Mattermost Server (Mattermost) - vulnerabilities (CVEs)

489 CVEs, 3 in the last 30 days, 1340 known versions, newest CVE from 2026-10-16. Vendor: Mattermost.

CVEs of Mattermost Server

• CVE-2026-19076 - CVSS 4.9 (medium), 2026-10-16: Mattermost versions 11.10.x <= 11.10.0, 11.7.x <= 11.7.9, 11.9.x <= 11.9.1, 11.8.x <= 11.8.5 fail to reject OAuth application sessions in the account type…
• CVE-2026-19600 - CVSS 4.9 (medium), 2026-10-16: Mattermost versions 11.9.x <= 11.9.1, 11.8.x <= 11.8.5, 11.7.x <= 11.7.10, 11.10.x <= 11.10.1 fail to sanitize authentication tokens before writing them to…
• CVE-2026-19621 - CVSS 6.5 (medium), 2026-10-16: Mattermost versions 11.10.x <= 11.10.0, 11.7.x <= 11.7.9, 11.9.x <= 11.9.1, 11.8.x <= 11.8.5 fail to strip action integration secrets from post payloads…
• CVE-2026-96260 - CVSS 6.5 (medium), 2026-09-22: Mattermost versions 11.9.x <= 11.9.1, 11.8.x <= 11.8.5, 11.7.x <= 11.7.10, 11.10.x <= 11.10.1 fail to enforce a request body size limit during CSRF validation…
• CVE-2026-96259 - CVSS 5.5 (medium), 2026-09-22: Mattermost versions 11.9.x <= 11.9.1, 11.8.x <= 11.8.5, 11.7.x <= 11.7.10, 11.10.x <= 11.10.1 fail to apply the internal-connection filter to OAuth endpoint…
• CVE-2026-95666 - CVSS 4.3 (medium), 2026-09-22: Mattermost versions 11.9.x <= 11.9.1, 11.8.x <= 11.8.5, 11.7.x <= 11.7.10, 11.10.x <= 11.10.1 fail to limit the length of the post ID array accepted by the…
• CVE-2026-91181 - CVSS 6.5 (medium), 2026-09-14: Mattermost versions 11.9.x <= 11.9.0, 11.8.x <= 11.8.4, 11.7.x <= 11.7.7, 10.11.x <= 10.11.22 Fail to sanitize Team objects returned by the data retention…
• CVE-2026-12985 - CVSS 9.3 (critical), 2026-09-14: Mattermost versions 11.9.x <= 11.9.0, 11.8.x <= 11.8.4, 11.7.x <= 11.7.7 Mattermost failed to validate Dynamic Client Registration redirect URIs by URL…
• CVE-2026-82920 - CVSS 5.5 (medium), 2026-09-14: Mattermost versions 11.9.x <= 11.9.0, 11.8.x <= 11.8.4, 11.7.x <= 11.7.7 fail to enforce authorization boundaries on the access control policy update endpoint…
• CVE-2026-86348 - CVSS 4.3 (medium), 2026-09-14: Mattermost versions <=11.9 11.0.9 11.4.8 11.7.7 10.22.11.0 fail to recover from handler panics, which allows an authenticated user to crash the plugin via a…
• CVE-2026-86349 - CVSS 4.3 (medium), 2026-09-14: Mattermost versions 11.9.x <= 11.9.0, 11.8.x <= 11.8.4, 11.7.x <= 11.7.8, 10.11.x <= 10.11.22 fail to limit the nesting depth in the server-side Markdown…
• CVE-2026-10556 - CVSS 5.3 (medium), 2026-09-14: Mattermost versions 11.9.x <= 11.9.0, 11.8.x <= 11.8.4, 11.7.x <= 11.7.7, 10.11.x <= 10.11.22 fail to validate null entries in Microsoft Graph webhook…
• CVE-2026-13417 - CVSS 4.3 (medium), 2026-09-14: Mattermost versions 11.9.x <= 11.9.0, 11.8.x <= 11.8.4, 11.7.x <= 11.7.7, 10.11.x <= 10.11.22 fail to validate the type of `fields.properties` on block…
