Mattermost group syncable endpoints allow privilege escalation via scheme_admin

Authorization Bypass in Mattermost Legal Hold Plugin Due to Missing Return After Permission Check

Terminal Escape Injection in mmctl Report Posts Command

Bypassing MFA Enforcement on Plugin Endpoints

Unauthorized Command Execution in Archived Channels

Session Persistence After User-to-Bot Conversion

One-click Client-Side Path Traversal Leading to CSRF in User Management admin page

Mattermost versions 8.1.x before 8.1.10, 9.2.x before 9.2.6, 9.3.x before 9.3.2, and 9.4.x before 9.4.3 fail to correctly verify account ownership when switching from email to…

Mattermost version 2.10.0 and earlier fails to sanitize deeplink paths, which allows an attacker to perform CSRF attacks against the server

Reflected client side path traversal leading to CSRF in Playbooks

Sensitive credentials exposed in plaintext in Mattermost support packets

Permanently local data deletion by malicious remote

DoS in Calls plugin via malformed msgpack in websocket request.

Insufficient server-side validation of board member role fields permits privilege escalation

Mattermost Jira plugin user spoofing enables Jira request forgery.

CSRF Protection Bypass Allows Updating a User's Authentication Method

Arbitrary Mattermost Team can be joined by manipulating the OAuth state

Arbitrary Mattermost Team can be joined by manipulating the SAML RelayState

Mattermost iOS app fails to properly validate the server certificate while initializing the TLS connection allowing a network attacker to intercept the WebSockets connection

Path traversal in Mattermost Agents plugin mention reminder allows plugin replacement via crafted post

RCE in desktop app in Windows by local attacker

Mattermost Desktop App fails to restrict the allow list of domains which NTLM credentials are passed

CVE-2026-6961: Path traversal via unsanitized FileInfo.Name in Mattermost federation sync

Mattermost Calls plugin exposes TURN server credentials in plaintext in support packets

Unauthenticated WebSocket binary frame causes denial of service in Mattermost Server

Missing request body size limits on Zoom plugin HTTP endpoints

DoS via URL Previews Rendering Malicious SVGs

DoS attack via login attempts with multi-megabyte passwords

Lack of MFA enforcement in WebSocket connections

DoS in Mattermost Playbooks via Excessive Task Actions

Webapp DoS via malicious retrospective post in Playbooks

Unauthorized Notification Exposure in Mobile App Under Specific Conditions

Arbitrary file read in Mattermost Boards via import & export board archive

Mobile crash via object that can't be cast to String in Attachment Field

Webapp crash via object that can't be cast to String in Attachment Field

Mobile crash via improper validation of proto style in attachments

DoS via Amplified GraphQL Response in Playbooks

Playbook plugin crash via missing interface type assertion

Playbook Plugin Crash via Run Checklist

Denial of Service via specially crafted block fields in Mattermost Boards

Denial of Service via Board Import Zip Bomb

Mattermost fails to sanitize post metadata during audit logging resulting in permalinks contents being logged

Mattermost Sever fails to redact the DB username and password before emitting an application log during server initialization

Mattermost 6.0.2 and earlier fails to sufficiently sanitize user's password in audit logs when user creation fails

An issue was discovered in Mattermost Mobile Apps before 1.31.2 on iOS

Mattermost: Delegated admins could patch protected default system roles

Admin RCE via prepackaged plugins by way of misconfigured imports directory

System Role with edit access to permissions can elevate themselves to system admin

Mattermost SAML RelayState forgery allows unauthorized team membership

Playbooks run owner channel membership permission bypass