaustion via the Invitation Feature
Affected: 8.1.0 before 8.1.10
CVE-2024-24988
6.5
1%
Feb 29
Excessive resource consumption when sending long emoji names in user custom status
Affected: before 8.1.8; 9.0.0 before 9.1.5; 9.2.0 before 9.2.4
CVE-2024-23493
6.5
0%
Feb 29
Team associated AD/LDAP Groups Leaked due to missing authorization
Affected: before 8.1.9; 9.0.0 before 9.2.5; 9.4.0 before 9.4.2; 9.3.0; 9.3.0; 9.3.0
CVE-2023-49809
6.5
1%
Dec 12
Todo plugin gets crashed and disabled by member
Affected: through 8.1.5; 9.0.0 through 9.1.0
CVE-2023-5333
6.5
1%
Oct 9
Denial of Service via multiple identical User IDs in /api/v4/users/ids
Affected: before 7.8.11; 8.0.0 before 8.0.3; 8.1.0 before 8.1.2
CVE-2023-3593
6.5
1%
Jul 17
Mattermost fails to properly validate markdown, allowing an attacker to crash the server via a specially crafted markdown input
Affected: 7.8.0 before 7.8.7; 7.9.0 before 7.9.5; 7.10.0 before 7.10.3
CVE-2023-1775
6.5
1%
Mar 31
When running in a High Availability configuration, Mattermost fails to sanitize some of the user_updated and post_deleted events broadcast to all users, leading to disclosure of…
Affected: before 7.1.6; 7.7.1
CVE-2022-3257
6.5
1%
Sep 23
Mattermost version 7.1.x and earlier fails to sufficiently process a specifically crafted GIF file when it is uploaded while drafting a post, which allows authenticated users to…
Affected: before 7.2.0
CVE-2022-3147
6.5
1%
Sep 9
Mattermost version 7.0.x and earlier fails to sufficiently limit the in-memory sizes of concurrently uploaded JPEG images, which allows authenticated users to cause resource…
Affected: before 7.1.0
CVE-2022-2401
6.5
1%
Jul 14
Unrestricted information disclosure of all users in Mattermost version 6.7.0 and earlier allows team members to access some sensitive information by directly accessing the APIs
Affected: before 6.3.9; 6.4.0 before 6.5.2; 6.6.0; 6.6.1; 6.7.0
CVE-2022-1982
6.5
1%
Jun 2
Uncontrolled resource consumption in Mattermost version 6.6.0 and earlier allows an authenticated attacker to crash the server via a crafted SVG attachment on a post
Affected: 5.0.0 before 6.3.8; 6.4.0 before 6.4.3; 6.5.0; 6.6.0
CVE-2022-1337
6.5
1%
Apr 13
The image proxy component in Mattermost version 6.4.1 and earlier allocates memory for multiple copies of a proxied image, which allows an authenticated attacker to crash the…
Affected: 5.37.0 before 5.37.9; 6.2.0 before 6.2.5; 6.3.0 before 6.3.5; 6.4.0 before 6.4.2
CVE-2022-0904
6.5
1%
Mar 10
A stack overflow bug in the document extractor in Mattermost Server in versions up to and including 6.3.2 allows an attacker to crash the server via submitting a maliciously…
Affected: 5.0.0 before 5.37.8; 6.0.0 before 6.1.3; 6.2.0 before 6.2.3; 6.3.0 before 6.3.3
CVE-2016-11078
6.5
1%
Jun 19
An issue was discovered in Mattermost Server before 3.0.0
Affected: before 3.0.0
