MA
Product
Mattermost
394
CVEs
0
On KEV
9.9
Max CVSS
23
New 30D
Severity mix
Critical 8High 48Medium 296Low 42
Watch
Add Mattermost to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2026-4858 | 9.9 | May 21 | Path traversal in integration action URL leading to arbitrary API execution via system admin’s auth token. Affected: 11.6.0 through 11.6.0; 11.5.0 through 11.5.3; 11.4.0 through 11.4.4; 10.11.0 through 10.11.14 |
| CVE-2025-12421 | 9.9 | Nov 27 | Account Takeover via Code Exchange Endpoint Affected: 11.0.0 through 11.0.2; 10.12.0 through 10.12.1; 10.11.0 through 10.11.4; 10.5.0 through 10.5.12 |
| CVE-2025-12419 | 9.9 | Nov 27 | Account takeover on OAuth/OpenID-enabled servers Affected: 10.12.0 through 10.12.1; 10.11.0 through 10.11.4; 10.5.0 through 10.5.12; 11.0.0 through 11.0.3 |
| CVE-2025-4981 | 9.9 | Jun 20 | Path Traversal Leading to RCE by Any Authenticated Mattermost User Affected: 10.5.0 through 10.5.5; 9.11.0 through 9.11.15; 10.8.0 through 10.8.0; 10.7.0 through 10.7.2; 10.6.0 through 10.6.5 |
| CVE-2024-39777 | 9.6 | Aug 1 | Malicious remote can invite itself to an arbitrary local channel Affected: 9.9.0; 9.5.0 through 9.5.6; 9.7.0 through 9.7.5; 9.8.0 through 9.8.1 |
| CVE-2026-12985 | 9.3 | Sep 14 | Mattermost DCR redirect URI allowlist bypass via improper URL component validation Affected: 11.9.0 through 11.9.0; 11.8.0 through 11.8.4; 11.7.0 through 11.7.7 |
| CVE-2023-2193 | 9.1 | Apr 20 | Mattermost fails to invalidate existing authorization codes when deauthorizing an OAuth2 app, allowing an attacker possessing an authorization code to generate an access token Affected: 7.1.7; 7.7.3; 7.8.2; 7.9.1 |
| CVE-2019-20851 | 9.1 | Jun 19 | An issue was discovered in Mattermost Mobile Apps before 1.26.0 Affected: before 1.26.0; before 1.26.0 |
Showing 8