Mattermost Mobile (Mattermost) - vulnerabilities (CVEs)
21 CVEs, 0 in the last 30 days, 177 known versions, newest CVE from 2026-05-21. Vendor: Mattermost.
CVEs of Mattermost Mobile
- CVE-2026-22880 - CVSS 6.1 (medium), 2026-05-21: Mattermost Mobile Apps versions <=2.37 11.4 2.0.37 11.0.4 11.1.3 11.3.2 10.11.11.0 fail to properly validate the SSO authentication callback origin which…
- CVE-2025-59480 - CVSS 6.5 (medium), 2025-11-13: Mattermost Mobile Apps versions <=2.32.0 fail to verify that SSO redirect tokens originate from the trusted server, which allows a malicious Mattermost…
- CVE-2025-30516 - CVSS 7.5 (high), 2025-04-14: Mattermost Mobile Apps versions <=2.25.0 fail to terminate sessions during logout under certain conditions (e.g. poor connectivity), allowing unauthorized…
- CVE-2025-1558 - CVSS 6.5 (medium), 2025-03-24: Mattermost Mobile Apps versions <=2.25.0 fail to properly validate GIF images prior to rendering which allows a malicious user to cause the Android…
- CVE-2025-20630 - CVSS 7.5 (high), 2025-01-16: Mattermost Mobile versions <=2.22.0 fail to properly handle posts with attachments containing fields that cannot be cast to a String, which allows an attacker…
- CVE-2025-20072 - CVSS 7.5 (high), 2025-01-16: Mattermost Mobile versions <= 2.22.0 fail to properly validate the style of proto supplied to an action's style in post.props.attachments, which allows an…
- CVE-2025-0476 - CVSS 4.3 (medium), 2025-01-16: Mattermost Mobile Apps versions <=2.22.0 fail to properly handle specially crafted attachment names, which allows an attacker to crash the mobile app for any…
- CVE-2025-21083 - CVSS 6.5 (medium), 2025-01-15: Mattermost Mobile Apps versions <=2.22.0 fail to properly validate post props which allows a malicious authenticated user to cause a crash via a malicious post.
- CVE-2025-20036 - CVSS 6.5 (medium), 2025-01-15: Mattermost Mobile Apps versions <=2.22.0 fail to properly validate post props which allows a malicious authenticated user to cause a crash via a malicious post.
- CVE-2024-11358 - CVSS 5.7 (medium), 2024-12-16: Mattermost Android Mobile Apps versions <=2.21.0 fail to properly configure file providers which allows an attacker with local access to access files via file…
- CVE-2024-45833 - CVSS 6.5 (medium), 2024-09-16: Mattermost Mobile Apps versions <=2.18.0 fail to disable autocomplete during login while typing the password and visible password is selected, which allows…
- CVE-2024-32945 - CVSS 5.3 (medium), 2024-07-15: Mattermost Mobile Apps versions <=2.16.0 fail to protect against abuse of a globally shared MathJax state which allows an attacker to change the contents of a…
- CVE-2024-39767 - CVSS 6.5 (medium), 2024-07-15: Mattermost Mobile Apps versions <=2.16.0 fail to validate that the push notifications received for a server actually came from this serve that which allows a…
- CVE-2024-3872 - CVSS 6.5 (medium), 2024-04-16: Mattermost Mobile app versions 2.13.0 and earlier use a regular expression with polynomial complexity to parse certain deeplinks, which allows an…
- CVE-2024-24975 - CVSS 6.5 (medium), 2024-03-15: Uncontrolled Resource Consumption in Mattermost Mobile versions before 2.13.0 fails to limit the size of the code block that will be processed by the syntax…
- CVE-2019-20852 - CVSS 7.5 (high), 2020-06-19: An issue was discovered in Mattermost Mobile Apps before 1.26.0. Local logging is not blocked for sensitive information (e.g., server addresses or message…
- CVE-2020-14451 - CVSS 7.5 (high), 2020-06-19: An issue was discovered in Mattermost Mobile Apps before 1.29.0. The iOS app allowed Single Sign-On cookies and Local Storage to remain after a logout, aka…
- CVE-2020-14449 - CVSS 7.5 (high), 2020-06-19: An issue was discovered in Mattermost Mobile Apps before 1.30.0. Authorization tokens can sometimes be disclosed to third-party servers, aka MMSA-2020-0018.
- CVE-2019-20849 - CVSS 5.3 (medium), 2020-06-19: An issue was discovered in Mattermost Mobile Apps before 1.26.0. Cookie data can persist on a device after a logout.
- CVE-2019-20848 - CVSS 7.5 (high), 2020-06-19: An issue was discovered in Mattermost Mobile Apps before 1.26.0. The Quick Reply feature mishandles crafted replies.
- CVE-2019-20850 - CVSS 5.3 (medium), 2020-06-19: An issue was discovered in Mattermost Mobile Apps before 1.26.0. A view cache can persist on a device after a logout.
