MA
Product
Mattermost
451
CVEs
0
On KEV
9.9
Max CVSS
23
New 30D
Severity mix
Critical 9High 53Medium 340Low 49
Watch
Add Mattermost to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2026-21388 | 6.5 | Apr 9 | Unbounded Request Body Read in MS Teams Plugin {{/lifecycle}} Webhook Endpoint Affected: through 2.3.1 |
| CVE-2026-3114 | 6.5 | Mar 26 | Zip Bomb Denial of Service via Unrestricted Archive Decompression Affected: 11.4.0 through 11.4.0; 11.3.0 through 11.3.1; 11.2.0 through 11.2.3; 10.11.0 through 10.11.11 |
| CVE-2026-26233 | 6.5 | Mar 25 | Denial of Service via HTTP/2 single packet attack on login endpoint Affected: 11.4.0 through 11.4.0; 11.3.0 through 11.3.1; 11.2.0 through 11.2.3; 10.11.0 through 10.11.11 |
| CVE-2026-1046 | 6.5 | Feb 16 | Arbitrary application execution via unvalidated server-controlled URLs in Help menu Affected: through 6.2.0; through 5.2.13 |
| CVE-2025-14435 | 6.5 | Jan 16 | Application-Level DoS via infinite re-render loop in user profile handling Affected: 10.11.0 through 10.11.8; 11.1.0 through 11.1.1; 11.0.0 through 11.0.6 |
| CVE-2025-14822 | 6.5 | Jan 16 | DoS from quadratic complexity in model.ParseHashtags Affected: 10.11.0 through 10.11.8 |
| CVE-2025-12689 | 6.5 | Dec 17 | DoS in Calls plugin via malformed UTF-8 in WebSocket request Affected: 11.0.0 through 11.0.4; 10.12.0 through 10.12.2; 10.11.0 through 10.11.6 |
| CVE-2025-59480 | 6.5 | Nov 13 | Inadequate validation of SSO redirect credentials permits credential theft Affected: through 2.32.0 |
| CVE-2025-58084 | 6.5 | Oct 13 | Mattermost Desktop App crashes when clicking on malformed external URL Affected: through 5.13.0 |
| CVE-2025-9081 | 6.5 | Sep 19 | IDOR in board file download allows any user to download any file by UUID Affected: 10.5.0 through 10.5.8; 9.11.0 through 9.11.17 |
| CVE-2025-9076 | 6.5 | Sep 15 | Mattermost Server exposes sensitive user credentials during shared channel membership synchronization Affected: 10.10.0 through 10.10.1 |
| CVE-2025-6226 | 6.5 | Jul 18 | IDOR in CreatePost API allows for timeboxed message disclosure Affected: 10.5.0 through 10.5.6; 10.8.0 through 10.8.1; 10.7.0 through 10.7.3; 9.11.0 through 9.11.16 |
| CVE-2025-31363 | 6.5 | Apr 16 | Data exfiltration via AI plugin Jira tool Affected: 10.4.0 through 10.4.2; 10.5.0; 9.11.0 through 9.11.9 |
| CVE-2025-1558 | 6.5 | Mar 24 | Denial of Service Via Malicious GIF Affected: through 2.25.0 |
| CVE-2025-30179 | 6.5 | Mar 21 | MFA Enforcement Bypass in Search APIs Affected: 10.4.0 through 10.4.2; 10.3.0 through 10.3.3; 9.11.0 through 9.11.8 |
| CVE-2025-20051 | 6.5 | Feb 24 | Arbitrary file read via block duplication in Mattermost Boards Affected: 10.4.0 through 10.4.1; 9.11.0 through 9.11.7; 10.3.0 through 10.3.2; 10.2.0 through 10.2.2 |
| CVE-2025-24490 | 6.5 | Feb 24 | SQL Injection in Mattermost Boards via board category ID reordering Affected: 10.4.0 through 10.4.1; 9.11.0 through 9.11.7; 10.3.0 through 10.3.2; 10.2.0 through 10.2.2 |
| CVE-2025-20088 | 6.5 | Jan 15 | Insufficient Input Validation on Post Props Affected: 10.2.0; 9.11.0 through 9.11.5; 10.0.0 through 10.0.3; 10.1.0 through 10.1.3 |