• CVE-2026-9812 - CVSS 6.5 (medium), 2026-09-14: Mattermost versions 11.9.x <= 11.9.0, 11.8.x <= 11.8.4, 11.7.x <= 11.7.7, 10.11.x <= 10.11.22 fail to validate that a property field belongs to the specified…
• CVE-2026-8821 - CVSS 7.1 (high), 2026-09-14: Mattermost versions 11.9.x <= 11.9.0, 11.8.x <= 11.8.4, 11.7.x <= 11.7.7, 10.11.x <= 10.11.22 fail to validate channel member-management permission during…
• CVE-2026-5132 - CVSS 6.5 (medium), 2026-09-14: Mattermost versions 11.9.x <= 11.9.0, 11.8.x <= 11.8.4, 11.7.x <= 11.7.7, 10.11.x <= 10.11.22 fail to limit size of unpacked SDP messages compressed with…
• CVE-2026-15814 - CVSS 6.5 (medium), 2026-09-14: Mattermost versions 11.9.x <= 11.9.0, 11.8.x <= 11.8.4, 11.7.x <= 11.7.7, 10.11.x <= 10.11.22 fail to limit the amount of memory allocated when decoding…
• CVE-2026-10542 - CVSS 5 (medium), 2026-09-14: Mattermost versions 11.9.x <= 11.9.0, 11.8.x <= 11.8.4, 11.7.x <= 11.7.7, 10.11.x <= 10.11.22 fail to validate channel action ownership which allows channel…
• CVE-2026-14344 - CVSS 4.3 (medium), 2026-09-14: Mattermost versions 11.9.x <= 11.9.0, 11.8.x <= 11.8.4, 11.7.x <= 11.7.7, 10.11.x <= 10.11.22 fail to enforce the board-creation permission which allows an…
• CVE-2026-12882 - CVSS 4.3 (medium), 2026-09-14: Mattermost versions 11.9.x <= 11.9.0, 11.8.x <= 11.8.4, 11.7.x <= 11.7.7, 10.11.x <= 10.11.22 fail to parse Markdown autolinks with unmatched trailing closing…
• CVE-2026-11993 - CVSS 4.3 (medium), 2026-09-14: Mattermost versions 11.9.x <= 11.9.0, 11.8.x <= 11.8.4, 11.7.x <= 11.7.7, 10.11.x <= 10.11.22 fail to properly enforce the limit of concurrent files being…
• CVE-2026-14259 - CVSS 4.3 (medium), 2026-09-14: Mattermost versions 11.9.x <= 11.9.0, 11.8.x <= 11.8.4, 11.7.x <= 11.7.7, 10.11.x <= 10.11.22 fail to enforce board creation permissions when importing…
• CVE-2026-9693 - CVSS 3.5 (low), 2026-08-17: Mattermost versions 10.11.x <= 10.11.20, 11.7.x <= 11.7.5 Mattermost fails to remove thread membership records when a user is removed from or leaves a team,…
• CVE-2026-9859 - CVSS 6.5 (medium), 2026-08-17: Mattermost versions 11.7.x <= 11.7.6, 10.11.x <= 10.11.21, 11.8.x <= 11.8.3 fail to enforce PermissionManageBoardRoles on the channelId field of the batch…
• CVE-2026-9816 - CVSS 8.3 (high), 2026-08-17: Mattermost versions 11.7.x <= 11.7.6, 10.11.x <= 10.11.21, 11.8.x <= 11.8.3 fail to validate BoardMember.Scheme* fields server-side on insert and…
• CVE-2026-10080 - CVSS 6.5 (medium), 2026-08-17: Mattermost versions 11.7.x <= 11.7.6, 10.11.x <= 10.11.21, 11.8.x <= 11.8.3 fails to validate WebSocket command field types which allows an authenticated user…
• CVE-2026-10527 - CVSS 6.3 (medium), 2026-08-17: Mattermost versions 11.7.x <= 11.7.6, 10.11.x <= 10.11.21, 11.8.x <= 11.8.3 fails to reconcile SchemeAdmin flags with a user's current role which allows a…
• CVE-2026-15754 - CVSS 4.2 (medium), 2026-08-17: Mattermost versions 11.7.x <= 11.7.6, 11.8.x <= 11.8.3 The access control policy unassign endpoint fails to re-validate that each target channel still belongs…
