Mattermost Server vulnerabilities
479 known vulnerabilities affecting mattermost/mattermost_server.
Total CVEs
479
CISA KEV
0
Public exploits
0
Exploited in wild
0
Severity breakdown
CRITICAL17HIGH82MEDIUM338LOW42
Vulnerabilities
Page 14 of 24
CVE-2026-10600P4MEDIUMCVSS 4.3≥ 10.11.0, < 10.11.21≥ 11.6.0, < 11.6.6+2 more2026-07-27
CVE-2026-10600 [MEDIUM] CWE-770 CVE-2026-10600: Mattermost versions 11.8.x <= 11.8.0, 11.7.x <= 11.7.3, 11.6.x <= 11.6.5, 10.11.x <= 10.11.20 fail t
Mattermost versions 11.8.x <= 11.8.0, 11.7.x <= 11.7.3, 11.6.x <= 11.6.5, 10.11.x <= 10.11.20 fail to bound the time and resource consumption of server-side document content extraction which allows an authenticated user with file-upload permission to degrade file uploads for all users on the server via repeatedly uploading small documents that are c
nvd
CVE-2026-22892P4MEDIUMCVSS 4.3≥ 10.11.0, < 10.11.10≥ 11.0.0, < 11.1.3+1 more2026-02-13
CVE-2026-22892 [MEDIUM] CWE-863 CVE-2026-22892: Mattermost versions 11.1.x <= 11.1.2, 10.11.x <= 10.11.9, 11.2.x <= 11.2.1 fail to validate user per
Mattermost versions 11.1.x <= 11.1.2, 10.11.x <= 10.11.9, 11.2.x <= 11.2.1 fail to validate user permissions when creating Jira issues from Mattermost posts, which allows an authenticated attacker with access to the Jira plugin to read post content and attachments from channels they do not have access to via the /create-issue API endpoint by providi
nvd
CVE-2024-36241P4MEDIUMCVSS 4.3≥ 8.1.0, < 8.1.13≥ 9.5.0, < 9.5.4+1 more2024-05-26
CVE-2024-36241 [MEDIUM] CWE-284 CVE-2024-36241: Mattermost versions 9.5.x <= 9.5.3, 9.6.x <= 9.6.1 and 8.1.x <= 8.1.12 fail to enforce proper access
Mattermost versions 9.5.x <= 9.5.3, 9.6.x <= 9.6.1 and 8.1.x <= 8.1.12 fail to enforce proper access controls which allows user to view arbitrary post contents via the /playbook add slash command
nvd
CVE-2026-14259P4MEDIUMCVSS 4.3≥ 10.11.0, < 10.11.23≥ 11.7.0, < 11.7.8+2 more2026-09-14
CVE-2026-14259 [MEDIUM] CWE-862 CVE-2026-14259: Mattermost versions 11.9.x <= 11.9.0, 11.8.x <= 11.8.4, 11.7.x <= 11.7.7, 10.11.x <= 10.11.22 fail t
Mattermost versions 11.9.x <= 11.9.0, 11.8.x <= 11.8.4, 11.7.x <= 11.7.7, 10.11.x <= 10.11.22 fail to enforce board creation permissions when importing archive files which allows an authenticated non-guest team member to create Open or Private boards despite administrator restrictions via importing a crafted .boardarchive file. Mattermost Advisory I
nvd
CVE-2026-4265P4MEDIUMCVSS 4.3≥ 10.11.0, < 10.11.11≥ 11.2.0, < 11.2.3+1 more2026-03-16
CVE-2026-4265 [MEDIUM] CWE-863 CVE-2026-4265: Mattermost versions 11.3.x <= 11.3.0, 11.2.x <= 11.2.2, 10.11.x <= 10.11.10 fail to validate team-sp
Mattermost versions 11.3.x <= 11.3.0, 11.2.x <= 11.2.2, 10.11.x <= 10.11.10 fail to validate team-specific upload_file permissions which allows a guest user to post files in channels where they lack upload_file permission via uploading files in a team where they have permission and reusing the file metadata in a POST request to a different team. Matte
nvd
CVE-2026-3637P4MEDIUMCVSS 4.3≥ 10.11.0, < 10.11.14≥ 11.4.0, < 11.4.4+1 more2026-05-18
CVE-2026-3637 [MEDIUM] CWE-862 CVE-2026-3637: Mattermost versions 11.5.x <= 11.5.1, 10.11.x <= 10.11.13, 11.4.x <= 11.4.3 fail to check the create
Mattermost versions 11.5.x <= 11.5.1, 10.11.x <= 10.11.13, 11.4.x <= 11.4.3 fail to check the create_post channel permission during post edit operations which allows an authenticated attacker with revoked posting privileges to modify their existing posts via direct API requests to the post update and patch endpoints.. Mattermost Advisory ID: MMSA-2026
nvd
CVE-2017-18897P4MEDIUMCVSS 6.1fixed in 4.0.5≥ 4.1.0, < 4.1.1+1 more2020-06-19
CVE-2017-18897 [MEDIUM] CWE-601 CVE-2017-18897: An issue was discovered in Mattermost Server before 4.2.0, 4.1.1, and 4.0.5, when used as an OAuth 2
An issue was discovered in Mattermost Server before 4.2.0, 4.1.1, and 4.0.5, when used as an OAuth 2.0 service provider. It mishandles a deny action for a redirection.
nvd
CVE-2017-18877P4MEDIUMCVSS 6.1≥ 4.1.0, < 4.1.2≥ 4.2.0, < 4.2.1+1 more2020-06-19
CVE-2017-18877 [MEDIUM] CWE-79 CVE-2017-18877: An issue was discovered in Mattermost Server before 4.3.0, 4.2.1, and 4.1.2. XSS attacks could occur
An issue was discovered in Mattermost Server before 4.3.0, 4.2.1, and 4.1.2. XSS attacks could occur against an OAuth 2.0 allow/deny page.