| CVE-2025-20086 | 6.5 | Jan 15 | Insufficient Input Validation on Post Props Affected: 10.2.0; 9.11.0 through 9.11.5; 10.0.0 through 10.0.3; 10.1.0 through 10.1.3 |
| CVE-2025-21083 | 6.5 | Jan 15 | Insufficient Input Validation on Post Props Affected: through 2.22.0 |
| CVE-2025-20036 | 6.5 | Jan 15 | Insufficient Input Validation on Post Props Affected: through 2.22.0 |
| CVE-2025-21088 | 6.5 | Jan 15 | WebApp crash via improper validation of proto style in attachments Affected: 10.2.0; 9.11.0 through 9.11.5; 10.0.0 through 10.0.3; 10.1.0 through 10.1.3 |
| CVE-2025-20033 | 6.5 | Jan 9 | DoS via custom post type for sysconsole plugin readers Affected: 10.2.0; 9.11.0 through 9.11.5; 10.0.0 through 10.0.3; 10.1.0 through 10.1.3 |
| CVE-2024-54083 | 6.5 | Dec 16 | DoS via lack of type validation in Calls Affected: 10.1.0 through 10.1.2; 10.0.0 through 10.0.2; 9.11.0 through 9.11.4; 9.5.0 through 9.5.12 |
| CVE-2024-47003 | 6.5 | Sep 26 | DoS via non-string message using permalink embed Affected: 9.11.0; 9.5.0 through 9.5.8 |
| CVE-2024-45835 | 6.5 | Sep 16 | Insufficient Electron Fuses Configuration Affected: through 5.8.0 |
| CVE-2024-45833 | 6.5 | Sep 16 | Mobile password gets saved in dictionary under conditions Affected: through 2.18.0 |
| CVE-2024-39836 | 6.5 | Aug 22 | Munged email address used for password resets and notifications Affected: 9.9.0 through 9.9.1; 9.5.0 through 9.5.7; 9.10.0; 9.8.0 through 9.8.2 |
| CVE-2024-39274 | 6.5 | Aug 1 | Malicious remote can add users to arbitrary teams and channels Affected: 9.9.0; 9.5.0 through 9.5.6; 9.7.0 through 9.7.5; 9.8.0 through 9.8.1 |
| CVE-2024-39767 | 6.5 | Jul 15 | Spoofed push notifications from malicious server Affected: through 2.16.0 |
| CVE-2024-6428 | 6.5 | Jul 3 | Limited DoS due to permitting creating users with user-defined IDs Affected: 9.8.0; 9.7.0 through 9.7.4; 9.6.0 through 9.6.2; 9.5.0 through 9.5.5 |
| CVE-2024-4183 | 6.5 | Apr 26 | Mattermost versions 8.1.x before 8.1.12, 9.6.x before 9.6.1, 9.5.x before 9.5.3, 9.4.x before 9.4.5 fail to limit the number of active sessions, which allows an authenticated… Affected: 9.6.0 through 8.1.10; 9.5.0 through 9.5.2; 9.4.0 through 9.4.4; 8.1.0 through 8.1.11 |
| CVE-2024-22091 | 6.5 | Apr 26 | Excessive resource consumption due to lack to request path size limits Affected: 8.1.0 through 8.1.10; 9.6.0; 9.5.0 through 9.5.2; 8.1.0 through 8.1.11 |
| CVE-2024-3872 | 6.5 | Apr 16 | Mattermost Mobile app versions 2.13.0 and earlier use a regular expression with polynomial complexity to parse certain deeplinks, which allows an unauthenticated remote attacker… Affected: through 2.13.0 |
| CVE-2024-2447 | 6.5 | Apr 5 | Mattermost versions 8.1.x before 8.1.11, 9.3.x before 9.3.3, 9.4.x before 9.4.4, and 9.5.x before 9.5.2 fail to authenticate the source of certain types of post actions, allowing… Affected: 9.5.0 through 9.5.1; 9.4.0 through 9.4.3; 9.3.0 through 9.3.2; 8.1.0 through 8.1.10 |
| CVE-2024-28949 | 6.5 | Apr 5 | DoS via a large number of User Preferences Affected: 9.5.0 through 9.5.1; 9.4.0 through 9.4.3; 9.3.0 through 9.3.2; 8.1.0 through 8.1.10 |
