MS
Product
Mattermost Server
501
CVEs
0
On KEV
9.9
Max CVSS
15
New 30D
Severity mix
Critical 17High 86Medium 356Low 41
Watch
Add Mattermost Server to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2017-18881 | 6.1 | Jun 19 | An issue was discovered in Mattermost Server before 4.3.0, 4.2.1, and 4.1.2 Affected: before 4.1.2; 4.2.0 before 4.2.1; 4.3.0; 4.3.0; 4.3.0; 4.3.0 |
| CVE-2017-18880 | 6.1 | Jun 19 | An issue was discovered in Mattermost Server before 4.3.0, 4.2.1, and 4.1.2 Affected: before 4.1.2; 4.2.0 before 4.2.1; 4.3.0; 4.3.0; 4.3.0; 4.3.0 |
| CVE-2017-18879 | 6.1 | Jun 19 | An issue was discovered in Mattermost Server before 4.3.0, 4.2.1, and 4.1.2 Affected: before 4.1.2; 4.2.0 before 4.2.1; 4.3.0; 4.3.0; 4.3.0; 4.3.0 |
| CVE-2017-18877 | 6.1 | Jun 19 | An issue was discovered in Mattermost Server before 4.3.0, 4.2.1, and 4.1.2 Affected: 4.1.0 before 4.1.2; 4.2.0 before 4.2.1; 4.3.0; 4.3.0; 4.3.0; 4.3.0 |
| CVE-2025-27936 | 5.9 | Apr 16 | Webhook Secret Exposure via Timing attack in MSteams plugin Affected: before 10.5.2 |
| CVE-2024-32045 | 5.9 | May 26 | Playbook run link to private channel grants channel access Affected: 8.1.0 before 8.1.13; 9.5.0 before 9.5.4; 9.6.0 before 9.6.2 |
| CVE-2026-2456 | 5.7 | Mar 16 | Denial of Service via Unbounded Memory Allocation in Integration Actions Affected: 10.11.0 before 10.11.11; 11.2.0 before 11.2.3; 11.3.0 before 11.3.1 |
| CVE-2025-13821 | 5.7 | Feb 16 | User profile update exposes password hash and MFA secrets Affected: 10.11.0 before 10.11.10; 11.1.0 before 11.1.3; 11.2.0 before 11.2.2 |
| CVE-2024-36255 | 5.7 | May 26 | Post actions can run playbook checklist task commands Affected: 8.1.0 before 8.1.13; 9.5.0 before 9.5.4; 9.6.0 before 9.6.2 |
| CVE-2021-37863 | 5.7 | Dec 17 | Mattermost 6.0 and earlier fails to sufficiently validate parameters during post creation, which allows authenticated attackers to cause a client-side crash of the web application… Affected: through 6.0 |
| CVE-2026-96259 | 5.5 | Sep 22 | Mattermost server-side request forgery via OAuth endpoints configurable by a System Administrator Affected: 11.7.0 before 11.7.11; 11.8.0 before 11.8.6; 11.9.0 before 11.9.2; 11.10.0 before 11.10.2 |
| CVE-2026-82920 | 5.5 | Sep 14 | Mattermost ABAC parent policy bypass via policy update endpoint Affected: 11.7.0 before 11.7.8; 11.8.0 before 11.8.5; 11.9.0 before 11.9.1 |
| CVE-2026-7521 | 5.5 | Jul 28 | SAML certificate deletion allows path traversal to delete arbitrary files outside the config directory Affected: 10.11.0 before 10.11.21; 11.6.0 before 11.6.6; 11.7.0 before 11.7.4; 11.8.0 before 11.8.1 |
| CVE-2026-3113 | 5.5 | Mar 26 | mmctl export download command doesn’t restrict permissions to created file to file owner Affected: 10.11.0 before 10.11.12; 11.2.0 before 11.2.4; 11.3.0 before 11.3.2; 11.4.0 |
| CVE-2019-20872 | 5.5 | Jun 19 | An issue was discovered in Mattermost Server before 5.9.0, 5.8.1, 5.7.3, and 4.10.8 Affected: before 4.10.8; 5.7.0 before 5.7.3; 5.8.0 before 5.8.1; 5.9.0; 5.9.0; 5.9.0; +1 more |
