CVE Program partner

Mattermost

Mattermost, Inc.

API
CVEs, 365 days199508 all time, 0 rejected
Quality100%median 99%
CVSS by the CNA100%share of records
CWE100%share of records
Affected versions100%not n/a or unspecified
CVSS added by CISA0%lower is better
OrganisationMattermost, Inc.
RoleCNA
TypeVendor, Researcher
Reports tomitre
ScopeAll Mattermost issues, and vulnerabilities discovered by Mattermost that are not in another CNA’s scope.
Advisorieshttps://mattermost.com/security-updates/

Latest CVEs · RSS

  • CVE-2026-18799 2026-10-16 · CVSS 4.3
    Mattermost versions 11.10.x <= 11.10.0, 11.7.x <= 11.7.9, 11.9.x <= 11.9.1, 11.8.x <= 11.8.5 fail to restrict Slack import account binding to system administrat
  • CVE-2026-16251 2026-10-16 · CVSS 6.5
    Mattermost versions 11.10.x <= 11.10.0, 11.7.x <= 11.7.9, 11.9.x <= 11.9.1, 11.8.x <= 11.8.5 fail to limit the size of remote image responses buffered in memory
  • CVE-2026-18256 2026-10-16 · CVSS 4.3
    Mattermost versions 11.10.x <= 11.10.0, 11.7.x <= 11.7.9, 11.9.x <= 11.9.1, 11.8.x <= 11.8.5 fail to properly restrict private teams from public team search res
  • CVE-2026-18223 2026-10-16 · CVSS 5.0
    Mattermost versions 11.10.x <= 11.10.0, 11.7.x <= 11.7.9, 11.9.x <= 11.9.1, 11.8.x <= 11.8.5 fail to validate the invited recipient's email address when redeemi
  • CVE-2026-19076 2026-10-16 · CVSS 4.4
    Mattermost versions 11.10.x <= 11.10.0, 11.7.x <= 11.7.9, 11.9.x <= 11.9.1, 11.8.x <= 11.8.5 fail to reject OAuth application sessions in the account type switc
  • CVE-2026-18560 2026-10-16 · CVSS 4.3
    Mattermost versions 11.10.x <= 11.10.0, 11.7.x <= 11.7.9, 11.9.x <= 11.9.1, 11.8.x <= 11.8.5 fail to validate user’s permissions before other validations which
  • CVE-2026-16453 2026-10-16 · CVSS 7.1
    Mattermost versions 11.10.x <= 11.10.0, 11.7.x <= 11.7.9, 11.9.x <= 11.9.1, 11.8.x <= 11.8.5 fail to verify the integrity of the SAML RelayState POST parameter
  • CVE-2026-19600 2026-10-16 · CVSS 4.5
    Mattermost versions 11.9.x <= 11.9.1, 11.8.x <= 11.8.5, 11.7.x <= 11.7.10, 11.10.x <= 11.10.1 fail to sanitize authentication tokens before writing them to serv
  • CVE-2026-19621 2026-10-16 · CVSS 6.5
    Mattermost versions 11.10.x <= 11.10.0, 11.7.x <= 11.7.9, 11.9.x <= 11.9.1, 11.8.x <= 11.8.5 fail to strip action integration secrets from post payloads before
  • CVE-2026-19603 2026-10-16 · CVSS 4.3
    Mattermost versions 11.9.x <= 11.9.1, 11.8.x <= 11.8.5, 11.7.x <= 11.7.10, 11.10.x <= 11.10.1 fail to sanitize the active channel field returned by the user sta
  • CVE-2026-18795 2026-10-16 · CVSS 6.4
    Mattermost versions 11.10.x <= 11.10.0, 11.7.x <= 11.7.9, 11.9.x <= 11.9.1, 11.8.x <= 11.8.5 fail to enforce DM/GM check on server side which allows an authenti
  • CVE-2026-19867 2026-10-16 · CVSS 4.3
