Mattermost Server vulnerabilities
482 known vulnerabilities affecting mattermost/mattermost_server.
Total CVEs
482
CISA KEV
0
Public exploits
0
Exploited in wild
0
Severity breakdown
CRITICAL17HIGH82MEDIUM341LOW42
Vulnerabilities
Page 18 of 25
CVE-2022-1385P4MEDIUMCVSS 4.6fixed in 6.5.02022-04-19
CVE-2022-1385 [MEDIUM] CWE-664 CVE-2022-1385: Mattermost 6.4.x and earlier fails to properly invalidate pending email invitations when the action
Mattermost 6.4.x and earlier fails to properly invalidate pending email invitations when the action is performed from the system console, which allows accidentally invited users to join the workspace and access information from the public teams and channels.
nvd
CVE-2026-3495P4MEDIUMCVSS 4.8≥ 10.11.0, < 10.11.14≥ 11.5.0, < 11.5.22026-05-18
CVE-2026-3495 [MEDIUM] CWE-79 CVE-2026-3495: Mattermost versions 11.5.x <= 11.5.1, 10.11.x <= 10.11.13 fail to escape some variables that could c
Mattermost versions 11.5.x <= 11.5.1, 10.11.x <= 10.11.13 fail to escape some variables that could contain malicious content during error page composition which allows an attacker with access to edit some site configuration to execute some malicious code via injecting some JS as part of those values.. Mattermost Advisory ID: MMSA-2026-00622
nvd
CVE-2022-1332P4MEDIUMCVSS 4.3≥ 5.37.0, < 5.37.9≥ 6.2.0, < 6.2.5+2 more2022-04-13
CVE-2022-1332 [MEDIUM] CWE-200 CVE-2022-1332: One of the API in Mattermost version 6.4.1 and earlier fails to properly protect the permissions, wh
One of the API in Mattermost version 6.4.1 and earlier fails to properly protect the permissions, which allows the authenticated members with restricted custom admin role to bypass the restrictions and view the server logs and server config.json file contents.
nvd
CVE-2024-32046P4MEDIUMCVSS 4.3≥ 8.1.0, < 8.1.12≥ 9.4.0, < 9.4.5+2 more2024-04-26
CVE-2024-32046 [MEDIUM] CWE-200 CVE-2024-32046: Mattermost versions 9.6.x <= 9.6.0, 9.5.x <= 9.5.2, 9.4.x <= 9.4.4 and 8.1.x <= 8.1.11 fail to remov
Mattermost versions 9.6.x <= 9.6.0, 9.5.x <= 9.5.2, 9.4.x <= 9.4.4 and 8.1.x <= 8.1.11 fail to remove detailed error messages in API requests even if the developer mode is off which allows an attacker to get information about the server such as the full path were files are stored
nvd
CVE-2026-86348P4MEDIUMCVSS 4.3≥ 10.11.0, < 10.11.23≥ 11.7.0, < 11.7.8+2 more2026-09-14
CVE-2026-86348 [MEDIUM] CWE-704 CVE-2026-86348: Mattermost versions <=11.9 11.0.9 11.4.8 11.7.7 10.22.11.0 fail to recover from handler panics, whic
Mattermost versions <=11.9 11.0.9 11.4.8 11.7.7 10.22.11.0 fail to recover from handler panics, which allows an authenticated user to crash the plugin via a post-action request with an unexpected field type.. Mattermost Advisory ID: MMSA-2026-00701
nvd
CVE-2025-2527P4MEDIUMCVSS 4.3≥ 9.11.0, < 9.11.12≥ 10.5.0, < 10.5.32025-05-15
CVE-2025-2527 [MEDIUM] CWE-863 CVE-2025-2527: Mattermost versions 10.5.x <= 10.5.2, 9.11.x <= 9.11.11 failed to properly verify a user's permissio
Mattermost versions 10.5.x <= 10.5.2, 9.11.x <= 9.11.11 failed to properly verify a user's permissions when accessing groups, which allows an attacker to view group information via an API request.
nvd
CVE-2024-23488P4MEDIUMCVSS 4.3fixed in 8.1.9≥ 9.0.0, < 9.4.22024-02-29
CVE-2024-23488 [MEDIUM] CWE-284 CVE-2024-23488: Mattermost fails to properly restrict the access of files attached to posts in an archived channel,
Mattermost fails to properly restrict the access of files attached to posts in an archived channel, resulting in members being able to access files of archived channels even if the “Allow users to view archived channels” option is disabled.