| CVE-2019-20860 | 5.5 | Jun 19 | An issue was discovered in Mattermost Server before 5.14.0, 5.13.3, 5.12.6, and 5.9.4 Affected: before 5.9.4; 5.12.0 before 5.12.6; 5.13.0 before 5.13.3; 5.14.0; 5.14.0; 5.14.0; +2 more |
| CVE-2026-16044 | 5.4 | Aug 17 | Insufficient validation of guest board admin privileges on archive import Affected: 10.11.0 before 10.11.22; 11.7.0 before 11.7.7 |
| CVE-2026-9597 | 5.4 | Jul 13 | Deactivated guest accounts can authenticate via magic-link token in Mattermost REST API login endpoint Affected: 11.6.0 before 11.6.5; 11.7.0 before 11.7.3 |
| CVE-2026-10085 | 5.4 | Jul 13 | Ordinary group/direct message member can enable group_constrained and remove all channel participants Affected: 10.11.0 before 10.11.20; 11.6.0 before 11.6.5; 11.7.0 before 11.7.3 |
| CVE-2026-5139 | 5.4 | Jun 22 | GitLab Plugin Allows Non-Admin Users to Modify Default Instance Configuration Affected: 10.11.0 before 10.11.18; 11.5.0 before 11.5.6; 11.6.0 before 11.6.3; 11.7.0 before 11.7.1 |
| CVE-2026-28735 | 5.4 | May 22 | GitHub OAuth Scope Validation Affected: 10.11.0 before 10.11.15; 11.4.0 before 11.4.5; 11.5.0 before 11.5.4; 11.6.0 before 11.6.1 |
| CVE-2026-4274 | 5.4 | Mar 26 | Insufficient authorization in shared channel membership sync grants team-level access instead of channel-level access Affected: 10.11.0 before 10.11.11; 11.2.0 before 11.2.3; 11.3.0 before 11.3.2; 11.4.0 before 11.4.1 |
| CVE-2025-41410 | 5.4 | Oct 16 | Slack import bypasses email verification for team access controls Affected: 10.5.0 before 10.5.11; 10.10.0 before 10.10.3; 10.11.0 before 10.11.3 |
| CVE-2025-9072 | 5.4 | Sep 15 | One-Click Mattermost Account Takeover via Poisoned RelayState SAML Parameter Affected: 10.5.0 before 10.5.10; 10.9.0 before 10.9.5; 10.10.0 before 10.10.2 |
| CVE-2025-47871 | 5.4 | Jun 30 | Mattermost Playbooks exposes private channel metadata to unauthorized users via run metadata API Affected: 9.11.0 before 9.11.16; 10.5.0 before 10.5.6; 10.6.0 before 10.6.6; 10.7.0 before 10.7.3; 10.8.0; 10.8.0; +2 more |
| CVE-2025-46702 | 5.4 | Jun 30 | Mattermost Playbooks allows privilege escalation through improper access control in playbook run participant management Affected: 9.11.0 before 9.11.16; 10.5.0 before 10.5.6; 10.6.0 before 10.6.6; 10.7.0 before 10.7.3; 10.8.0; 10.8.0; +2 more |
| CVE-2025-3230 | 5.4 | May 30 | Bypass of System Admin User Deactivation Controls for Personal Access Tokens in Mattermost Server Affected: 9.11.0 before 9.11.13; 10.5.0 before 10.5.4; 10.6.0 before 10.6.3; 10.7.0 before 10.7.1 |
| CVE-2025-2475 | 5.4 | Apr 14 | Unauthorized Bot Login Using Credentials Affected: 9.11.0 before 9.11.10; 10.4.0 before 10.4.4; 10.5.0 before 10.5.2 |
| CVE-2024-42406 | 5.4 | Sep 26 | Unauthorized access on archived channels Affected: 9.5.0 before 9.5.9; 9.9.0 before 9.9.3; 9.10.0 before 9.10.2; 9.11.0; 9.11.0; 9.11.0; +1 more |
| CVE-2024-45843 | 5.4 | Sep 26 | Weak SSRF Filtering Affected: 9.5.0 before 9.5.9 |
| CVE-2024-39837 | 5.4 | Aug 1 | Malicious remote can create arbitrary channels Affected: 9.5.0 before 9.5.7; 9.9.0 |
| CVE-2023-6547 | 5.4 | Dec 12 | Playbooks access/modification by removed team member Affected: through 8.1.5; 9.2.0 through 9.2.1 |