• CVE-2026-16044 - CVSS 5.4 (medium), 2026-08-17: Mattermost versions 11.7.x <= 11.7.6, 10.11.x <= 10.11.21 fail to prevent guest users from receiving Board Admin privileges during board archive import which…
• CVE-2026-16045 - CVSS 4.3 (medium), 2026-08-17: Mattermost versions 11.7.x <= 11.7.6, 10.11.x <= 10.11.21 Mattermost failed to restrict OAuth deauthorization and personal access token management endpoints…
• CVE-2026-16047 - CVSS 4.3 (medium), 2026-08-17: Mattermost versions 11.7.x <= 11.7.6, 10.11.x <= 10.11.21, 11.8.x <= 11.8.3 fail to validate that users have read access to a channel before linking a board…
• CVE-2026-16046 - CVSS 4.3 (medium), 2026-08-17: Mattermost versions 11.7.x <= 11.7.6, 10.11.x <= 10.11.21 fail to enforce run-state validation on write operations for finished playbook runs which allows a…
• CVE-2026-16048 - CVSS 6.3 (medium), 2026-08-17: Mattermost versions 11.8.x <= 11.8.2, 11.7.x <= 11.7.6, 10.11.x <= 10.11.21 fail to restrict channel member role assignment to channel-scoped roles which…
• CVE-2026-14298 - CVSS 6.5 (medium), 2026-08-13: Mattermost versions 11.9.x <= 11.9.0, 11.8.x <= 11.8.4, 11.7.x <= 11.7.7, 10.11.x <= 10.11.22 fail to limit decompressed content size and enforce the…
• CVE-2026-7521 - CVSS 5.5 (medium), 2026-07-28: Mattermost versions 11.8.x <= 11.8.0, 11.7.x <= 11.7.3, 11.6.x <= 11.6.5, 10.11.x <= 10.11.20 fail to verify file deletion path which allows an admin with…
• CVE-2026-10819 - CVSS 6.5 (medium), 2026-07-27: Mattermost versions 11.6.x <= 11.6.5, 10.11.x <= 10.11.20, 11.8.x <= 11.8.1, 11.7.x <= 11.7.4 fail to limit the number of frames and enforce the file size cap…
• CVE-2026-10600 - CVSS 4.3 (medium), 2026-07-27: Mattermost versions 11.8.x <= 11.8.0, 11.7.x <= 11.7.3, 11.6.x <= 11.6.5, 10.11.x <= 10.11.20 fail to bound the time and resource consumption of server-side…
• CVE-2026-6541 - CVSS 4.3 (medium), 2026-07-13: Mattermost versions 11.7.x <= 11.7.1, 11.6.x <= 11.6.4, 10.11.x <= 10.11.19 fail to restrict metric configuration changes to the playbook being saved, which…
• CVE-2026-9820 - CVSS 3.8 (low), 2026-07-13: Mattermost versions 11.7.x <= 11.7.2, 10.11.x <= 10.11.19 fail to sanitize team objects returned by the scheme teams endpoint, which allows a user with the…
• CVE-2026-9824 - CVSS 4.3 (medium), 2026-07-13: Mattermost versions 11.7.x <= 11.7.2, 11.6.x <= 11.6.4, 10.11.x <= 10.11.19 fail to check the manage_shared_channels permission in the /share-channel…
• CVE-2026-9597 - CVSS 5.4 (medium), 2026-07-13: Mattermost versions 11.7.x <= 11.7.2, 11.6.x <= 11.6.4 fail to verify whether a guest account is deactivated before creating a session in the magic-link token…
• CVE-2026-6850 - CVSS 6.5 (medium), 2026-07-13: Mattermost versions 11.7.x <= 11.7.2, 11.6.x <= 11.6.4, 10.11.x <= 10.11.19 fail to validate the length and content of message attachment field values, which…
