MS
Product
Mattermost Server
501
CVEs
0
On KEV
9.9
Max CVSS
15
New 30D
Severity mix
Critical 17High 86Medium 356Low 41
Watch
Add Mattermost Server to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2023-6459 | 5.3 | Dec 6 | Public endpoint /metrics of Calls plugin reveals channel IDs Affected: before 7.8.14; 8.0.0 before 8.1.5 |
| CVE-2023-5331 | 5.3 | Oct 9 | File Information Leak via IDOR in file_id in Draft Posts Affected: before 7.8.11; 8.0.0 before 8.0.3; 8.1.0 before 8.1.2 |
| CVE-2023-1777 | 5.3 | Mar 31 | Information disclosure in linked message previews Affected: before 7.1.6; 7.7.1; 7.8.0 |
| CVE-2022-2366 | 5.3 | Jul 12 | Incorrect default configuration for trusted IP header in Mattermost version 6.7.0 and earlier allows attacker to bypass some of the rate limitations in place or use manipulated… Affected: before 6.3.9; 6.4.0 before 6.5.2; 6.6.0 before 6.6.2; 6.7.0 |
| CVE-2017-18919 | 5.3 | Jun 19 | An issue was discovered in Mattermost Server before 3.7.0 and 3.6.3 Affected: before 3.6.3 |
| CVE-2017-18916 | 5.3 | Jun 19 | An issue was discovered in Mattermost Server before 3.8.2, 3.7.5, and 3.6.7 Affected: before 3.6.7; 3.7.0 before 3.7.5; 3.8.0 before 3.8.2 |
| CVE-2017-18914 | 5.3 | Jun 19 | An issue was discovered in Mattermost Server before 3.8.2, 3.7.5, and 3.6.7 Affected: before 3.6.7; 3.7.0 before 3.7.5; 3.8.0 before 3.8.2 |
| CVE-2017-18905 | 5.3 | Jun 19 | An issue was discovered in Mattermost Server before 4.0.0, 3.10.2, and 3.9.2, when used as an OAuth 2.0 service provider, Session invalidation was mishandled Affected: before 3.9.2; 3.10.0 before 3.10.2 |
| CVE-2016-11076 | 5.3 | Jun 19 | An issue was discovered in Mattermost Server before 3.0.0 Affected: before 3.0.0 |
| CVE-2016-11075 | 5.3 | Jun 19 | An issue was discovered in Mattermost Server before 3.0.0 Affected: before 3.0.0 |
| CVE-2016-11068 | 5.3 | Jun 19 | An issue was discovered in Mattermost Server before 3.2.0 Affected: before 3.2.0 |
| CVE-2016-11067 | 5.3 | Jun 19 | An issue was discovered in Mattermost Server before 3.2.0 Affected: before 3.2.0 |
| CVE-2016-11062 | 5.3 | Jun 19 | An issue was discovered in Mattermost Server before 3.5.1 Affected: before 3.5.1 |
| CVE-2017-18902 | 5.3 | Jun 19 | An issue was discovered in Mattermost Server before 4.1.0, 4.0.4, and 3.10.3 Affected: before 3.10.3; 4.0.0 before 4.0.4 |
| CVE-2017-18901 | 5.3 | Jun 19 | An issue was discovered in Mattermost Server before 4.1.0, 4.0.4, and 3.10.3 Affected: before 3.10.3; 4.0.0 before 4.0.4 |
| CVE-2017-18899 | 5.3 | Jun 19 | An issue was discovered in Mattermost Server before 4.2.0, 4.1.1, and 4.0.5 Affected: before 4.0.5; 4.1.0 before 4.1.1; 4.2.0; 4.2.0; 4.2.0; 4.2.0 |
| CVE-2017-18898 | 5.3 | Jun 19 | An issue was discovered in Mattermost Server before 4.2.0, 4.1.1, and 4.0.5 Affected: before 4.0.5; 4.1.0 before 4.1.1; 4.2.0; 4.2.0; 4.2.0; 4.2.0 |