nvd
CVE-2016-11083P4MEDIUMCVSS 6.1fixed in 2.2.02020-06-19
CVE-2016-11083 [MEDIUM] CWE-79 CVE-2016-11083: An issue was discovered in Mattermost Server before 2.2.0. It allows XSS because it configures files
An issue was discovered in Mattermost Server before 2.2.0. It allows XSS because it configures files to be opened in a browser window.
nvd
CVE-2017-18904P4MEDIUMCVSS 6.1fixed in 3.9.2≥ 3.10.0, < 3.10.22020-06-19
CVE-2017-18904 [MEDIUM] CWE-79 CVE-2017-18904: An issue was discovered in Mattermost Server before 4.0.0, 3.10.2, and 3.9.2. It allows XSS via an u
An issue was discovered in Mattermost Server before 4.0.0, 3.10.2, and 3.9.2. It allows XSS via an uploaded file.
nvd
CVE-2017-18907P4MEDIUMCVSS 6.1fixed in 3.9.2≥ 3.10.0, < 3.10.22020-06-19
CVE-2017-18907 [MEDIUM] CWE-79 CVE-2017-18907: An issue was discovered in Mattermost Server before 4.0.0, 3.10.2, and 3.9.2. XSS could occur via a
An issue was discovered in Mattermost Server before 4.0.0, 3.10.2, and 3.9.2. XSS could occur via a channel header.
nvd
CVE-2016-11082P4MEDIUMCVSS 6.1fixed in 2.2.02020-06-19
CVE-2016-11082 [MEDIUM] CWE-79 CVE-2016-11082: An issue was discovered in Mattermost Server before 2.2.0. It allows XSS via a crafted link.
An issue was discovered in Mattermost Server before 2.2.0. It allows XSS via a crafted link.
nvd
CVE-2017-18898P4MEDIUMCVSS 5.3fixed in 4.0.5≥ 4.1.0, < 4.1.1+1 more2020-06-19
CVE-2017-18898 [MEDIUM] CWE-404 CVE-2017-18898: An issue was discovered in Mattermost Server before 4.2.0, 4.1.1, and 4.0.5. It allows crafted posts
An issue was discovered in Mattermost Server before 4.2.0, 4.1.1, and 4.0.5. It allows crafted posts that potentially cause a web browser to hang.
nvd
CVE-2016-11067P4MEDIUMCVSS 5.3fixed in 3.2.02020-06-19
CVE-2016-11067 [MEDIUM] CWE-20 CVE-2016-11067: An issue was discovered in Mattermost Server before 3.2.0. It allowed crafted posts that could cause
An issue was discovered in Mattermost Server before 3.2.0. It allowed crafted posts that could cause a web browser to hang.
nvd
CVE-2017-18901P4MEDIUMCVSS 5.3fixed in 3.10.3≥ 4.0.0, < 4.0.42020-06-19
CVE-2017-18901 [MEDIUM] CWE-200 CVE-2017-18901: An issue was discovered in Mattermost Server before 4.1.0, 4.0.4, and 3.10.3. It allows attackers to
An issue was discovered in Mattermost Server before 4.1.0, 4.0.4, and 3.10.3. It allows attackers to discover a team invite ID by requesting a JSON document.
nvd
CVE-2019-20877P4MEDIUMCVSS 5.3fixed in 4.10.8≥ 5.7.0, < 5.7.3+2 more2020-06-19
CVE-2019-20877 [MEDIUM] CVE-2019-20877: An issue was discovered in Mattermost Server before 5.9.0, 5.8.1, 5.7.3, and 4.10.8. It allows attac
An issue was discovered in Mattermost Server before 5.9.0, 5.8.1, 5.7.3, and 4.10.8. It allows attackers to obtain sensitive information about whether someone has 2FA enabled.
nvd
CVE-2016-11062P4MEDIUMCVSS 5.3fixed in 3.5.12020-06-19
CVE-2016-11062 [MEDIUM] CWE-732 CVE-2016-11062: An issue was discovered in Mattermost Server before 3.5.1. E-mail address verification can be bypass
An issue was discovered in Mattermost Server before 3.5.1. E-mail address verification can be bypassed.
nvd
CVE-2016-11070P4MEDIUMCVSS 5.4fixed in 3.1.02020-06-19
CVE-2016-11070 [MEDIUM] CWE-79 CVE-2016-11070: An issue was discovered in Mattermost Server before 3.1.0. It allows XSS via theme color-code values
An issue was discovered in Mattermost Server before 3.1.0. It allows XSS via theme color-code values.
nvd
CVE-2019-20847P4MEDIUMCVSS 5.3fixed in 5.18.02020-06-19
CVE-2019-20847 [MEDIUM] CVE-2019-20847: An issue was discovered in Mattermost Server before 5.18.0. An attacker can send a user_typing WebSo
An issue was discovered in Mattermost Server before 5.18.0. An attacker can send a user_typing WebSocket event to any channel.
nvd
CVE-2017-18905P4MEDIUMCVSS 5.3fixed in 3.9.2≥ 3.10.0, < 3.10.22020-06-19
CVE-2017-18905 [MEDIUM] CWE-613 CVE-2017-18905: An issue was discovered in Mattermost Server before 4.0.0, 3.10.2, and 3.9.2, when used as an OAuth
An issue was discovered in Mattermost Server before 4.0.0, 3.10.2, and 3.9.2, when used as an OAuth 2.0 service provider, Session invalidation was mishandled.
nvd