• CVE-2026-10106 - CVSS 6.5 (medium), 2026-07-13: Mattermost versions 11.7.x <= 11.7.2, 11.6.x <= 11.6.4, 10.11.x <= 10.11.19 fail to verify that the channel referenced in an action cookie matches the channel…
• CVE-2026-10085 - CVSS 5.4 (medium), 2026-07-13: Mattermost versions 11.7.x <= 11.7.2, 11.6.x <= 11.6.4, 10.11.x <= 10.11.19 fail to restrict the group_constrained channel flag to public and private channels…
• CVE-2026-9708 - CVSS 4.9 (medium), 2026-07-13: Mattermost versions 11.7.x <= 11.7.2, 11.6.x <= 11.6.4, 10.11.x <= 10.11.19 fail to validate that an assigned incoming webhook user has access to the target…
• CVE-2026-10103 - CVSS 4.3 (medium), 2026-07-13: Mattermost versions 11.7.x <= 11.7.2, 11.6.x <= 11.6.4, 10.11.x <= 10.11.19 fail to verify post ownership in the shared channel inbound sync handler, which…
• CVE-2026-9571 - CVSS 6.5 (medium), 2026-07-13: Mattermost versions 11.7.x <= 11.7.2, 11.6.x <= 11.6.4, 10.11.x <= 10.11.19 fail to invalidate OAuth refresh tokens upon user account deactivation, which…
• CVE-2026-4339 - CVSS 6.5 (medium), 2026-06-26: Mattermost versions 10.11.x <= 10.11.18, 11.6.x <= 11.6.3, 11.5.x <= 11.5.6 fail to validate attachment URLs against internal or private IP ranges in the…
• CVE-2026-3472 - CVSS 3.5 (low), 2026-06-26: Mattermost versions 10.11.x <= 10.11.18, 11.6.x <= 11.6.3, 11.5.x <= 11.5.6 fail to properly apply markdown image rendering restrictions to AI bot tool result…
• CVE-2026-8823 - CVSS 3.8 (low), 2026-06-22: Mattermost versions 11.7.x <= 11.7.0, 10.11.x <= 10.11.17 fail to validate bot targets when demoting users to guests which allows a lower-privileged…
• CVE-2026-6062 - CVSS 6.4 (medium), 2026-06-22: Mattermost versions 11.7.x <= 11.7.0, 11.6.x <= 11.6.2, 11.5.x <= 11.5.5, 10.11.x <= 10.11.17 Fail to validate channel ownership of an existing subscription…
• CVE-2026-6673 - CVSS 6.4 (medium), 2026-06-22: Mattermost versions 11.7.x <= 11.7.0, 11.6.x <= 11.6.2, 11.5.x <= 11.5.5, 10.11.x <= 10.11.17 fail to authenticate Atlassian Connect installed callbacks,…
• CVE-2026-8074 - CVSS 3.8 (low), 2026-06-22: Mattermost versions 11.7.x <= 11.7.0, 10.11.x <= 10.11.17 fail to enforce bot-specific permission checks on the user active status endpoint, which allows a…
• CVE-2026-9162 - CVSS 4.3 (medium), 2026-06-22: Mattermost versions 11.7.x <= 11.7.0, 11.6.x <= 11.6.2, 11.5.x <= 11.5.5, 10.11.x <= 10.11.17 fail to invalidate cached authentication state for active…
• CVE-2026-5139 - CVSS 5.4 (medium), 2026-06-22: Mattermost versions 11.7.x <= 11.7.0, 11.6.x <= 11.6.2, 11.5.x <= 11.5.5, 10.11.x <= 10.11.17 fail to enforce administrator authorization on the…
• CVE-2026-6739 - CVSS 7.2 (high), 2026-06-12: Mattermost versions 11.6.x <= 11.6.1, 11.5.x <= 11.5.4, 10.11.x <= 10.11.15, 10.11.x <= 10.11.16 fail to require system-level permission when patching…
• CVE-2026-7387 - CVSS 8.8 (high), 2026-06-12: Mattermost versions 11.6.x <= 11.6.1, 11.5.x <= 11.5.4, 10.11.x <= 10.11.15, 10.11.x <= 10.11.16 Mattermost fails to require role-management authorization…