| CVE-2017-18896 | 5.3 | Jun 19 | An issue was discovered in Mattermost Server before 4.2.0, 4.1.1, and 4.0.5 Affected: before 4.0.5; 4.1.0 before 4.1.1; 4.2.0; 4.2.0; 4.2.0; 4.2.0 |
| CVE-2017-18895 | 5.3 | Jun 19 | An issue was discovered in Mattermost Server before 4.2.0, 4.1.1, and 4.0.5 Affected: before 4.0.5; 4.1.0 before 4.1.1; 4.2.0; 4.2.0; 4.2.0; 4.2.0 |
| CVE-2017-18887 | 5.3 | Jun 19 | An issue was discovered in Mattermost Server before 4.3.0, 4.2.1, and 4.1.2 Affected: before 4.1.2; 4.2.0 before 4.2.1; 4.3.0; 4.3.0; 4.3.0; 4.3.0 |
| CVE-2017-18873 | 5.3 | Jun 19 | An issue was discovered in Mattermost Server before 4.3.0, 4.2.1, and 4.1.2 Affected: before 4.1.2; 4.2.0 before 4.2.1; 4.3.0; 4.3.0; 4.3.0; 4.3.0 |
| CVE-2019-20889 | 5.3 | Jun 19 | An issue was discovered in Mattermost Server before 5.7, 5.6.3, 5.5.2, and 4.10.5 Affected: 4.10.0 before 4.10.5; 5.5.0 before 5.5.2; 5.6.0 before 5.6.3; 5.7.0; 5.7.0; 5.7.0; +3 more |
| CVE-2019-20884 | 5.3 | Jun 19 | An issue was discovered in Mattermost Server before 5.8.0 Affected: before 5.8.0 |
| CVE-2019-20882 | 5.3 | Jun 19 | An issue was discovered in Mattermost Server before 5.8.0 Affected: before 5.8.0 |
| CVE-2019-20877 | 5.3 | Jun 19 | An issue was discovered in Mattermost Server before 5.9.0, 5.8.1, 5.7.3, and 4.10.8 Affected: before 4.10.8; 5.7.0 before 5.7.3; 5.8.0 before 5.8.1; 5.9.0; 5.9.0; 5.9.0; +1 more |
| CVE-2019-20875 | 5.3 | Jun 19 | An issue was discovered in Mattermost Server before 5.9.0, 5.8.1, 5.7.3, and 4.10.8 Affected: before 4.10.8; 5.7.0 before 5.7.3; 5.8.0 before 5.8.1; 5.9.0; 5.9.0; 5.9.0; +1 more |
| CVE-2018-21259 | 5.3 | Jun 19 | An issue was discovered in Mattermost Server before 4.10.1, 4.9.4, and 4.8.2 Affected: before 4.8.2; 4.9.0 before 4.9.4; 4.10.0 before 4.10.1 |
| CVE-2018-21257 | 5.3 | Jun 19 | An issue was discovered in Mattermost Server before 5.1 Affected: before 5.1.0 |
| CVE-2019-20869 | 5.3 | Jun 19 | An issue was discovered in Mattermost Server before 5.10.0, 5.9.1, 5.8.2, and 4.10.9 Affected: before 4.10.9; 5.7.0 before 5.7.3; 5.8.0 before 5.8.2; 5.9.0 before 5.9.1; 5.10.0; 5.10.0; +4 more |
| CVE-2019-20867 | 5.3 | Jun 19 | An issue was discovered in Mattermost Server before 5.11.0 Affected: before 5.11.0 |
| CVE-2019-20866 | 5.3 | Jun 19 | An issue was discovered in Mattermost Server before 5.12.0 Affected: before 5.12.0 |
| CVE-2020-14457 | 5.3 | Jun 19 | An issue was discovered in Mattermost Server before 5.20.0 Affected: before 5.20.0 |
| CVE-2020-14452 | 5.3 | Jun 19 | An issue was discovered in Mattermost Server before 5.21.0 Affected: before 5.21.0 |
| CVE-2019-20847 | 5.3 | Jun 19 | An issue was discovered in Mattermost Server before 5.18.0 Affected: before 5.18.0 |
| CVE-2026-18223 | 5.0 | Oct 16 | Mattermost invitation tokens not bound to invited email address allowing unauthorized team and private channel access Affected: 11.7.0 before 11.7.10; 11.8.0 before 11.8.6; 11.9.0 before 11.9.2; 11.10.0 |
