Mattermost Server vulnerabilities
479 known vulnerabilities affecting mattermost/mattermost_server.
Total CVEs
479
CISA KEV
0
Public exploits
0
Exploited in wild
0
Severity breakdown
CRITICAL17HIGH82MEDIUM338LOW42
Vulnerabilities
Page 13 of 24
CVE-2024-2445P4MEDIUMCVSS 6.1≥ 8.1.0, < 8.1.10≥ 9.2.0, < 9.2.6+2 more2024-03-15
CVE-2024-2445 [MEDIUM] CWE-74 CVE-2024-2445: Mattermost Jira plugin versions shipped with Mattermost versions 8.1.x before 8.1.10, 9.2.x before 9
Mattermost Jira plugin versions shipped with Mattermost versions 8.1.x before 8.1.10, 9.2.x before 9.2.6, 9.3.x before 9.3.2, and 9.4.x before 9.4.3 fail to escape user-controlled outputs when generating HTML pages, which allows an attacker to perform reflected cross-site scripting attacks against the users of the Mattermost server.
nvd
CVE-2017-18899P4MEDIUMCVSS 5.3fixed in 4.0.5≥ 4.1.0, < 4.1.1+1 more2020-06-19
CVE-2017-18899 [MEDIUM] CWE-770 CVE-2017-18899: An issue was discovered in Mattermost Server before 4.2.0, 4.1.1, and 4.0.5. It mishandles IP-based
An issue was discovered in Mattermost Server before 4.2.0, 4.1.1, and 4.0.5. It mishandles IP-based rate limiting.
nvd
CVE-2019-20876P4MEDIUMCVSS 5.4fixed in 4.10.8≥ 5.7.0, < 5.7.3+2 more2020-06-19
CVE-2019-20876 [MEDIUM] CVE-2019-20876: An issue was discovered in Mattermost Server before 5.9.0, 5.8.1, 5.7.3, and 4.10.8. Users can deact
An issue was discovered in Mattermost Server before 5.9.0, 5.8.1, 5.7.3, and 4.10.8. Users can deactivate themselves, bypassing a policy.
nvd
CVE-2021-37862P4MEDIUMCVSS 5.4≤ 6.02021-12-17
CVE-2021-37862 [MEDIUM] CWE-754 CVE-2021-37862: Mattermost 6.0 and earlier fails to sufficiently validate the email address during registration, whi
Mattermost 6.0 and earlier fails to sufficiently validate the email address during registration, which allows attackers to trick users into signing up using attacker-controlled email addresses via crafted invitation token.
nvd
CVE-2017-18895P4MEDIUMCVSS 5.3fixed in 4.0.5≥ 4.1.0, < 4.1.1+1 more2020-06-19
CVE-2017-18895 [MEDIUM] CWE-200 CVE-2017-18895: An issue was discovered in Mattermost Server before 4.2.0, 4.1.1, and 4.0.5. It allows attackers to
An issue was discovered in Mattermost Server before 4.2.0, 4.1.1, and 4.0.5. It allows attackers to obtain sensitive information (user statuses) via a REST API version 4 endpoint.
nvd
CVE-2019-20866P4MEDIUMCVSS 5.3fixed in 5.12.02020-06-19
CVE-2019-20866 [MEDIUM] CWE-444 CVE-2019-20866: An issue was discovered in Mattermost Server before 5.12.0. Use of a Proxy HTTP header, rather than
An issue was discovered in Mattermost Server before 5.12.0. Use of a Proxy HTTP header, rather than the source address in an IP packet header, for obtaining IP address information was mishandled.
nvd
CVE-2016-11076P4MEDIUMCVSS 5.3fixed in 3.0.02020-06-19
CVE-2016-11076 [MEDIUM] CWE-295 CVE-2016-11076: An issue was discovered in Mattermost Server before 3.0.0. It does not ensure that a cookie is used
An issue was discovered in Mattermost Server before 3.0.0. It does not ensure that a cookie is used over SSL.