• CVE-2026-6689 - CVSS 4.3 (medium), 2026-06-12: Mattermost versions 11.6.x <= 11.6.1, 11.5.x <= 11.5.4, 10.11.x <= 10.11.15, 10.11.x <= 10.11.16 Fail to enforce PermissionInviteUser when setting…
• CVE-2026-7184 - CVSS 6.5 (medium), 2026-06-12: Mattermost versions 11.6.x <= 11.6.1, 11.5.x <= 11.5.4, 10.11.x <= 10.11.15 fail to sanitize the Remote Cluster API response on PATCH operations, which allows…
• CVE-2026-6961 - CVSS 7.6 (high), 2026-06-12: Mattermost versions 11.6.x <= 11.6.1, 11.5.x <= 11.5.4, 10.11.x <= 10.11.15, 10.11.x <= 10.11.16 Mattermost fails to sanitize FileInfo.Name received from…
• CVE-2026-6046 - CVSS 5.3 (medium), 2026-06-12: Mattermost versions 11.6.x <= 11.6.1, 11.5.x <= 11.5.4, 10.11.x <= 10.11.15, 10.11.x <= 10.11.16 fail to validate that a username returned during bot…
• CVE-2026-3433 - CVSS 4.3 (medium), 2026-06-12: Mattermost versions 11.6.x <= 11.6.1, 11.5.x <= 11.5.4, 10.11.x <= 10.11.15, 10.11.x <= 10.11.16 fail to restrict role_updated websocket event broadcasts to…
• CVE-2026-4915 - CVSS 6.5 (medium), 2026-05-25: Mattermost versions 11.6.x <= 11.6.0, 11.5.x <= 11.5.3, 11.4.x <= 11.4.4, 10.11.x <= 10.11.14 fail to filter nil elements from outgoing webhook attachment…
• CVE-2026-28735 - CVSS 5.4 (medium), 2026-05-22: Mattermost versions 11.6.x <= 11.6.0, 11.5.x <= 11.5.3, 11.4.x <= 11.4.4, 10.11.x <= 10.11.14 fail to validate the OAuth token scope on the callback which…
• CVE-2026-4635 - CVSS 6.5 (medium), 2026-05-22: Mattermost versions 11.6.x <= 11.6.0, 11.5.x <= 11.5.3, 11.4.x <= 11.4.4, 10.11.x <= 10.11.14 fail to archive the channel before removing persistent…
• CVE-2026-3473 - CVSS 7.1 (high), 2026-05-22: Mattermost versions 11.6.x <= 11.6.0, 11.5.x <= 11.5.3, 11.4.x <= 11.4.4, 10.11.x <= 10.11.14 fail to validate file ownership and access control, which allows…
• CVE-2026-4646 - CVSS 4.3 (medium), 2026-05-22: Mattermost versions 11.6.x <= 11.6.0, 11.5.x <= 11.5.3, 11.4.x <= 11.4.4, 10.11.x <= 10.11.14 fail to validate user-supplied input in API request handlers…
• CVE-2026-3636 - CVSS 4.3 (medium), 2026-05-22: Mattermost versions 11.6.x <= 11.6.0, 11.5.x <= 11.5.3, 11.4.x <= 11.4.4, 10.11.x <= 10.11.14 fail to sanitize team member data when returned via API to users…
• CVE-2026-5740 - CVSS 7.5 (high), 2026-05-22: Mattermost versions 11.6.x <= 11.6.0, 11.5.x <= 11.5.3, 11.4.x <= 11.4.4, 10.11.x <= 10.11.14 fail to properly validate msgpack-encoded WebSocket frames…
• CVE-2026-5308 - CVSS 7.5 (high), 2026-05-22: Mattermost versions 11.6.x <= 11.6.0, 11.5.x <= 11.5.3, 11.4.x <= 11.4.4, 10.11.x <= 10.11.14 fail to enforce request body size limits on plugin HTTP…
• CVE-2026-5755 - CVSS 6.5 (medium), 2026-05-22: Mattermost versions 11.6.x <= 11.6.0, 11.5.x <= 11.5.2, 11.5.x <= 11.5.3, 11.4.x <= 11.4.4, 10.11.x <= 10.11.14 fail to validate the TIFF IFD offset in the…