| CVE-2026-6333 | 5.0 | May 18 | SSRF via Host Header Spoofing in Custom Slash Commands Affected: 10.11.0 before 10.11.14; 11.5.0 before 11.5.2 |
| CVE-2026-19076 | 4.9 | Oct 16 | Mattermost fails to reject OAuth application sessions in account type switch, allowing account takeover via bearer token Affected: 11.7.0 before 11.7.10; 11.8.0 before 11.8.6; 11.9.0 before 11.9.2; 11.10.0 |
| CVE-2026-19600 | 4.9 | Oct 16 | Mattermost logs plaintext authentication tokens in debug-level server logs on failed auth attempts Affected: 11.7.0 before 11.7.10; 11.8.0 before 11.8.6; 11.9.0 before 11.9.2; 11.10.0 before 11.10.2 |
| CVE-2026-19601 | 4.9 | Oct 16 | Disclosure of AD/LDAP bind password via Test Connection Affected: 11.7.0 before 11.7.11; 11.8.0 before 11.8.6; 11.9.0 before 11.9.2; 11.10.0 before 11.10.2 |
| CVE-2026-9708 | 4.9 | Jul 13 | Incoming webhook user attribution via unvalidated webhook owner Affected: 10.11.0 before 10.11.20; 11.6.0 before 11.6.5; 11.7.0 before 11.7.3 |
| CVE-2026-3112 | 4.9 | Mar 26 | Arbitrary File Read via Advanced Logging Support Packet Affected: 10.11.0 before 10.11.12; 11.2.0 before 11.2.4; 11.3.0 before 11.3.2; 11.4.0 |
| CVE-2026-3116 | 4.9 | Mar 26 | Improper Input Validation in Zoom Plugin Webhook Handler Affected: 10.11.0 before 10.11.12; 11.2.0 before 11.2.4; 11.3.0 before 11.3.2; 11.4.0 before 11.4.1 |
| CVE-2025-11794 | 4.9 | Nov 14 | Password hash and MFA secret returned in user email verification endpoint Affected: 10.5.0 before 10.5.12; 10.11.0 before 10.11.4; 10.12.0 before 10.12.1 |
| CVE-2025-8402 | 4.9 | Aug 21 | Nil pointer dereference in bulk import crashes server Affected: 9.11.0 before 9.11.18; 10.5.0 before 10.5.9; 10.8.0 before 10.8.4; 10.9.0 before 10.9.4; 10.10.0 |
| CVE-2025-8023 | 4.9 | Aug 21 | Path Traversal in Template Upload Allows Uploading Files Outside Target Directory Affected: 9.11.0 before 9.11.18; 10.5.0 before 10.5.9; 10.8.0 before 10.8.4; 10.9.0 before 10.9.3 |
| CVE-2025-36530 | 4.9 | Aug 21 | Import Path Traversal Enables Unauthorized Unsigned Plugin Installation Affected: 9.11.0 before 9.11.18; 10.5.0 before 10.5.9; 10.8.0 before 10.8.4; 10.9.0 before 10.9.2 |
| CVE-2025-6233 | 4.9 | Jul 18 | Arbitrary file read by system admin via path traversal Affected: 9.11.0 before 9.11.17; 10.5.0 before 10.5.8; 10.7.0 before 10.7.4; 10.8.0 before 10.8.2 |
| CVE-2025-32093 | 4.9 | Apr 14 | Syatem admin profile modification by delegated granular administration role Affected: 9.11.0 before 9.11.10; 10.4.0 before 10.4.4; 10.5.0 before 10.5.2 |
| CVE-2024-54682 | 4.9 | Dec 16 | Zipbomb DoS via Missing Slack Import Validation Affected: 9.5.0 before 9.5.13; 9.11.0 before 9.11.5; 10.0.0 before 10.0.3; 10.1.0 before 10.1.3 |
| CVE-2024-42497 | 4.9 | Aug 22 | Insufficient permissions checks on teams Affected: 9.5.0 before 9.5.8; 9.8.0 before 9.8.3; 9.9.0 before 9.9.2; 9.10.0 |
The 500 most important CVEs for this product (exploited first, then by severity)