Mattermost Server vulnerabilities
482 known vulnerabilities affecting mattermost/mattermost_server.
Total CVEs
482
CISA KEV
0
Public exploits
0
Exploited in wild
0
Severity breakdown
CRITICAL17HIGH82MEDIUM341LOW42
Vulnerabilities
Page 16 of 25
CVE-2017-18891P4MEDIUMCVSS 6.1fixed in 4.0.5≥ 4.1.0, < 4.1.1+1 more2020-06-19
CVE-2017-18891 [MEDIUM] CWE-601 CVE-2017-18891: An issue was discovered in Mattermost Server before 4.2.0, 4.1.1, and 4.0.5. It allows Phishing beca
An issue was discovered in Mattermost Server before 4.2.0, 4.1.1, and 4.0.5. It allows Phishing because an error page can have a link.
nvd
CVE-2016-11073P4MEDIUMCVSS 6.1fixed in 3.0.02020-06-19
CVE-2016-11073 [MEDIUM] CWE-79 CVE-2016-11073: An issue was discovered in Mattermost Server before 3.0.0. It allows XSS via a Legal or Support sett
An issue was discovered in Mattermost Server before 3.0.0. It allows XSS via a Legal or Support setting.
nvd
CVE-2016-11079P4MEDIUMCVSS 6.1fixed in 3.0.02020-06-19
CVE-2016-11079 [MEDIUM] CWE-79 CVE-2016-11079: An issue was discovered in Mattermost Server before 3.0.0. It allows XSS via a redirect URL.
An issue was discovered in Mattermost Server before 3.0.0. It allows XSS via a redirect URL.
nvd
CVE-2016-11071P4MEDIUMCVSS 6.1fixed in 3.1.02020-06-19
CVE-2016-11071 [MEDIUM] CWE-79 CVE-2016-11071: An issue was discovered in Mattermost Server before 3.1.0. It allows XSS because the noreferrer and
An issue was discovered in Mattermost Server before 3.1.0. It allows XSS because the noreferrer and noopener protection mechanisms were not in place.
nvd
CVE-2017-18892P4MEDIUMCVSS 6.1fixed in 4.0.5≥ 4.1.0, < 4.1.1+1 more2020-06-19
CVE-2017-18892 [MEDIUM] CWE-116 CVE-2017-18892: An issue was discovered in Mattermost Server before 4.2.0, 4.1.1, and 4.0.5. E-mail templates can ha
An issue was discovered in Mattermost Server before 4.2.0, 4.1.1, and 4.0.5. E-mail templates can have a field in which HTML content is not neutralized.
nvd
CVE-2017-18921P4MEDIUMCVSS 6.1fixed in 3.5.22020-06-19
CVE-2017-18921 [MEDIUM] CWE-79 CVE-2017-18921: An issue was discovered in Mattermost Server before 3.6.0 and 3.5.2. XSS can occur via a link on an
An issue was discovered in Mattermost Server before 3.6.0 and 3.5.2. XSS can occur via a link on an error page.
nvd
CVE-2017-18913P4MEDIUMCVSS 6.1fixed in 3.6.7≥ 3.7.0, < 3.7.5+1 more2020-06-19
CVE-2017-18913 [MEDIUM] CWE-79 CVE-2017-18913: An issue was discovered in Mattermost Server before 3.8.2, 3.7.5, and 3.6.7. XSS can occur via a lin
An issue was discovered in Mattermost Server before 3.8.2, 3.7.5, and 3.6.7. XSS can occur via a link on an error page.
nvd
CVE-2023-1421P4MEDIUMCVSS 6.1≥ 5.32.0, < 7.7.02023-03-15
CVE-2023-1421 [MEDIUM] CWE-79 CVE-2023-1421: A reflected cross-site scripting vulnerability in the OAuth flow completion endpoints in Mattermost
A reflected cross-site scripting vulnerability in the OAuth flow completion endpoints in Mattermost allows an attacker to send AJAX requests on behalf of the victim via sharing a crafted link with a malicious state parameter.