nvd
CVE-2019-20884P4MEDIUMCVSS 5.3fixed in 5.8.02020-06-19
CVE-2019-20884 [MEDIUM] CVE-2019-20884: An issue was discovered in Mattermost Server before 5.8.0. It allows attackers to partially attach a
An issue was discovered in Mattermost Server before 5.8.0. It allows attackers to partially attach a file to more than one post.
nvd
CVE-2019-20869P4MEDIUMCVSS 5.3fixed in 4.10.9≥ 5.7.0, < 5.7.3+3 more2020-06-19
CVE-2019-20869 [MEDIUM] CVE-2019-20869: An issue was discovered in Mattermost Server before 5.10.0, 5.9.1, 5.8.2, and 4.10.9. A non-member c
An issue was discovered in Mattermost Server before 5.10.0, 5.9.1, 5.8.2, and 4.10.9. A non-member could change the Update/Patch Channel endpoint for a private channel.
nvd
CVE-2019-20882P4MEDIUMCVSS 5.3fixed in 5.8.02020-06-19
CVE-2019-20882 [MEDIUM] CWE-276 CVE-2019-20882: An issue was discovered in Mattermost Server before 5.8.0. It does not honor the domain requirement
An issue was discovered in Mattermost Server before 5.8.0. It does not honor the domain requirement when processing a join request for an open team.
nvd
CVE-2019-20889P4MEDIUMCVSS 5.3≥ 4.10.0, < 4.10.5≥ 5.5.0, < 5.5.2+2 more2020-06-19
CVE-2019-20889 [MEDIUM] CWE-276 CVE-2019-20889: An issue was discovered in Mattermost Server before 5.7, 5.6.3, 5.5.2, and 4.10.5. It mishandles per
An issue was discovered in Mattermost Server before 5.7, 5.6.3, 5.5.2, and 4.10.5. It mishandles permissions for user-access token creation.
nvd
CVE-2026-3113P4MEDIUMCVSS 5.5≥ 10.11.0, < 10.11.12≥ 11.2.0, < 11.2.4+2 more2026-03-26
CVE-2026-3113 [MEDIUM] CWE-732 CVE-2026-3113: Mattermost versions 11.4.x <= 11.4.0, 11.3.x <= 11.3.1, 11.2.x <= 11.2.3, 10.11.x <= 10.11.11 fail t
Mattermost versions 11.4.x <= 11.4.0, 11.3.x <= 11.3.1, 11.2.x <= 11.2.3, 10.11.x <= 10.11.11 fail to set permissions on downloaded bulk export which allows other local users on the server to be able to read contents of the bulk export.. Mattermost Advisory ID: MMSA-2026-00593
nvd
CVE-2023-6459P4MEDIUMCVSS 5.3fixed in 7.8.14≥ 8.0.0, < 8.1.52023-12-06
CVE-2023-6459 [MEDIUM] CWE-200 CVE-2023-6459: Mattermost is grouping calls in the /metrics endpoint by id and reports that id in the response. Sin
Mattermost is grouping calls in the /metrics endpoint by id and reports that id in the response. Since this id is the channelID, the public /metrics endpoint is revealing channelIDs.
nvd
CVE-2023-5331P4MEDIUMCVSS 5.3fixed in 7.8.11≥ 8.0.0, < 8.0.3+1 more2023-10-09
CVE-2023-5331 [MEDIUM] CWE-862 CVE-2023-5331: Mattermost fails to properly check the creator of an attached file when adding the file to a draft p
Mattermost fails to properly check the creator of an attached file when adding the file to a draft post, potentially exposing unauthorized file information.