nvd
CVE-2025-41443P4MEDIUMCVSS 4.3≥ 10.5.0, < 10.5.11≥ 10.11.0, < 10.11.32025-10-16
CVE-2025-41443 [MEDIUM] CWE-862 CVE-2025-41443: Mattermost versions 10.5.x <= 10.5.12, 10.11.x <= 10.11.2 fail to properly validate guest user permi
Mattermost versions 10.5.x <= 10.5.12, 10.11.x <= 10.11.2 fail to properly validate guest user permissions when accessing channel information which allows guest users to discover active public channels and their metadata via the `/api/v4/teams/{team_id}/channels/ids` endpoint
nvd
CVE-2025-3228P4MEDIUMCVSS 4.3≥ 9.11.0, < 9.11.16≥ 10.5.0, < 10.5.6+3 more2025-06-20
CVE-2025-3228 [MEDIUM] CWE-863 CVE-2025-3228: Mattermost versions 10.5.x <= 10.5.5, 9.11.x <= 9.11.15, 10.8.x <= 10.8.0, 10.7.x <= 10.7.2, 10.6.x
Mattermost versions 10.5.x <= 10.5.5, 9.11.x <= 9.11.15, 10.8.x <= 10.8.0, 10.7.x <= 10.7.2, 10.6.x <= 10.6.5 fail to properly retrieve requestorInfo from playbooks handler for guest users which allows an attacker access to the playbook run.
nvd
CVE-2024-43780P4MEDIUMCVSS 4.3≥ 9.5.0, < 9.5.8≥ 9.8.0, < 9.8.3+2 more2024-08-22
CVE-2024-43780 [MEDIUM] CWE-284 CVE-2024-43780: Mattermost versions 9.9.x <= 9.9.1, 9.5.x <= 9.5.7, 9.10.0, 9.8.x <= 9.8.2 fail to enforce permissio
Mattermost versions 9.9.x <= 9.9.1, 9.5.x <= 9.5.7, 9.10.0, 9.8.x <= 9.8.2 fail to enforce permissions which allows a guest user with read access to upload files to a channel.
nvd
CVE-2024-9155P4MEDIUMCVSS 4.3≥ 9.5.0, < 9.5.9≥ 9.9.0, < 9.9.3+1 more2024-09-26
CVE-2024-9155 [MEDIUM] CWE-863 CVE-2024-9155: Mattermost versions 9.10.x <= 9.10.1, 9.9.x <= 9.9.2, 9.5.x <= 9.5.8 fail to limit access to channel
Mattermost versions 9.10.x <= 9.10.1, 9.9.x <= 9.9.2, 9.5.x <= 9.5.8 fail to limit access to channels files that have not been linked to a post which allows an attacker to view them in channels that they are a member of.
nvd
CVE-2024-34152P4MEDIUMCVSS 4.3≥ 8.1.0, < 8.1.13≥ 9.5.0, < 9.5.4+1 more2024-05-26
CVE-2024-34152 [MEDIUM] CWE-284 CVE-2024-34152: Mattermost versions 9.5.x <= 9.5.3, 9.6.x <= 9.6.1 and 8.1.x <= 8.1.12 fail to perform proper access
Mattermost versions 9.5.x <= 9.5.3, 9.6.x <= 9.6.1 and 8.1.x <= 8.1.12 fail to perform proper access control which allows a guest to get the metadata of a public playbook run that linked to the channel they are guest via sending an RHSRuns GraphQL query request to the server
nvd
CVE-2025-2424P4MEDIUMCVSS 4.3≥ 9.11.0, < 9.11.10≥ 10.5.0, < 10.5.22025-04-14
CVE-2025-2424 [MEDIUM] CWE-863 CVE-2025-2424: Mattermost versions 10.5.x <= 10.5.1, 9.11.x <= 9.11.9 fail to check if a file has been deleted when
Mattermost versions 10.5.x <= 10.5.1, 9.11.x <= 9.11.9 fail to check if a file has been deleted when creating a bookmark which allows an attacker who knows the IDs of deleted files to obtain metadata of the files via bookmark creation.
nvd
CVE-2024-47145P4MEDIUMCVSS 4.3≥ 9.5.0, < 9.5.92024-09-26
CVE-2024-47145 [MEDIUM] CWE-284 CVE-2024-47145: Mattermost versions 9.5.x <= 9.5.8 fail to properly authorize access to archived channels when viewi
Mattermost versions 9.5.x <= 9.5.8 fail to properly authorize access to archived channels when viewing archived channels is disabled, which allows an attacker to view posts and files of archived channels via file links.