CVE-2016-11072
6.5
1%
Jun 19
An issue was discovered in Mattermost Server before 3.0.2
Affected: before 3.0.2
CVE-2017-18874
6.5
1%
Jun 19
An issue was discovered in Mattermost Server before 4.3.0, 4.2.1, and 4.1.2 when local storage for files is used
Affected: before 4.1.2; 4.2.0 before 4.2.1; 4.3.0; 4.3.0; 4.3.0; 4.3.0
CVE-2018-21250
6.5
1%
Jun 19
An issue was discovered in Mattermost Server before 5.2.2, 5.1.2, and 4.10.4
Affected: before 4.10.4; 5.1.0 before 5.1.2; 5.2.0 before 5.2.2
CVE-2019-20873
6.5
1%
Jun 19
An issue was discovered in Mattermost Server before 5.9.0, 5.8.1, 5.7.3, and 4.10.8
Affected: before 4.10.8; 5.7.0 before 5.7.3; 5.8.0 before 5.8.1; 5.9.0; 5.9.0; 5.9.0; +1 more
CVE-2020-14460
6.5
1%
Jun 19
An issue was discovered in Mattermost Server before 5.19.0, 5.18.1, 5.17.3, 5.16.5, and 5.9.8
Affected: before 5.9.8; 5.16.0 before 5.16.5; 5.17.0 before 5.17.3; 5.18.0 before 5.18.1; 5.19.0; 5.19.0; +1 more
CVE-2019-20844
6.5
0%
Jun 19
An issue was discovered in Mattermost Server before 5.18.0, 5.17.2, 5.16.4, 5.15.4, and 5.9.7
Affected: before 5.9.7; 5.15.0 before 5.15.4; 5.16.0 before 5.16.4; 5.17.0 before 5.17.2; 5.18.0; 5.18.0; +2 more
CVE-2026-18795
6.4
0%
Oct 16
Missing server side validation allowed user to quarantine a DM and GM post
Affected: 11.7.0 before 11.7.10; 11.8.0 before 11.8.6; 11.9.0 before 11.9.2; 11.10.0
CVE-2026-6062
6.4
0%
Jun 22
IDOR in Jira plugin subscription edit endpoint
Affected: 10.11.0 before 10.11.18; 11.5.0 before 11.5.6; 11.6.0 before 11.6.3; 11.7.0 before 11.7.1
CVE-2026-6673
6.4
0%
Jun 22
Mattermost Jira plugin had unauthenticated {{/ac/installed}} lifecycle callback during pending Jira Cloud install
Affected: 10.11.0 before 10.11.18; 11.5.0 before 11.5.6; 11.6.0 before 11.6.3; 11.7.0 before 11.7.1
CVE-2026-10527
6.3
0%
Aug 17
Boards plugin retains Board Admin rights for users demoted to System Guest
Affected: 10.11.0 before 10.11.22; 11.7.0 before 11.7.7; 11.8.0 before 11.8.4
CVE-2026-16048
6.3
0%
Aug 17
Channel member roles accept out-of-scope roles
Affected: 10.11.0 before 10.11.22; 11.7.0 before 11.7.7; 11.8.0 before 11.8.3
CVE-2024-31859
6.3
0%
May 26
Member promoted to channel admin via playbooks run linking to channel
Affected: 8.1.0 before 8.1.13; 9.5.0 before 9.5.4; 9.6.0 before 9.6.2
CVE-2026-27656
6.1
0%
Mar 25
Account Takeover via Substring Matching in OpenID Connect Authentication
Affected: 10.11.0 before 10.11.12; 11.2.0 before 11.2.4; 11.3.0 before 11.3.2; 11.4.0 before 11.4.1
CVE-2025-62690
6.1
0%
Dec 17
Open redirect in error page when link opened in new tab
Affected: 10.11.0 before 10.11.5
CVE-2025-9084
6.1
0%
Sep 15
Open redirect in OAuth login
Affected: 10.5.0 before 10.5.10
CVE-2024-2445
6.1
0%
Mar 15
Reflected XSS in Mattermost Jira plugin
Affected: 8.1.0 before 8.1.10; 9.2.0 before 9.2.6; 9.3.0 before 9.3.2; 9.4.0 before 9.4.3
