MS
Product
Mattermost Server
501
CVEs
0
On KEV
9.9
Max CVSS
15
New 30D
Severity mix
Critical 17High 86Medium 356Low 41
Watch
Add Mattermost Server to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2026-2455 | 4.3 | Mar 16 | SSRF bypass via IPv4-mapped IPv6 literals Affected: 10.11.0 before 10.11.11; 11.2.0 before 11.2.3; 11.3.0 before 11.3.1 |
| CVE-2026-21386 | 4.3 | Mar 16 | Private channel enumeration via /mute slash command Affected: 10.11.0 before 10.11.11; 11.2.0 before 11.2.3; 11.3.0 before 11.3.1 |
| CVE-2026-25780 | 4.3 | Mar 16 | Memory Exhaustion via Malformed DOC File Upload Affected: 10.11.0 before 10.11.11; 11.2.0 before 11.2.3; 11.3.0 before 11.3.1 |
| CVE-2026-4265 | 4.3 | Mar 16 | Guest user can upload files without permission across teams Affected: 10.11.0 before 10.11.11; 11.2.0 before 11.2.3; 11.3.0 before 11.3.1 |
| CVE-2026-25783 | 4.3 | Mar 16 | Denial of service via malformed User-Agent header in getBrowserVersion Affected: 10.11.0 before 10.11.11; 11.2.0 before 11.2.3; 11.3.0 before 11.3.1 |
| CVE-2026-2578 | 4.3 | Mar 16 | Information Disclosure via WebSocket Event When Deleting Unrevealed Burn on Read Posts Affected: 11.3.0 before 11.3.1 |
| CVE-2026-26246 | 4.3 | Mar 16 | Memory Exhaustion via Malformed PSD File Upload Affected: 10.11.0 before 10.11.11; 11.2.0 before 11.2.3; 11.3.0 before 11.3.1 |
| CVE-2026-2458 | 4.3 | Mar 16 | Unauthorized channel enumeration in private teams after member removal Affected: 10.11.0 before 10.11.11; 11.2.0 before 11.2.3; 11.3.0 before 11.3.1 |
| CVE-2026-2457 | 4.3 | Mar 16 | WebSocket Message Spoofing via Permalink Embed Manipulation Affected: 10.11.0 before 10.11.11; 11.2.0 before 11.2.3; 11.3.0 before 11.3.1 |
| CVE-2026-2461 | 4.3 | Mar 16 | Missing authorization check allows unauthorized modification of other users' comments on a board Affected: before 10.11.11; 11.0.0 through 11.0.3; 11.1.0 before 11.2.3; 11.3.0 before 11.3.1 |
| CVE-2026-2463 | 4.3 | Mar 16 | Unauthorized access to invite ID during team creation Affected: 10.11.0 before 10.11.11; 11.2.0 before 11.2.3; 11.3.0 before 11.3.1 |
| CVE-2025-14350 | 4.3 | Feb 16 | Information disclosure via channel mentions in posts Affected: 10.11.0 before 10.11.10; 11.1.0 before 11.1.3; 11.2.0 before 11.2.2 |
| CVE-2026-0997 | 4.3 | Feb 16 | Mattermost Zoom Plugin channel preference API lacks authorization checks Affected: 10.11.0 before 10.11.10; 11.1.0 before 11.1.3; 11.2.0 before 11.2.2 |
| CVE-2026-0998 | 4.3 | Feb 16 | Mattermost Zoom Plugin allows unauthorized meeting creation and post modification via insufficient API access controls Affected: 10.11.0 before 10.11.10; 11.1.0 before 11.1.3; 11.2.0 before 11.2.2 |
| CVE-2026-0999 | 4.3 | Feb 16 | Authentication bypass via userID login when email and username login are disabled Affected: 10.11.0 before 10.11.10; 11.1.0 before 11.1.3; 11.2.0 before 11.2.2 |
| CVE-2026-22892 | 4.3 | Feb 13 | Insufficient Authorization in Mattermost Jira Plugin Allows Unauthorized Access to Post Attachments Affected: 10.11.0 before 10.11.10; 11.0.0 before 11.1.3; 11.2.0 before 11.2.2 |