nvd
CVE-2024-29215P4MEDIUMCVSS 4.3≥ 8.1.0, < 8.1.13≥ 9.5.0, < 9.5.4+2 more2024-05-26
CVE-2024-29215 [MEDIUM] CWE-284 CVE-2024-29215: Mattermost versions 9.5.x <= 9.5.3, 9.7.x <= 9.7.1, 9.6.x <= 9.6.1, 8.1.x <= 8.1.12 fail to enforce
Mattermost versions 9.5.x <= 9.5.3, 9.7.x <= 9.7.1, 9.6.x <= 9.6.1, 8.1.x <= 8.1.12 fail to enforce proper access control which allows a user to run a slash command in a channel they are not a member of via linking a playbook run to that channel and running a slash command as a playbook task command.
nvd
CVE-2026-3115P4MEDIUMCVSS 4.3≥ 10.11.0, < 10.11.11≥ 11.2.0, < 11.2.3+2 more2026-03-26
CVE-2026-3115 [MEDIUM] CWE-863 CVE-2026-3115: Mattermost versions 11.2.x <= 11.2.2, 10.11.x <= 10.11.10, 11.4.x <= 11.4.0, 11.3.x <= 11.3.1 fail t
Mattermost versions 11.2.x <= 11.2.2, 10.11.x <= 10.11.10, 11.4.x <= 11.4.0, 11.3.x <= 11.3.1 fail to apply view restrictions when retrieving group member IDs, which allows authenticated guest users to enumerate user IDs outside their allowed visibility scope via the group retrieval endpoint.. Mattermost Advisory ID: MMSA-2026-00594
nvd
CVE-2026-1629P4MEDIUMCVSS 4.3≥ 10.11.0, < 10.11.112026-03-16
CVE-2026-1629 [MEDIUM] CWE-672 CVE-2026-1629: Mattermost versions 10.11.x <= 10.11.10 Fail to invalidate cached permalink preview data when a user
Mattermost versions 10.11.x <= 10.11.10 Fail to invalidate cached permalink preview data when a user loses channel access which allows the user to continue viewing private channel content via previously cached permalink previews until cache reset or relogin.. Mattermost Advisory ID: MMSA-2026-00580
nvd
CVE-2025-24839P4MEDIUMCVSS 4.3≥ 9.11.0, < 9.11.10≥ 10.4.0, < 10.4.4+1 more2025-04-16
CVE-2025-24839 [MEDIUM] CWE-863 CVE-2025-24839: Mattermost versions 10.5.x <= 10.5.1, 10.4.x <= 10.4.3, 9.11.x <= 9.11.9 fail to prevent Wrangler po
Mattermost versions 10.5.x <= 10.5.1, 10.4.x <= 10.4.3, 9.11.x <= 9.11.9 fail to prevent Wrangler posts from triggering AI responses. This vulnerability allows users without access to the AI bot to activate it by attaching the activate_ai override property to a post via the Wrangler plugin, provided both the AI and Wrangler plugins are enabled.
nvd
CVE-2025-4128P4MEDIUMCVSS 4.3≥ 9.11.0, < 9.11.14≥ 10.5.0, < 10.5.52025-06-11
CVE-2025-4128 [MEDIUM] CWE-863 CVE-2025-4128: Mattermost versions 10.5.x <= 10.5.4, 9.11.x <= 9.11.13 fail to properly restrict API access to team
Mattermost versions 10.5.x <= 10.5.4, 9.11.x <= 9.11.13 fail to properly restrict API access to team information, allowing guest users to bypass permissions and view information about public teams they are not members of via a direct API call to /api/v4/teams/{team_id}.
nvd
CVE-2025-12559P4MEDIUMCVSS 4.3≥ 10.5.0, < 10.5.13≥ 10.11.0, < 10.11.5+2 more2025-11-27
CVE-2025-12559 [MEDIUM] CWE-200 CVE-2025-12559: Mattermost versions 11.0.x <= 11.0.2, 10.12.x <= 10.12.1, 10.11.x <= 10.11.4, 10.5.x <= 10.5.12 fail
Mattermost versions 11.0.x <= 11.0.2, 10.12.x <= 10.12.1, 10.11.x <= 10.11.4, 10.5.x <= 10.5.12 fail to sanitize team email addresses to be visible only to Team Admins, which allows any authenticated user to view team email addresses via the GET /api/v4/channels/{channel_id}/common_teams endpoint
nvd