CVE-2023-7113
6.1
0%
Dec 29
Mattermost version 8.1.6 and earlier fails to sanitize channel mention data in posts, which allows an attacker to inject markup in the web client
Affected: before 8.1.7
CVE-2023-1421
6.1
0%
Mar 15
A reflected cross-site scripting vulnerability in the OAuth flow completion endpoints in Mattermost allows an attacker to send AJAX requests on behalf of the victim via sharing a…
Affected: 5.32.0 before 7.7.0
CVE-2017-18921
6.1
1%
Jun 19
An issue was discovered in Mattermost Server before 3.6.0 and 3.5.2
Affected: before 3.5.2
CVE-2017-18913
6.1
1%
Jun 19
An issue was discovered in Mattermost Server before 3.8.2, 3.7.5, and 3.6.7
Affected: before 3.6.7; 3.7.0 before 3.7.5; 3.8.0 before 3.8.2
CVE-2017-18907
6.1
1%
Jun 19
An issue was discovered in Mattermost Server before 4.0.0, 3.10.2, and 3.9.2
Affected: before 3.9.2; 3.10.0 before 3.10.2
CVE-2016-11084
6.1
0%
Jun 19
An issue was discovered in Mattermost Server before 2.1.0
Affected: before 2.1.0
CVE-2016-11083
6.1
1%
Jun 19
An issue was discovered in Mattermost Server before 2.2.0
Affected: before 2.2.0
CVE-2016-11082
6.1
1%
Jun 19
An issue was discovered in Mattermost Server before 2.2.0
Affected: before 2.2.0
CVE-2016-11079
6.1
1%
Jun 19
An issue was discovered in Mattermost Server before 3.0.0
Affected: before 3.0.0
CVE-2016-11073
6.1
1%
Jun 19
An issue was discovered in Mattermost Server before 3.0.0
Affected: before 3.0.0
CVE-2016-11071
6.1
1%
Jun 19
An issue was discovered in Mattermost Server before 3.1.0
Affected: before 3.1.0
CVE-2016-11063
6.1
1%
Jun 19
An issue was discovered in Mattermost Server before 3.5.1
Affected: before 3.5.1
CVE-2017-18904
6.1
1%
Jun 19
An issue was discovered in Mattermost Server before 4.0.0, 3.10.2, and 3.9.2
Affected: before 3.9.2; 3.10.0 before 3.10.2
CVE-2017-18897
6.1
1%
Jun 19
An issue was discovered in Mattermost Server before 4.2.0, 4.1.1, and 4.0.5, when used as an OAuth 2.0 service provider
Affected: before 4.0.5; 4.1.0 before 4.1.1; 4.2.0; 4.2.0; 4.2.0; 4.2.0
CVE-2017-18893
6.1
1%
Jun 19
An issue was discovered in Mattermost Server before 4.2.0, 4.1.1, and 4.0.5
Affected: before 4.0.5; 4.1.0 before 4.1.1; 4.2.0; 4.2.0; 4.2.0; 4.2.0
CVE-2017-18892
6.1
1%
Jun 19
An issue was discovered in Mattermost Server before 4.2.0, 4.1.1, and 4.0.5
Affected: before 4.0.5; 4.1.0 before 4.1.1; 4.2.0; 4.2.0; 4.2.0; 4.2.0
CVE-2017-18891
6.1
1%
Jun 19
An issue was discovered in Mattermost Server before 4.2.0, 4.1.1, and 4.0.5
Affected: before 4.0.5; 4.1.0 before 4.1.1; 4.2.0; 4.2.0; 4.2.0; 4.2.0
CVE-2017-18882
6.1
1%
Jun 19
An issue was discovered in Mattermost Server before 4.3.0, 4.2.1, and 4.1.2
Affected: before 4.1.2; 4.2.0 before 4.2.1; 4.3.0; 4.3.0; 4.3.0; 4.3.0
Page 2 of 8 · 356 total
123…8
The 500 most important CVEs for this product (exploited first, then by severity)