nvd
CVE-2017-18875P4MEDIUMCVSS 4.9fixed in 4.1.2≥ 4.2.0, < 4.2.1+1 more2020-06-19
CVE-2017-18875 [MEDIUM] CWE-732 CVE-2017-18875: An issue was discovered in Mattermost Server before 4.3.0, 4.2.1, and 4.1.2 when local storage for f
An issue was discovered in Mattermost Server before 4.3.0, 4.2.1, and 4.1.2 when local storage for files is used. A System Admin can create arbitrary files.
nvd
CVE-2017-18918P4MEDIUMCVSS 4.9≥ 3.6.0, < 3.6.5≥ 3.7.0, < 3.7.32020-06-19
CVE-2017-18918 [MEDIUM] CWE-295 CVE-2017-18918: An issue was discovered in Mattermost Server before 3.7.3 and 3.6.5. A System Administrator can plac
An issue was discovered in Mattermost Server before 3.7.3 and 3.6.5. A System Administrator can place a SAML certificate at an arbitrary pathname.
nvd
CVE-2024-42497P4MEDIUMCVSS 4.9≥ 9.5.0, < 9.5.8≥ 9.8.0, < 9.8.3+2 more2024-08-22
CVE-2024-42497 [MEDIUM] CWE-284 CVE-2024-42497: Mattermost versions 9.9.x <= 9.9.1, 9.5.x <= 9.5.7, 9.10.x <= 9.10.0, 9.8.x <= 9.8.2 fail to properl
Mattermost versions 9.9.x <= 9.9.1, 9.5.x <= 9.5.7, 9.10.x <= 9.10.0, 9.8.x <= 9.8.2 fail to properly enforce permissions which allows a user with systems manager role with read-only access to teams to perform write operations on teams.
nvd
CVE-2025-32093P4MEDIUMCVSS 4.9≥ 9.11.0, < 9.11.10≥ 10.4.0, < 10.4.4+1 more2025-04-14
CVE-2025-32093 [MEDIUM] CWE-863 CVE-2025-32093: Mattermost versions 10.5.x <= 10.5.1, 10.4.x <= 10.4.3, 9.11.x <= 9.11.9 fail to restrict certain op
Mattermost versions 10.5.x <= 10.5.1, 10.4.x <= 10.4.3, 9.11.x <= 9.11.9 fail to restrict certain operations on system admins to only other system admins, which allows delegated granular administration users with the "Edit Other Users" permission to perform unauthorized modifications to system administrators via improper permission validation.
nvd
CVE-2026-27659P4MEDIUMCVSS 4.6≥ 10.11.0, < 10.11.11≥ 11.2.0, < 11.2.3+2 more2026-03-25
CVE-2026-27659 [MEDIUM] CWE-352 CVE-2026-27659: Mattermost versions 11.2.x <= 11.2.2, 10.11.x <= 10.11.10, 11.4.x <= 11.4.0, 11.3.x <= 11.3.1 fail t
Mattermost versions 11.2.x <= 11.2.2, 10.11.x <= 10.11.10, 11.4.x <= 11.4.0, 11.3.x <= 11.3.1 fail to properly validate CSRF tokens in the /api/v4/access_control_policies/{policy_id}/activate endpoint, which allows an attacker to trick an admin into changing access control policy active status via a crafted request.. Mattermost Advisory ID: MMSA-202
nvd
CVE-2026-11993P4MEDIUMCVSS 4.3≥ 10.11.0, < 10.11.23≥ 11.7.0, < 11.7.8+2 more2026-09-14
CVE-2026-11993 [MEDIUM] CWE-770 CVE-2026-11993: Mattermost versions 11.9.x <= 11.9.0, 11.8.x <= 11.8.4, 11.7.x <= 11.7.7, 10.11.x <= 10.11.22 fail t
Mattermost versions 11.9.x <= 11.9.0, 11.8.x <= 11.8.4, 11.7.x <= 11.7.7, 10.11.x <= 10.11.22 fail to properly enforce the limit of concurrent files being processed and handled failed files, which allows a user with permission to upload files to spawn more goroutines than intended and block the indexing of other files via uploading heavy files const
nvd