| CVE-2025-13767 | 4.3 | Dec 24 | Unauthorized Read Access to Private Channel Posts via Mattermost Jira Plugin Affected: 10.11.0 before 10.11.8; 10.12.0 before 10.12.4; 11.0.0 before 11.0.6; 11.1.0 before 11.1.1 |
| CVE-2025-62190 | 4.3 | Dec 17 | CSRF Allows Call Initiation and Message Delivery Affected: 10.11.0 before 10.11.7; 10.12.0 before 10.12.3; 11.0.0 before 11.0.5 |
| CVE-2025-13870 | 4.3 | Dec 2 | Unauthorized access and subscription vulnerability in Boards Affected: 10.5.0 before 10.5.13; 10.11.0 before 10.11.5 |
| CVE-2025-12756 | 4.3 | Dec 1 | Insecure Direct Object Reference in Mattermost Boards Plugin Enables Unauthorised Comment Deletion Affected: 10.5.0 before 10.5.13; 10.11.0 before 10.11.5; 10.12.0 before 10.12.2; 11.0.0 before 11.0.3 |
| CVE-2025-12559 | 4.3 | Nov 27 | Information Disclosure in Common Teams API Affected: 10.5.0 before 10.5.13; 10.11.0 before 10.11.5; 10.12.0 before 10.12.2; 11.0.0 before 11.0.3 |
| CVE-2025-41436 | 4.3 | Nov 14 | Unauthorized access to archived channel content via threads interface Affected: before 11.0.0 |
| CVE-2025-11776 | 4.3 | Nov 14 | Guest user can discover archived public channels Affected: before 11.0.0 |
| CVE-2025-11777 | 4.3 | Nov 13 | Cross-team channel membership access Affected: 10.5.0 before 10.5.12; 10.11.0 before 10.11.4 |
| CVE-2025-10545 | 4.3 | Oct 16 | Guest user can add unauthorized team users to private channels Affected: 10.5.0 before 10.5.11; 10.11.0 before 10.11.3 |
| CVE-2025-41443 | 4.3 | Oct 16 | Guest user can discover active public channels Affected: 10.5.0 before 10.5.11; 10.11.0 before 10.11.3 |
| CVE-2025-9078 | 4.3 | Sep 15 | Weak cache keys lead to post IDOR and link preview poisoning Affected: 9.11.0 before 9.11.18; 10.5.0 before 10.5.9; 10.8.0 before 10.8.4; 10.9.0 before 10.9.4; 10.10.0 before 10.10.2 |
| CVE-2025-6465 | 4.3 | Aug 21 | Path traversal in image upload with preview overwrite Affected: 10.5.0 before 10.5.9; 10.8.0 before 10.8.4; 10.9.0 before 10.9.4; 10.10.0 |
| CVE-2025-47870 | 4.3 | Aug 21 | Team invite ID leaked to team admin with no member invite privileges Affected: 9.11.0 before 9.11.18; 10.5.0 before 10.5.9; 10.8.0 before 10.8.4; 10.9.0 before 10.9.3 |
| CVE-2025-49810 | 4.3 | Aug 21 | Thread summarization allows persistent access to channel Affected: 10.5.0 before 10.5.9 |
| CVE-2025-3228 | 4.3 | Jun 20 | Unauthorized Guest user access to Playbook Affected: 9.11.0 before 9.11.16; 10.5.0 before 10.5.6; 10.6.0 before 10.6.6; 10.7.0 before 10.7.3; 10.8.0; 10.8.0; +2 more |
| CVE-2025-3227 | 4.3 | Jun 20 | Unauthorized channel member management through playbook runs Affected: 9.11.0 before 9.11.16; 10.5.0 before 10.5.6; 10.6.0 before 10.6.6; 10.7.0 before 10.7.3; 10.8.0; 10.8.0; +2 more |
| CVE-2025-4128 | 4.3 | Jun 11 | Mattermost Guest User Information Disclosure Vulnerability Affected: 9.11.0 before 9.11.14; 10.5.0 before 10.5.5 |