• CVE-2026-4858 - CVSS 9.9 (critical), 2026-05-21: Mattermost versions 11.6.x <= 11.6.0, 11.5.x <= 11.5.3, 11.4.x <= 11.4.4, 10.11.x <= 10.11.14 fail to check integration URL for path traversal which allows an…
• CVE-2026-4055 - CVSS 4.3 (medium), 2026-05-21: Mattermost versions 11.5.x <= 11.5.1 fail to validate team-level run_create permission against the target team when creating a playbook run which allows an…
• CVE-2026-6346 - CVSS 8.7 (high), 2026-05-18: Mattermost versions 11.5.x <= 11.5.1, 10.11.x <= 10.11.13, 11.4.x <= 11.4.3 fail to sanitize sensitive configuration fields before including them in support…
• CVE-2026-6347 - CVSS 7.6 (high), 2026-05-18: Mattermost versions 11.5.x <= 11.5.1, 10.11.x <= 10.11.13, 11.4.x <= 11.4.3 fail to sanitize sensitive configuration fields in the Mattermost Calls plugin…
• CVE-2026-6339 - CVSS 4.3 (medium), 2026-05-18: Mattermost versions 11.5.x <= 11.5.1, 11.4.x <= 11.4.3 fail to validate the X-Requested-With header on the burn-on-read reveal endpoint which allows an…
• CVE-2026-6333 - CVSS 5 (medium), 2026-05-18: Mattermost versions 11.5.x <= 11.5.1, 10.11.x <= 10.11.13 fail to validate the Host header when constructing response URLs for custom slash commands which…
• CVE-2026-6345 - CVSS 6.5 (medium), 2026-05-18: Mattermost versions 11.5.x <= 11.5.1, 10.11.x <= 10.11.13, 11.4.x <= 11.4.3 fail prevent disclosure of created user password which allows a malicious attacker…
• CVE-2026-5163 - CVSS 6.5 (medium), 2026-05-18: Mattermost versions 11.5.x <= 11.5.1 fail to verify channel membership when processing AI-assisted message rewrites which allows an authenticated attacker to…
• CVE-2026-6343 - CVSS 4.3 (medium), 2026-05-18: Mattermost versions 11.5.x <= 11.5.1, 10.11.x <= 10.11.13, 11.4.x <= 11.4.3 fail to check public/private permissions which allows members without these…
• CVE-2026-3117 - CVSS 6.5 (medium), 2026-05-18: Mattermost Plugins versions <=11.5 11.1.5 10.13.11 11.3.4.0 fail to properly check for permissions when processing commands in the Gitlab plugin which allows…
• CVE-2026-28732 - CVSS 4.3 (medium), 2026-05-18: Mattermost versions 11.5.x <= 11.5.1, 10.11.x <= 10.11.13, 11.4.x <= 11.4.3 Fail to enforce slash command trigger-word uniqueness during command updates which…
• CVE-2026-4286 - CVSS 4.3 (medium), 2026-05-18: Mattermost versions 11.5.x <= 11.5.1, 10.11.x <= 10.11.13 fail to check if {{team_id}} was being changed when updating playbooks, allowing users with only…
• CVE-2026-4273 - CVSS 4.3 (medium), 2026-05-18: Mattermost versions 11.5.x <= 11.5.1, 10.11.x <= 10.11.13 fail to validate that the RefreshedToken differs from the original invite token during remote…
• CVE-2026-6341 - CVSS 4.3 (medium), 2026-05-18: Mattermost Plugins versions <=11.5 11.1.5 10.13.11 11.3.4.0 fail to have API-level checks on which groups the user can create issues or attach comments to…
• CVE-2026-3637 - CVSS 4.3 (medium), 2026-05-18: Mattermost versions 11.5.x <= 11.5.1, 10.11.x <= 10.11.13, 11.4.x <= 11.4.3 fail to check the create_post channel permission during post edit operations which…
