MS
Product
Mattermost Server
501
CVEs
0
On KEV
9.9
Max CVSS
15
New 30D
Severity mix
Critical 17High 86Medium 356Low 41
Watch
Add Mattermost Server to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2026-3495 | 4.8 | May 18 | Unescaped variables during error page composition Affected: 10.11.0 before 10.11.14; 11.5.0 before 11.5.2 |
| CVE-2024-48872 | 4.8 | Dec 16 | Bypass of "Max failed attempts" restriction via race condition Affected: 9.5.0 before 9.5.13; 9.11.0 before 9.11.5; 10.0.0 before 10.0.3; 10.1.0 before 10.1.3 |
| CVE-2024-36250 | 4.8 | Nov 9 | MFA Code Replay Affected: 9.5.0 before 9.5.11; 9.11.0 before 9.11.3 |
| CVE-2026-27659 | 4.6 | Mar 25 | CSRF vulnerability in UpdateAccessControlPolicyActiveStatus endpoint Affected: 10.11.0 before 10.11.11; 11.2.0 before 11.2.3; 11.3.0 before 11.3.2; 11.4.0 before 11.4.1 |
| CVE-2024-46872 | 4.6 | Oct 29 | Client-Side Path Traversal Leading to CSRF in Playbooks Affected: 9.5.0 through 9.5.9; 9.10.0 through 9.10.2; 9.11.0 through 9.11.1 |
| CVE-2022-1385 | 4.6 | Apr 19 | Invitation Email is resent as a Reminder after invalidating pending email invites Affected: before 6.5.0 |
| CVE-2026-18799 | 4.3 | Oct 16 | Mattermost Server fails to restrict Slack import account binding, allowing team admins to forge posts as existing users Affected: 11.7.0 before 11.7.10; 11.8.0 before 11.8.6; 11.9.0 before 11.9.2; 11.10.0 |
| CVE-2026-18256 | 4.3 | Oct 16 | Private team metadata disclosure via the team search API Affected: 11.7.0 before 11.7.10; 11.8.0 before 11.8.6; 11.9.0 before 11.9.2; 11.10.0 |
| CVE-2026-18560 | 4.3 | Oct 16 | Improper order of authorisations in Mattermost GetFile API leads to an authenticated user to determine a post’s quarantined status Affected: 11.7.0 before 11.7.10; 11.8.0 before 11.8.6; 11.9.0 before 11.9.2; 11.10.0 |
| CVE-2026-19603 | 4.3 | Oct 16 | Private channel ID disclosure via user status endpoints Affected: 11.7.0 before 11.7.11; 11.8.0 before 11.8.6; 11.9.0 before 11.9.2; 11.10.0 before 11.10.2 |
| CVE-2026-19867 | 4.3 | Oct 16 | Uncapped mention keys in user notification properties allow CPU exhaustion during post processing Affected: 11.7.0 before 11.7.11; 11.8.0 before 11.8.6; 11.9.0 before 11.9.2; 11.10.0 |
| CVE-2026-95666 | 4.3 | Sep 22 | Unbounded post ID array in the bulk reactions endpoint allows denial of service Affected: 11.7.0 before 11.7.11; 11.8.0 before 11.8.6; 11.9.0 before 11.9.2; 11.10.0 before 11.10.2 |
| CVE-2026-86348 | 4.3 | Sep 14 | MS Calendar plugin: unrecovered handler panics from malformed post-action requests could crash the plugin process Affected: 10.11.0 before 10.11.23; 11.7.0 before 11.7.8; 11.8.0 before 11.8.5; 11.9.0 before 11.9.1 |
| CVE-2026-86349 | 4.3 | Sep 14 | Mattermost Server Algorithmic DoS via Unbounded Markdown Block Nesting Affected: 10.11.0 before 10.11.23; 11.7.0 before 11.7.9; 11.8.0 before 11.8.5; 11.9.0 before 11.9.1 |
| CVE-2026-13417 | 4.3 | Sep 14 | Boards plugin denial of service via unvalidated block fields.properties Affected: 10.11.0 before 10.11.23; 11.7.0 before 11.7.8; 11.8.0 before 11.8.5; 11.9.0 before 11.9.1 |
| CVE-2026-10542 | 4.3 | Sep 14 | Playbooks channel action update validation issue Affected: 10.11.0 before 10.11.23; 11.7.0 before 11.7.8; 11.8.0 before 11.8.5; 11.9.0 before 11.9.1 |