nvd
CVE-2021-37863P4MEDIUMCVSS 5.7≤ 6.02021-12-17
CVE-2021-37863 [MEDIUM] CWE-20 CVE-2021-37863: Mattermost 6.0 and earlier fails to sufficiently validate parameters during post creation, which all
Mattermost 6.0 and earlier fails to sufficiently validate parameters during post creation, which allows authenticated attackers to cause a client-side crash of the web application via a maliciously crafted post.
nvd
CVE-2017-18887P4MEDIUMCVSS 5.3fixed in 4.1.2≥ 4.2.0, < 4.2.1+1 more2020-06-19
CVE-2017-18887 [MEDIUM] CWE-200 CVE-2017-18887: An issue was discovered in Mattermost Server before 4.3.0, 4.2.1, and 4.1.2. It discloses the team c
An issue was discovered in Mattermost Server before 4.3.0, 4.2.1, and 4.1.2. It discloses the team creator's e-mail address to members.
nvd
CVE-2016-11075P4MEDIUMCVSS 5.3fixed in 3.0.02020-06-19
CVE-2016-11075 [MEDIUM] CWE-200 CVE-2016-11075: An issue was discovered in Mattermost Server before 3.0.0. It allows attackers to obtain sensitive i
An issue was discovered in Mattermost Server before 3.0.0. It allows attackers to obtain sensitive information about team URLs via an API.
nvd
CVE-2020-14457P4MEDIUMCVSS 5.3fixed in 5.20.02020-06-19
CVE-2020-14457 [MEDIUM] CVE-2020-14457: An issue was discovered in Mattermost Server before 5.20.0. Non-members can receive broadcasted team
An issue was discovered in Mattermost Server before 5.20.0. Non-members can receive broadcasted team details via the update_team WebSocket event, aka MMSA-2020-0012.
nvd
CVE-2024-54682P4MEDIUMCVSS 4.9≥ 9.5.0, < 9.5.13≥ 9.11.0, < 9.11.5+2 more2024-12-16
CVE-2024-54682 [MEDIUM] CWE-409 CVE-2024-54682: Mattermost versions 10.1.x <= 10.1.2, 10.0.x <= 10.0.2, 9.11.x <= 9.11.4, 9.5.x <= 9.5.12 fail to li
Mattermost versions 10.1.x <= 10.1.2, 10.0.x <= 10.0.2, 9.11.x <= 9.11.4, 9.5.x <= 9.5.12 fail to limit the file size for slack import file uploads which allows a user to cause a DoS via zip bomb by importing data in a team they are a team admin.
nvd
CVE-2024-36250P4MEDIUMCVSS 4.8≥ 9.5.0, < 9.5.11≥ 9.11.0, < 9.11.32024-11-09
CVE-2024-36250 [MEDIUM] CWE-303 CVE-2024-36250: Mattermost versions 9.11.x <= 9.11.2, and 9.5.x <= 9.5.10 fail to protect the mfa code against repla
Mattermost versions 9.11.x <= 9.11.2, and 9.5.x <= 9.5.10 fail to protect the mfa code against replay attacks, which allows an attacker to reuse the MFA code within ~30 seconds
nvd
CVE-2024-46872P4MEDIUMCVSS 4.6≥ 9.5.0, ≤ 9.5.9≥ 9.10.0, ≤ 9.10.2+1 more2024-10-29
CVE-2024-46872 [MEDIUM] CWE-352 CVE-2024-46872: Mattermost versions 9.10.x <= 9.10.2, 9.11.x <= 9.11.1, 9.5.x <= 9.5.9 fail to sanitize user inputs
Mattermost versions 9.10.x <= 9.10.2, 9.11.x <= 9.11.1, 9.5.x <= 9.5.9 fail to sanitize user inputs in the frontend that are used for redirection which allows for a one-click client-side path traversal that is leading to CSRF in Playbooks
nvd
