MA
Product
Mattermost
487
CVEs
0
On KEV
9.9
Max CVSS
23
New 30D
Severity mix
Critical 9High 61Medium 363Low 54
Watch
Add Mattermost to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2023-2785 | 4.3 | Jun 16 | Specially crafted search query can cause large log entries in postgres Affected: through 7.1.9; through 7.8.4; through 7.9.3; 7.10.0 |
| CVE-2023-2791 | 4.3 | Jun 16 | Playbooks lets you edit arbitrary posts Affected: before 7.9.2; before 7.8.3; before 7.7.4; before 7.10.1 |
| CVE-2023-2786 | 4.3 | Jun 16 | Channel commands execution doesn't properly verify permissions Affected: through 7.1.9; through 7.8.4; through 7.9.3; 7.10.0 |
| CVE-2023-2783 | 4.3 | Jun 16 | App Framework does not checks for the secret provided in the incoming webhook request Affected: 7.8.0 through 7.8.4; 7.9.0 through 7.9.3; 7.10.0 |
| CVE-2023-2281 | 4.3 | Apr 25 | Archiving a team broadcasts unsanitized data over WebSockets Affected: before 7.9 |
| CVE-2023-1562 | 4.3 | Mar 22 | Full name revealed via /plugins/focalboard/api/v2/users Affected: 7.4.0 |
| CVE-2022-2408 | 4.3 | Jul 14 | Guest accounts can list all public channels Affected: through 6.3.8; 6.4.x; 6.7.x 6.7.0; 6.5.x through 6.5.1; 6.6.x through 6.6.1 |
| CVE-2022-1332 | 4.3 | Apr 13 | Restricted custom admin role can bypass the restrictions and view the server logs and server config.json file contents Affected: 6.4 before 6.4.2; 6.3 before 6.3.5; 6.2 before 6.2.5; 5.37 before 5.37.9 |
| CVE-2026-15754 | 4.2 | Aug 17 | Missing per-channel team-scope check in ABAC access control policy unassign allows cross-team policy removal Affected: 11.7.0 through 11.7.6; 11.8.0 through 11.8.3 |
| CVE-2025-2571 | 4.2 | May 30 | Google OAuth Authentication Bypass for Converted Bot Accounts Affected: 10.7.0; 10.6.0 through 10.6.2; 10.5.0 through 10.5.3; 9.11.0 through 9.11.12 |
| CVE-2025-64641 | 4.1 | Dec 24 | Mattermost Jira plugin crafted action leaks Jira issue details Affected: 11.1.0 through 11.1.0; 11.0.0 through 11.0.5; 10.12.0 through 10.12.3; 10.11.0 through 10.11.7 |
| CVE-2025-4573 | 4.1 | Jun 11 | LDAP Injection in Mattermost Enterprise Edition When Using Active Directory Affected: 10.7.0 through 10.7.1; 10.6.0 through 10.6.3; 10.5.0 through 10.5.4; 9.11.0 through 9.11.13 |
| CVE-2024-24774 | 4.1 | Feb 9 | Missing authorization allows users to access arbitrary security levels on Jira through webhooks (Jira Plugin) Affected: through 8.1.7 |