Mattermost - vulnerabilities (CVEs)

671 CVEs in 25 products, 23 in the last 30 days, newest from 2026-10-28.

Products

• Mattermost Server - 489 CVEs
• Mattermost - 480 CVEs
• Mattermost Desktop - 34 CVEs
• Mattermost Mobile - 21 CVEs
• Confluence - 14 CVEs
• Mattermost Confluence Plugin - 14 CVEs
• Focalboard - 2 CVEs
• Legal Hold - 2 CVEs
• Mattermost App Framework - 2 CVEs
• Mattermost Boards - 2 CVEs
• Mattermost Playbooks - 2 CVEs
• Ms Teams - 2 CVEs
• Playbooks - 2 CVEs
• Zoom - 2 CVEs
• Channel Export - 1 CVEs
• Github.commattermostmattermostserverpublic - 1 CVEs
• Google Drive - 1 CVEs
• Mattermost Github Plugin - 1 CVEs
• Mattermost Google Drive Plugin - 1 CVEs
• Mattermost Ios App - 1 CVEs
• Mattermost Packages - 1 CVEs
• Mattermost Plugins - 1 CVEs
• Playbooks Plugin - 1 CVEs
• Mattermost Channel Export - 0 CVEs
• Server - 0 CVEs

Newest CVEs of Mattermost

• CVE-2026-93851 - CVSS 8 (high), 2026-10-28: Mattermost versions 11.9.x <= 11.9.1, 11.8.x <= 11.8.5, 11.7.x <= 11.7.10 fail to validate the target post ID in the Agents plugin's mention reminder…
• CVE-2026-93846 - CVSS 3.8 (low), 2026-10-26: Mattermost versions 11.7.x <= 11.7.10 fail to restrict which built-in roles can be assigned to a team member via the API, which allows a team admin to grant a…
• CVE-2026-93848 - CVSS 2.7 (low), 2026-10-26: Mattermost versions 11.7.x <= 11.7.10 fail to apply outbound internal-connection filtering to the OpenID discovery endpoint request which allows a System…
• CVE-2026-93850 - CVSS 6.5 (medium), 2026-10-26: Mattermost versions 11.9.x <= 11.9.1, 11.8.x <= 11.8.5, 11.7.x <= 11.7.10, 11.10.x <= 11.10.1 fail to bind the volume of text extracted from an uploaded PDF…
• CVE-2026-93849 - CVSS 6.5 (medium), 2026-10-26: Mattermost versions 11.9.x <= 11.9.1, 11.8.x <= 11.8.5, 11.7.x <= 11.7.10, 11.10.x <= 11.10.1 Mattermost fail to apply allocation limits to the byte-string…
• CVE-2026-93847 - CVSS 3.5 (low), 2026-10-26: Mattermost versions 11.7.x <= 11.7.10 fail to validate reserved system post types on the scheduled post creation and publication paths which allows an…
• CVE-2026-116516 - CVSS 6.5 (medium), 2026-10-26: Mattermost versions <=11.9 11.1.9 11.5.8 11.10.7.0 fail to validate Zoom chat line length before slicing which allows an authenticated attacker to crash the…
• CVE-2026-13411 - CVSS 4.3 (medium), 2026-10-22: Mattermost versions 11.7.x <= 11.7.11 fail to validate null elements when decoding playbook import conditions which allows an authenticated attacker to crash…
• CVE-2026-18799 - CVSS 4.3 (medium), 2026-10-16: Mattermost versions 11.10.x <= 11.10.0, 11.7.x <= 11.7.9, 11.9.x <= 11.9.1, 11.8.x <= 11.8.5 fail to restrict Slack import account binding to system…
• CVE-2026-16251 - CVSS 6.5 (medium), 2026-10-16: Mattermost versions 11.10.x <= 11.10.0, 11.7.x <= 11.7.9, 11.9.x <= 11.9.1, 11.8.x <= 11.8.5 fail to limit the size of remote image responses buffered in…
• CVE-2026-18256 - CVSS 4.3 (medium), 2026-10-16: Mattermost versions 11.10.x <= 11.10.0, 11.7.x <= 11.7.9, 11.9.x <= 11.9.1, 11.8.x <= 11.8.5 fail to properly restrict private teams from public team search…
• CVE-2026-18223 - CVSS 5 (medium), 2026-10-16: Mattermost versions 11.10.x <= 11.10.0, 11.7.x <= 11.7.9, 11.9.x <= 11.9.1, 11.8.x <= 11.8.5 fail to validate the invited recipient's email address when…
• CVE-2026-19076 - CVSS 4.9 (medium), 2026-10-16: Mattermost versions 11.10.x <= 11.10.0, 11.7.x <= 11.7.9, 11.9.x <= 11.9.1, 11.8.x <= 11.8.5 fail to reject OAuth application sessions in the account type…