CVE-2026-86349P4MEDIUMCVSS 4.3≥ 10.11.0, < 10.11.23≥ 11.7.0, < 11.7.9+2 more2026-09-14
CVE-2026-86349 [MEDIUM] CWE-407 CVE-2026-86349: Mattermost versions 11.9.x <= 11.9.0, 11.8.x <= 11.8.4, 11.7.x <= 11.7.8, 10.11.x <= 10.11.22 fail t
Mattermost versions 11.9.x <= 11.9.0, 11.8.x <= 11.8.4, 11.7.x <= 11.7.8, 10.11.x <= 10.11.22 fail to limit the nesting depth in the server-side Markdown parser which allows an authenticated attacker to cause a denial of service (CPU resource exhaustion) via a crafted post containing deeply nested blockquotes or list items.. Mattermost Advisory ID:
nvd
CVE-2026-16045P4MEDIUMCVSS 4.3≥ 10.11.0, < 10.11.22≥ 11.7.0, < 11.7.72026-08-17
CVE-2026-16045 [MEDIUM] CWE-863 CVE-2026-16045: Mattermost versions 11.7.x <= 11.7.6, 10.11.x <= 10.11.21 Mattermost failed to restrict OAuth deauth
Mattermost versions 11.7.x <= 11.7.6, 10.11.x <= 10.11.21 Mattermost failed to restrict OAuth deauthorization and personal access token management endpoints to direct user sessions, which allowed an OAuth app with a delegated user token to revoke the user's authorizations or tokens for other integrations via account-management endpoints.. Mattermost
nvd
CVE-2026-25783P4MEDIUMCVSS 4.3≥ 10.11.0, < 10.11.11≥ 11.2.0, < 11.2.3+1 more2026-03-16
CVE-2026-25783 [MEDIUM] CWE-1287 CVE-2026-25783: Mattermost versions 11.3.x <= 11.3.0, 11.2.x <= 11.2.2, 10.11.x <= 10.11.10 fail to properly validat
Mattermost versions 11.3.x <= 11.3.0, 11.2.x <= 11.2.2, 10.11.x <= 10.11.10 fail to properly validate User-Agent header tokens which allows an authenticated attacker to cause a request panic via a specially crafted User-Agent header. Mattermost Advisory ID: MMSA-2026-00586
nvd
CVE-2024-42000P4MEDIUMCVSS 4.3≥ 9.5.0, < 9.5.10≥ 9.10.0, < 9.10.3+2 more2024-11-09
CVE-2024-42000 [MEDIUM] CWE-863 CVE-2024-42000: Mattermost versions 9.10.x <= 9.10.2, 9.11.x <= 9.11.1, 9.5.x <= 9.5.9 and 10.0.x <= 10.0.0 fail to
Mattermost versions 9.10.x <= 9.10.2, 9.11.x <= 9.11.1, 9.5.x <= 9.5.9 and 10.0.x <= 10.0.0 fail to properly authorize the requests to /api/v4/channels which allows a User or System Manager, with "Read Groups" permission but with no access for channels to retrieve details about private channels that they were not a member of by sending a request to /
nvd
CVE-2025-41423P4MEDIUMCVSS 4.3≥ 9.11.0, < 9.11.11≥ 10.4.0, < 10.4.3+1 more2025-04-24
CVE-2025-41423 [MEDIUM] CWE-863 CVE-2025-41423: Mattermost versions 10.4.x <= 10.4.2, 10.5.x <= 10.5.0, 9.11.x <= 9.11.10 fail to properly validate
Mattermost versions 10.4.x <= 10.4.2, 10.5.x <= 10.5.0, 9.11.x <= 9.11.10 fail to properly validate permissions for the API endpoint /plugins/playbooks/api/v0/signal/keywords/ignore-thread, allowing any user or attacker to delete posts containing actions created by the Playbooks bot, even without channel access or appropriate permissions.
nvd