• CVE-2026-6340 - CVSS 6.5 (medium), 2026-05-18: Mattermost versions 11.5.x <= 11.5.1, 10.11.x <= 10.11.13, 11.4.x <= 11.4.3 fail to validate 7zip archive structure before processing which allows an…
• CVE-2026-6334 - CVSS 3.8 (low), 2026-05-18: Mattermost versions 11.5.x <= 11.5.1, 10.11.x <= 10.11.13 fail to enforce client identity binding during the OAuth authorization code redemption flow which…
• CVE-2026-6342 - CVSS 4.3 (medium), 2026-05-18: Mattermost Plugins versions <=11.5 11.1.5 10.13.11 11.3.4.0 fail to appropriately check for valid namespaces which allows plugin users to create subscriptions…
• CVE-2026-2325 - CVSS 6.5 (medium), 2026-05-18: Mattermost versions 11.5.x <= 11.5.1, 10.11.x <= 10.11.13, 11.4.x <= 11.4.3 fail to limit the size of the request body on the start meeting API endpoint,…
• CVE-2026-28759 - CVSS 4.3 (medium), 2026-05-18: Mattermost versions 11.5.x <= 11.5.1, 10.11.x <= 10.11.13, 11.4.x <= 11.4.3 fail to validate that a remote cluster has access to a channel before processing…
• CVE-2026-3495 - CVSS 4.8 (medium), 2026-05-18: Mattermost versions 11.5.x <= 11.5.1, 10.11.x <= 10.11.13 fail to escape some variables that could contain malicious content during error page composition…
• CVE-2026-4053 - CVSS 4.3 (medium), 2026-05-15: Mattermost versions 11.5.x <= 11.5.1, 10.11.x <= 10.11.13 fail to enforce the PostEditTimeLimit on non-message post fields which allows an authenticated user…
• CVE-2026-4054 - CVSS 6.5 (medium), 2026-05-15: Mattermost versions 11.5.x <= 11.5.1, 10.11.x <= 10.11.13, 11.4.x <= 11.4.3 Fail to validate the response body of proxied images, which allows a remote…
• CVE-2026-3590 - CVSS 6.5 (medium), 2026-04-15: Mattermost versions 10.11.x <= 10.11.12, 11.5.x <= 11.5.0, 11.4.x <= 11.4.2, 11.3.x <= 11.3.2 fail to enforce atomic single-use consumption of guest magic…
• CVE-2026-28741 - CVSS 8.1 (high), 2026-04-15: Mattermost versions 10.11.x <= 10.11.12, 11.5.x <= 11.5.0, 11.4.x <= 11.4.2, 11.3.x <= 11.3.2 fail to validate CSRF tokens on an authentication endpoint which…
• CVE-2026-27769 - CVSS 2.7 (low), 2026-04-15: Mattermost versions 10.11.x <= 10.11.12 fail to validate whether users were correctly owned by the correct Connected Workspace which allows a malicious remote…
• CVE-2026-21388 - CVSS 6.5 (medium), 2026-04-09: Mattermost Plugins versions <=2.3.1 fail to limit the request body size on the {{/lifecycle}} webhook endpoint which allows an authenticated attacker to cause…
• CVE-2026-3114 - CVSS 6.5 (medium), 2026-03-26: Mattermost versions 11.4.x <= 11.4.0, 11.3.x <= 11.3.1, 11.2.x <= 11.2.3, 10.11.x <= 10.11.11 fail to validate decompressed archive entry sizes during file…
• CVE-2026-3113 - CVSS 5.5 (medium), 2026-03-26: Mattermost versions 11.4.x <= 11.4.0, 11.3.x <= 11.3.1, 11.2.x <= 11.2.3, 10.11.x <= 10.11.11 fail to set permissions on downloaded bulk export which allows…