• CVE-2026-18560 - CVSS 4.3 (medium), 2026-10-16: Mattermost versions 11.10.x <= 11.10.0, 11.7.x <= 11.7.9, 11.9.x <= 11.9.1, 11.8.x <= 11.8.5 fail to validate user’s permissions before other validations…
• CVE-2026-16453 - CVSS 7.1 (high), 2026-10-16: Mattermost versions 11.10.x <= 11.10.0, 11.7.x <= 11.7.9, 11.9.x <= 11.9.1, 11.8.x <= 11.8.5 fail to verify the integrity of the SAML RelayState POST…
• CVE-2026-19600 - CVSS 4.9 (medium), 2026-10-16: Mattermost versions 11.9.x <= 11.9.1, 11.8.x <= 11.8.5, 11.7.x <= 11.7.10, 11.10.x <= 11.10.1 fail to sanitize authentication tokens before writing them to…
• CVE-2026-19621 - CVSS 6.5 (medium), 2026-10-16: Mattermost versions 11.10.x <= 11.10.0, 11.7.x <= 11.7.9, 11.9.x <= 11.9.1, 11.8.x <= 11.8.5 fail to strip action integration secrets from post payloads…
• CVE-2026-19603 - CVSS 4.3 (medium), 2026-10-16: Mattermost versions 11.9.x <= 11.9.1, 11.8.x <= 11.8.5, 11.7.x <= 11.7.10, 11.10.x <= 11.10.1 fail to sanitize the active channel field returned by the user…
• CVE-2026-18795 - CVSS 6.4 (medium), 2026-10-16: Mattermost versions 11.10.x <= 11.10.0, 11.7.x <= 11.7.9, 11.9.x <= 11.9.1, 11.8.x <= 11.8.5 fail to enforce DM/GM check on server side which allows an…
• CVE-2026-19867 - CVSS 4.3 (medium), 2026-10-16: Mattermost versions 11.10.x <= 11.10.0, 11.9.x <= 11.9.1, 11.8.x <= 11.8.5, 11.7.x <= 11.7.10 fail to cap the number and size of mention keys stored in a…
• CVE-2026-19601 - CVSS 4.9 (medium), 2026-10-16: Mattermost versions 11.9.x <= 11.9.1, 11.8.x <= 11.8.5, 11.7.x <= 11.7.10, 11.10.x <= 11.10.1 fail to invalidate the stored AD/LDAP bind password when other…
• CVE-2026-18551 - CVSS 6.5 (medium), 2026-10-16: Mattermost versions 11.10.x <= 11.10.0, 11.7.x <= 11.7.9, 11.9.x <= 11.9.1, 11.8.x <= 11.8.5 fail to validate the combination of guest and admin scheme roles…
• CVE-2026-19541 - CVSS 6.5 (medium), 2026-10-16: Mattermost versions 11.9.x <= 11.9.1, 11.8.x <= 11.8.5, 11.7.x <= 11.7.10, 11.10.x <= 11.10.1 fail to require re-entry of the stored client secret when…
• CVE-2026-96260 - CVSS 6.5 (medium), 2026-09-22: Mattermost versions 11.9.x <= 11.9.1, 11.8.x <= 11.8.5, 11.7.x <= 11.7.10, 11.10.x <= 11.10.1 fail to enforce a request body size limit during CSRF validation…
• CVE-2026-96259 - CVSS 5.5 (medium), 2026-09-22: Mattermost versions 11.9.x <= 11.9.1, 11.8.x <= 11.8.5, 11.7.x <= 11.7.10, 11.10.x <= 11.10.1 fail to apply the internal-connection filter to OAuth endpoint…
• CVE-2026-95666 - CVSS 4.3 (medium), 2026-09-22: Mattermost versions 11.9.x <= 11.9.1, 11.8.x <= 11.8.5, 11.7.x <= 11.7.10, 11.10.x <= 11.10.1 fail to limit the length of the post ID array accepted by the…
• CVE-2026-12284 - CVSS 3.8 (low), 2026-09-17: Mattermost Desktop App versions <=6.2 6.2.2.0 fails to validate the IPC sender in the leaveCall handler which allows a malicious or compromised Mattermost…
• CVE-2026-75588 - CVSS 2.6 (low), 2026-09-17: Mattermost Desktop App versions <=6.2 6.2.2.0 fail to validate the URL scheme when checking whether a target URL is internal to the connected server, which…
• CVE-2026-75025 - CVSS 4.7 (medium), 2026-09-16: Mattermost Desktop App versions <=6.2 6.2.2.0 Fixed an issue where Mattermost Desktop did not sufficiently restrict server-rendered content from accessing…
• CVE-2026-91181 - CVSS 6.5 (medium), 2026-09-14: Mattermost versions 11.9.x <= 11.9.0, 11.8.x <= 11.8.4, 11.7.x <= 11.7.7, 10.11.x <= 10.11.22 Fail to sanitize Team objects returned by the data retention…