| CVE-2026-14344 | 4.3 | Sep 14 | Inconsistent authorization checks in Mattermost Boards endpoints Affected: 10.11.0 before 10.11.23; 11.7.0 before 11.7.8; 11.8.0 before 11.8.5; 11.9.0 before 11.9.1 |
| CVE-2026-12882 | 4.3 | Sep 14 | Mattermost Markdown autolink parsing denial of service Affected: 10.11.0 before 10.11.23; 11.7.0 before 11.7.8; 11.8.0 before 11.8.5; 11.9.0 before 11.9.1 |
| CVE-2026-11993 | 4.3 | Sep 14 | Fix authenticated members disabling file content indexing server-wide via extraction pool exhaustion Affected: 10.11.0 before 10.11.23; 11.7.0 before 11.7.8; 11.8.0 before 11.8.5; 11.9.0 before 11.9.1 |
| CVE-2026-14259 | 4.3 | Sep 14 | Board archive import bypasses team board creation permissions Affected: 10.11.0 before 10.11.23; 11.7.0 before 11.7.8; 11.8.0 before 11.8.5; 11.9.0 before 11.9.1 |
| CVE-2026-16045 | 4.3 | Aug 17 | Delegated OAuth tokens could revoke unrelated OAuth application authorizations Affected: 10.11.0 before 10.11.22; 11.7.0 before 11.7.7 |
| CVE-2026-16047 | 4.3 | Aug 17 | Board channel linking without read channel permission validation Affected: 10.11.0 before 10.11.22; 11.7.0 before 11.7.7; 11.8.0 before 11.8.4 |
| CVE-2026-16046 | 4.3 | Aug 17 | Missing run-state validation on finished playbook runs Affected: 10.11.0 before 10.11.22; 11.7.0 before 11.7.7 |
| CVE-2026-10600 | 4.3 | Jul 27 | Denial of service via unbounded document content extraction in Mattermost Server Affected: 10.11.0 before 10.11.21; 11.6.0 before 11.6.6; 11.7.0 before 11.7.4; 11.8.0 before 11.8.1 |
| CVE-2026-6541 | 4.3 | Jul 13 | Unscoped updates to other playbooks' metric configuration Affected: 10.11.0 before 10.11.20; 11.6.0 before 11.6.5; 11.7.0 before 11.7.2 |
| CVE-2026-9824 | 4.3 | Jul 13 | Remote cluster metadata enumeration via /share-channel autocomplete Affected: 10.11.0 before 10.11.20; 11.6.0 before 11.6.5; 11.7.0 before 11.7.3 |
| CVE-2026-10103 | 4.3 | Jul 13 | Authenticated remote cluster can modify or delete posts it does not own in Mattermost Connected Workspaces shared channels Affected: 10.11.0 before 10.11.20; 11.6.0 before 11.6.5; 11.7.0 before 11.7.3 |
| CVE-2026-9162 | 4.3 | Jun 22 | Global session revocation does not invalidate active WebSocket connections Affected: 10.11.0 before 10.11.18; 11.5.0 before 11.5.6; 11.6.0 before 11.6.3; 11.7.0 before 11.7.1 |
| CVE-2026-6689 | 4.3 | Jun 12 | *Missing* {{invite_user}} *permission check on team creation allows unprivileged users to set open-invite and allowed-domains team settings* Affected: 10.11.0 before 10.11.17; 11.5.0 before 11.5.5; 11.6.0 before 11.6.2 |
| CVE-2026-3433 | 4.3 | Jun 12 | Mattermost fails to scope role_updated websocket events to authorized team and channel members Affected: 10.11.0 before 10.11.17; 11.5.0 before 11.5.5; 11.6.0 before 11.6.2 |
| CVE-2026-4646 | 4.3 | May 22 | Insufficient input validation in GitHub plugin API causes denial of service Affected: 10.11.0 before 10.11.15; 11.4.0 before 11.4.5; 11.5.0 before 11.5.4; 11.6.0 before 11.6.1 |
| CVE-2026-3636 | 4.3 | May 22 | Sanitize team member data returned by API Affected: 10.11.0 before 10.11.15; 11.4.0 before 11.4.5; 11.5.0 before 11.5.4; 11.6.0 before 11.6.1 |
