MA
Product
Mattermost
405
CVEs
0
On KEV
9.9
Max CVSS
23
New 30D
Severity mix
Critical 8High 48Medium 306Low 43
Watch
Add Mattermost to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2024-39353 | 2.7 | Jul 3 | RemoteClusterFrame payloads are audit logged in full Affected: 9.8.0; 9.5.0 through 9.5.5 |
| CVE-2023-5193 | 2.7 | Sep 29 | Mattermost fails to properly check permissions when retrieving a post allowing for a System Role with the permission to manage channels to read the posts of a DM conversation Affected: 7.0.0 before 7.8.10; 8.0.0 before 8.0.2; 8.1.0 before 8.1.1 |
| CVE-2023-5159 | 2.7 | Sep 29 | Mattermost fails to properly verify the permissions when managing/updating a bot allowing a User Manager role with user edit permissions to manage/update bots Affected: 7.0.0 before 7.8.10; 8.0.0 before 8.1.1 |
| CVE-2026-75588 | 2.6 | Sep 17 | Mattermost Desktop App plugin popout scheme validation bypass Affected: through 6.2.2 |
| CVE-2026-3109 | 2.2 | Mar 26 | Missing timestamp validation in Zoom webhook handler Affected: through 10.11.11 |