| CVE-2023-3586 | 5.4 | Jul 17 | Disabling publicly-shared boards does not disable existing publicly available board links Affected: 7.8.0 before 7.8.7; 7.9.0 before 7.9.5; 7.10.0 before 7.10.3 |
| CVE-2023-1776 | 5.4 | Mar 31 | Stored XSS via SVG attachment on Boards Affected: before 7.1.6; 7.7.1 |
| CVE-2023-1774 | 5.4 | Mar 31 | Unauthorized email invite to a private channel Affected: before 7.1.6; 7.7.1 |
| CVE-2021-37862 | 5.4 | Dec 17 | Mattermost 6.0 and earlier fails to sufficiently validate the email address during registration, which allows attackers to trick users into signing up using attacker-controlled… Affected: through 6.0 |
| CVE-2016-11070 | 5.4 | Jun 19 | An issue was discovered in Mattermost Server before 3.1.0 Affected: before 3.1.0 |
| CVE-2019-20876 | 5.4 | Jun 19 | An issue was discovered in Mattermost Server before 5.9.0, 5.8.1, 5.7.3, and 4.10.8 Affected: before 4.10.8; 5.7.0 before 5.7.3; 5.8.0 before 5.8.1; 5.9.0; 5.9.0; 5.9.0; +1 more |
| CVE-2026-10556 | 5.3 | Sep 14 | Unauthenticated webhook request with null notification entry could crash the Microsoft Calendar plugin. Affected: 10.11.0 before 10.11.23; 11.7.0 before 11.7.8; 11.8.0 before 11.8.5; 11.9.0 before 11.9.1 |
| CVE-2026-6046 | 5.3 | Jun 12 | Plugin bot username conflict allows user account to be used as bot identity in Mattermost Server Affected: 10.11.0 before 10.11.17; 11.5.0 before 11.5.5; 11.6.0 before 11.6.2 |
| CVE-2026-4635 | 5.3 | May 22 | Persistent notification timing attack causing server denial of service Affected: 10.11.0 before 10.11.15; 11.4.0 before 11.4.5; 11.5.0 before 11.5.4; 11.6.0 before 11.6.1 |
| CVE-2025-55073 | 5.3 | Nov 14 | MS Teams plugin OAuth allows editing arbitrary posts Affected: 10.5.0 before 10.5.12; 10.11.0 before 10.11.4; 10.12.0 before 10.12.1 |
| CVE-2025-31947 | 5.3 | May 15 | Repeated LDAP login failures can lock an LDAP account Affected: 9.11.0 before 9.11.12; 10.4.0 before 10.4.5; 10.5.0 before 10.5.3; 10.6.0 before 10.6.2 |
| CVE-2025-0503 | 5.3 | Feb 14 | Leaked User IDs and Metadata of Deleted DMs Affected: 9.11.0 before 9.11.7 |
| CVE-2025-22445 | 5.3 | Jan 9 | Misleading UI for undefined admin console settings in Calls causes security confusion Affected: 10.0.0 before 10.3.0 |
| CVE-2024-11599 | 5.3 | Nov 28 | Domain Restriction Bypass on Registration Affected: 9.5.0 before 9.5.12; 9.11.0 before 9.11.4; 10.0.0 before 10.0.2; 10.1.0 before 10.1.2 |
| CVE-2023-46701 | 5.3 | Dec 12 | Inaccessible Post Information Leak via Run Timeline IDOR Affected: through 7.8.14; 8.0.0 through 8.1.5; 9.0.0 through 9.0.3; 9.1.1 through 9.1.2; 9.2.0 through 9.2.1 |
| CVE-2023-6459 | 5.3 | Dec 6 | Public endpoint /metrics of Calls plugin reveals channel IDs Affected: before 7.8.14; 8.0.0 before 8.1.5 |
| CVE-2023-5331 | 5.3 | Oct 9 | File Information Leak via IDOR in file_id in Draft Posts Affected: before 7.8.11; 8.0.0 before 8.0.3; 8.1.0 before 8.1.2 |
| CVE-2023-1777 | 5.3 | Mar 31 | Information disclosure in linked message previews Affected: before 7.1.6; 7.7.1; 7.8.0 |
The 500 most important CVEs for this product (exploited first, then by severity)