    Mattermost versions 11.10.x <= 11.10.0, 11.9.x <= 11.9.1, 11.8.x <= 11.8.5, 11.7.x <= 11.7.10 fail to cap the number and size of mention keys stored in a user's
  • CVE-2026-19601 2026-10-16 · CVSS 4.9
    Mattermost versions 11.9.x <= 11.9.1, 11.8.x <= 11.8.5, 11.7.x <= 11.7.10, 11.10.x <= 11.10.1 fail to invalidate the stored AD/LDAP bind password when other con
  • CVE-2026-18551 2026-10-16 · CVSS 6.5
    Mattermost versions 11.10.x <= 11.10.0, 11.7.x <= 11.7.9, 11.9.x <= 11.9.1, 11.8.x <= 11.8.5 fail to validate the combination of guest and admin scheme roles wh
  • CVE-2026-19541 2026-10-16 · CVSS 6.5
    Mattermost versions 11.9.x <= 11.9.1, 11.8.x <= 11.8.5, 11.7.x <= 11.7.10, 11.10.x <= 11.10.1 fail to require re-entry of the stored client secret when validati
  • CVE-2026-96260 2026-09-22 · CVSS 6.5
    Mattermost versions 11.9.x <= 11.9.1, 11.8.x <= 11.8.5, 11.7.x <= 11.7.10, 11.10.x <= 11.10.1 fail to enforce a request body size limit during CSRF validation o
  • CVE-2026-96259 2026-09-22 · CVSS 5.5
    Mattermost versions 11.9.x <= 11.9.1, 11.8.x <= 11.8.5, 11.7.x <= 11.7.10, 11.10.x <= 11.10.1 fail to apply the internal-connection filter to OAuth endpoint req
  • CVE-2026-95666 2026-09-22 · CVSS 4.3
    Mattermost versions 11.9.x <= 11.9.1, 11.8.x <= 11.8.5, 11.7.x <= 11.7.10, 11.10.x <= 11.10.1 fail to limit the length of the post ID array accepted by the bulk
  • CVE-2026-12284 2026-09-17 · CVSS 3.8
    Mattermost Desktop App versions <=6.2 6.2.2.0 fails to validate the IPC sender in the leaveCall handler which allows a malicious or compromised Mattermost serve
  • CVE-2026-75588 2026-09-17 · CVSS 2.6
    Mattermost Desktop App versions <=6.2 6.2.2.0 fail to validate the URL scheme when checking whether a target URL is internal to the connected server, which allo
  • CVE-2026-75025 2026-09-16 · CVSS 4.7
    Mattermost Desktop App versions <=6.2 6.2.2.0 Fixed an issue where Mattermost Desktop did not sufficiently restrict server-rendered content from accessing local
  • CVE-2026-91181 2026-09-14 · CVSS 6.5
    Mattermost versions 11.9.x <= 11.9.0, 11.8.x <= 11.8.4, 11.7.x <= 11.7.7, 10.11.x <= 10.11.22 Fail to sanitize Team objects returned by the data retention teams
  • CVE-2026-12985 2026-09-14 · CVSS 6.8
    Mattermost versions 11.9.x <= 11.9.0, 11.8.x <= 11.8.4, 11.7.x <= 11.7.7 Mattermost failed to validate Dynamic Client Registration redirect URIs by URL componen
  • CVE-2026-82920 2026-09-14 · CVSS 5.5
    Mattermost versions 11.9.x <= 11.9.0, 11.8.x <= 11.8.4, 11.7.x <= 11.7.7 fail to enforce authorization boundaries on the access control policy update endpoint w
  • CVE-2026-86348 2026-09-14 · CVSS 4.3
    Mattermost versions <=11.9 11.0.9 11.4.8 11.7.7 10.22.11.0 fail to recover from handler panics, which allows an authenticated user to crash the plugin via a pos

All CVE Program partners