Path traversal in integration action URL leading to arbitrary API execution via system admin’s auth token.

Account Takeover via Code Exchange Endpoint

Account takeover on OAuth/OpenID-enabled servers

Path Traversal Leading to RCE by Any Authenticated Mattermost User

Client side path traversal due to lack of route parameters validation

Malicious remote can invite itself to an arbitrary local channel

Mattermost DCR redirect URI allowlist bypass via improper URL component validation

Mattermost fails to invalidate existing authorization codes when deauthorizing an OAuth2 app, allowing an attacker possessing an authorization code to generate an access token

An issue was discovered in Mattermost Mobile Apps before 1.26.0

Mattermost group syncable endpoints allow privilege escalation via scheme_admin

Authorization Bypass in Mattermost Legal Hold Plugin Due to Missing Return After Permission Check

Terminal Escape Injection in mmctl Report Posts Command

Bypassing MFA Enforcement on Plugin Endpoints

Unauthorized Command Execution in Archived Channels

Session Persistence After User-to-Bot Conversion

One-click Client-Side Path Traversal Leading to CSRF in User Management admin page

Mattermost versions 8.1.x before 8.1.10, 9.2.x before 9.2.6, 9.3.x before 9.3.2, and 9.4.x before 9.4.3 fail to correctly verify account ownership when switching from email to…

Mattermost version 2.10.0 and earlier fails to sanitize deeplink paths, which allows an attacker to perform CSRF attacks against the server

Reflected client side path traversal leading to CSRF in Playbooks

Sensitive credentials exposed in plaintext in Mattermost support packets

Permanently local data deletion by malicious remote

DoS in Calls plugin via malformed msgpack in websocket request.

Insufficient server-side validation of board member role fields permits privilege escalation

Mattermost Jira plugin user spoofing enables Jira request forgery.

CSRF Protection Bypass Allows Updating a User's Authentication Method

Arbitrary Mattermost Team can be joined by manipulating the OAuth state

Arbitrary Mattermost Team can be joined by manipulating the SAML RelayState

Mattermost iOS app fails to properly validate the server certificate while initializing the TLS connection allowing a network attacker to intercept the WebSockets connection

Path traversal in Mattermost Agents plugin mention reminder allows plugin replacement via crafted post

RCE in desktop app in Windows by local attacker

Mattermost Desktop App fails to restrict the allow list of domains which NTLM credentials are passed

CVE-2026-6961: Path traversal via unsanitized FileInfo.Name in Mattermost federation sync

Mattermost Calls plugin exposes TURN server credentials in plaintext in support packets

Unauthenticated WebSocket binary frame causes denial of service in Mattermost Server

Missing request body size limits on Zoom plugin HTTP endpoints

DoS via URL Previews Rendering Malicious SVGs

DoS attack via login attempts with multi-megabyte passwords

Lack of MFA enforcement in WebSocket connections

DoS in Mattermost Playbooks via Excessive Task Actions

Webapp DoS via malicious retrospective post in Playbooks

Unauthorized Notification Exposure in Mobile App Under Specific Conditions

Arbitrary file read in Mattermost Boards via import & export board archive

Mobile crash via object that can't be cast to String in Attachment Field

Webapp crash via object that can't be cast to String in Attachment Field

Mobile crash via improper validation of proto style in attachments

DoS via Amplified GraphQL Response in Playbooks

Playbook plugin crash via missing interface type assertion

Playbook Plugin Crash via Run Checklist

Denial of Service via specially crafted block fields in Mattermost Boards

Denial of Service via Board Import Zip Bomb