MA
Product
Mattermost
463
CVEs
0
On KEV
9.9
Max CVSS
23
New 30D
Severity mix
Critical 9High 57Medium 345Low 52
Watch
Add Mattermost to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2026-6739 | 7.2 | Jun 12 | Mattermost: Delegated admins could patch protected default system roles Affected: 11.6.0 through 11.6.1; 11.5.0 through 11.5.4; 10.11.0 through 10.11.15; 10.11.0 through 10.11.16 |
| CVE-2025-9079 | 7.2 | Sep 19 | Admin RCE via prepackaged plugins by way of misconfigured imports directory Affected: 10.8.0 through 10.8.3; 10.5.0 through 10.5.8; 9.11.0 through 9.11.17; 10.10.0 through 10.10.1; 10.9.0 through 10.9.3 |
| CVE-2024-8071 | 7.2 | Aug 22 | System Role with edit access to permissions can elevate themselves to system admin Affected: 9.9.0 through 9.9.1; 9.5.0 through 9.5.7; 9.10.0; 9.8.0 through 9.8.2 |
| CVE-2026-16453 | 7.1 | Oct 16 | Mattermost SAML RelayState forgery allows unauthorized team membership Affected: 11.10.0 through 11.10.0; 11.7.0 through 11.7.9; 11.9.0 through 11.9.1; 11.8.0 through 11.8.5 |
| CVE-2026-8821 | 7.1 | Sep 14 | Playbooks run owner channel membership permission bypass Affected: 11.9.0 through 11.9.0; 11.8.0 through 11.8.4; 11.7.0 through 11.7.7; 10.11.0 through 10.11.22 |
| CVE-2026-3473 | 7.1 | May 22 | Improper file ownership validation in the Boards API allows unauthorised file access Affected: 11.6.0 through 11.6.0; 11.5.0 through 11.5.3; 11.4.0 through 11.4.4; 10.11.0 through 10.11.14 |
| CVE-2024-41144 | 7.1 | Aug 1 | Malicious remote can create/update/delete arbitrary posts in arbitrary channels Affected: 9.9.0; 9.5.0 through 9.5.6; 9.7.0 through 9.7.5; 9.8.0 through 9.8.1 |