| CVE-2026-4055 | 4.3 | May 21 | Insufficient permission validation on cross-team playbook run creation Affected: 10.11.0 before 10.11.17; 11.5.0 before 11.5.5; 11.6.0 before 11.6.2 |
| CVE-2026-28732 | 4.3 | May 18 | Slash command trigger-word update allowed command hijacking Affected: 10.11.0 before 10.11.14; 11.4.0 before 11.4.4; 11.5.0 before 11.5.2 |
| CVE-2026-6343 | 4.3 | May 18 | Mattermost Playbooks Plugin fails to enforce view permissions in list endpoints, allowing unauthorized access to public playbooks Affected: 10.11.0 before 10.11.14; 11.4.0 before 11.4.4; 11.5.0 before 11.5.2 |
| CVE-2026-4286 | 4.3 | May 18 | Playbooks Plugin fails to validate team transfers, allowing unauthorized removal of member access via playbook update Affected: 10.11.0 before 10.11.14; 11.5.0 before 11.5.2 |
| CVE-2026-6339 | 4.3 | May 18 | Missing request origin validation on burn-on-read reveal endpoint Affected: 11.4.0 before 11.4.4; 11.5.0 before 11.5.2 |
| CVE-2026-6341 | 4.3 | May 18 | Incomplete group locking implementation Affected: 10.13.0 through 10.13.11; 11.1.0 through 11.1.5; 11.3.0 through 11.3.4 |
| CVE-2026-6342 | 4.3 | May 18 | Group prefix matching bypass for subscriptions Affected: 10.13.0 through 10.13.11; 11.1.0 through 11.1.5; 11.3.0 through 11.3.4 |
| CVE-2026-4273 | 4.3 | May 18 | Insufficient token rotation validation in remote cluster invite confirmation Affected: 10.11.0 before 10.11.14; 11.5.0 before 11.5.2 |
| CVE-2026-3637 | 4.3 | May 18 | Mattermost fails to enforce create_post permission when editing posts Affected: 10.11.0 before 10.11.14; 11.4.0 before 11.4.4; 11.5.0 before 11.5.2 |
| CVE-2026-28759 | 4.3 | May 18 | Insufficient authorization in shared channel membership sync allows remote cluster to remove users from arbitrary channels Affected: 10.11.0 before 10.11.14; 11.4.0 before 11.4.4; 11.5.0 before 11.5.2 |
| CVE-2026-4053 | 4.3 | May 15 | post edit time limit is not enforced on some post update operations Affected: 10.11.0 before 10.11.14; 11.5.0 before 11.5.2 |
| CVE-2026-3115 | 4.3 | Mar 26 | Guest users can view group member IDs without respecting view restrictions Affected: 10.11.0 before 10.11.11; 11.2.0 before 11.2.3; 11.3.0 before 11.3.2; 11.4.0 |
| CVE-2026-1629 | 4.3 | Mar 16 | Permalink Preview Information Disclosure After Permission Revocation Affected: 10.11.0 before 10.11.11 |
| CVE-2026-26304 | 4.3 | Mar 16 | Permission Bypass in Playbook Run Creation Affected: 11.2.0 before 11.2.3; 11.3.0 before 11.3.1 |
| CVE-2026-24692 | 4.3 | Mar 16 | Guest users can bypass read permissions via search API Affected: 10.11.0 before 10.11.11; 11.2.0 before 11.2.3; 11.3.0 before 11.3.1 |
| CVE-2026-2455 | 4.3 | Mar 16 | SSRF bypass via IPv4-mapped IPv6 literals Affected: 10.11.0 before 10.11.11; 11.2.0 before 11.2.3; 11.3.0 before 11.3.1 |
| CVE-2026-21386 | 4.3 | Mar 16 | Private channel enumeration via /mute slash command Affected: 10.11.0 before 10.11.11; 11.2.0 before 11.2.3; 11.3.0 before 11.3.1 |
| CVE-2026-25780 | 4.3 | Mar 16 | Memory Exhaustion via Malformed DOC File Upload Affected: 10.11.0 before 10.11.11; 11.2.0 before 11.2.3; 11.3.0 before 11.3.1 |
The 500 most important CVEs for this product (exploited first, then by severity)