| CVE-2025-3611 | 4.3 | May 30 | Improper Access Control in Mattermost allows System Managers to view team details despite role restrictions Affected: 9.11.0 before 9.11.13; 10.5.0 before 10.5.4; 10.7.0; 10.7.0; 10.7.0 |
| CVE-2025-2527 | 4.3 | May 15 | Improper access control to group information Affected: 9.11.0 before 9.11.12; 10.5.0 before 10.5.3 |
| CVE-2025-3446 | 4.3 | May 15 | Members Without Guest Invite Permissions Can Add Guests to Teams Affected: 9.11.0 before 9.11.12; 10.4.0 before 10.4.5; 10.5.0 before 10.5.3; 10.6.0 before 10.6.2 |
| CVE-2025-41423 | 4.3 | Apr 24 | Unauthorized Playbooks Post Deletion in Mattermost Playbooks Plugin Affected: 9.11.0 before 9.11.11; 10.4.0 before 10.4.3; 10.5.0 |
| CVE-2025-2564 | 4.3 | Apr 16 | Unauthorized View Access to Archived Channel Member Info Affected: 9.11.0 before 9.11.10; 10.4.0 before 10.4.4; 10.5.0 before 10.5.2 |
| CVE-2025-27571 | 4.3 | Apr 16 | Channel metadata visible in archived channels despite configuration setting Affected: 9.11.0 before 9.11.10; 10.4.0 before 10.4.4; 10.5.0 before 10.5.2 |
| CVE-2025-24839 | 4.3 | Apr 16 | Unauthorized AI bot activation via Wrangler plugin Affected: 9.11.0 before 9.11.10; 10.4.0 before 10.4.4; 10.5.0 before 10.5.2 |
| CVE-2025-2424 | 4.3 | Apr 14 | Leaked Metadata of Deleted Files via Bookmark Creation Affected: 9.11.0 before 9.11.10; 10.5.0 before 10.5.2 |
| CVE-2025-24920 | 4.3 | Mar 21 | Unauthorized Bookmark Creation and Modification in Archived Channels Affected: 9.11.0 before 9.11.9; 10.3.0 before 10.3.4; 10.4.0 before 10.4.3; 10.5.0 before 10.5.1 |
| CVE-2025-27933 | 4.3 | Mar 21 | Unauthorized Private-to-Public Channel Conversion Affected: 9.11.0 before 9.11.9; 10.3.0 before 10.3.4; 10.4.0 before 10.4.3 |
| CVE-2025-1472 | 4.3 | Mar 19 | Unauthorized View Access to Site Statistics and Team Statistics Affected: 9.11.0 before 9.11.9 |
| CVE-2025-24526 | 4.3 | Feb 24 | Channel export permitted on archived channel when viewing archived channels is disabled Affected: 9.11.0 before 9.11.8; 10.1.0 before 10.1.4; 10.2.0 before 10.2.3; 10.3.0 before 10.3.3; 10.4.0 before 10.4.2 |
| CVE-2024-12247 | 4.3 | Dec 5 | Improper propagation of permission scheme updates across cluster nodes Affected: 9.7.0 before 9.7.6; 9.8.0 before 9.8.3; 9.9.0 before 9.9.3 |
| CVE-2024-52032 | 4.3 | Nov 9 | Private channel names leaking when Elasticsearch is enabled Affected: 9.11.0 before 9.11.3; 10.0.0; 10.0.0; 10.0.0; 10.0.0; 10.0.0 |
| CVE-2024-42000 | 4.3 | Nov 9 | Unauthorized Access to view channels' details Affected: 9.5.0 before 9.5.10; 9.10.0 before 9.10.3; 9.11.0 before 9.11.2; 10.0.0; 10.0.0; 10.0.0; +2 more |
| CVE-2024-50052 | 4.3 | Oct 29 | Arbitrary post deletion via Playbooks /ignore-thread endpoint Affected: 9.5.0 before 9.5.10; 9.10.0 before 9.10.3; 9.11.0 before 9.11.2 |
| CVE-2024-10241 | 4.3 | Oct 29 | Private channel names leaked with Ctrl+K when ElasticSearch is enabled Affected: 9.5.0 before 9.5.10 |
The 500 most important CVEs for this product (exploited first, then by severity)