| CVE-2024-28053 | 6.5 | Mar 15 | Resource Exhaustion via the Invitation Feature Affected: 8.1.0 through 8.1.9 |
| CVE-2024-24988 | 6.5 | Feb 29 | Excessive resource consumption when sending long emoji names in user custom status Affected: through 9.2.4; through 8.1.8; through 9.3.0 |
| CVE-2024-23493 | 6.5 | Feb 29 | Team associated AD/LDAP Groups Leaked due to missing authorization Affected: through 9.4.1; through 9.3.0; through 9.2.5; through 8.1.8 |
| CVE-2023-49809 | 6.5 | Dec 12 | Todo plugin gets crashed and disabled by member Affected: through 8.1.5 |
| CVE-2023-5333 | 6.5 | Oct 9 | Denial of Service via multiple identical User IDs in /api/v4/users/ids Affected: through 7.8.10; through 8.0.2; through 8.1.1 |
| CVE-2023-5196 | 6.5 | Sep 29 | DoS via Channel Notification Properties Affected: through 7.8.9; 8.1.0; through 8.0.1 |
| CVE-2023-4107 | 6.5 | Aug 11 | Mattermost fails to properly validate the requesting user permissions when updating a system admin, allowing a user manager to update a system admin's details such as email, first… Affected: 7.8.0 before 7.8.8; 7.9.0 before 7.9.6; 7.10.0 before 7.10.4 |
| CVE-2023-4106 | 6.5 | Aug 11 | Mattermost fails to check if the requesting user is a guest before performing different actions to public playbooks, resulting a guest being able to view, join, edit, export and… Affected: 7.8.0 before 7.8.8; 7.9.0 before 7.9.6; 7.10.0 before 7.10.4 |
| CVE-2023-2831 | 6.5 | Jun 16 | Mattermost fails to unescape Markdown strings in a memory-efficient way, allowing an attacker to cause a Denial of Service by sending a message containing a large number of… Affected: 7.1.0 through 7.1.9; 7.8.0 through 7.8.4; 7.9.0 through 7.9.3; 7.10.0 |
| CVE-2023-2797 | 6.5 | Jun 16 | Mattermost fails to sanitize code permalinks, allowing an attacker to preview code from private repositories by posting a specially crafted permalink on a channel Affected: 7.1.0 through 7.1.9; 7.8.0 through 7.8.4; 7.10.0 |
| CVE-2023-2793 | 6.5 | Jun 16 | Mattermost fails to validate links on external websites when constructing a preview for a linked website, allowing an attacker to cause a denial-of-service by a linking to a… Affected: 7.8.0 through 7.8.3; 7.9.0 through 7.9.2; 7.10.0 |
| CVE-2023-2792 | 6.5 | Jun 16 | Mattermost fails to sanitize ephemeral error messages, allowing an attacker to obtain arbitrary message contents by a specially crafted /groupmsg command Affected: 7.1.0 through 7.1.9; 7.8.0 through 7.8.4; 7.9.0 through 7.9.3; 7.10.0 |
| CVE-2023-2788 | 6.5 | Jun 16 | Mattermost fails to check if an admin user account active after an oauth2 flow is started, allowing an attacker with admin privileges to retain persistent access to Mattermost by… Affected: 7.1.0 through 7.1.9; 7.8.0 through 7.8.4; 7.9.0 through 7.9.3; 7.10.0 |
| CVE-2023-2787 | 6.5 | Jun 16 | Mattermost fails to check channel membership when accessing message threads, allowing an attacker to access arbitrary posts by using the message threads API Affected: 7.1.0 through 7.1.9; 7.8.0 through 7.8.4; 7.9.0 through 7.9.3; 7.10.0 |