Mattermost
Products
| Product | CVEs | Exploited | Latest |
|---|---|---|---|
| Mattermost | 480 | – | Oct 28, 2026 |
| Mattermost Confluence Plugin | 14 | – | Feb 6, 2026 |
| Mattermost Desktop | 3 | – | Nov 2, 2023 |
| Mattermost Boards | 2 | – | Jan 18, 2022 |
| Focalboard | 2 | – | Apr 3, 2026 |
| Mattermost App Framework | 2 | – | Jun 16, 2023 |
| Mattermost Playbooks | 2 | – | May 3, 2022 |
| Mattermost Google Drive Plugin | 1 | – | Jun 25, 2026 |
| Playbooks Plugin | 1 | – | Nov 23, 2022 |
| Mattermost Github Plugin | 1 | – | Jun 16, 2023 |
| Mattermost iOS app | 1 | – | Jul 17, 2023 |
| Mattermost Mobile | 1 | – | Mar 15, 2024 |
| Mattermost Plugins | 1 | – | Jul 17, 2023 |
| github.com/mattermost/mattermost/server/public | 1 | – | Jun 26, 2026 |
Exploited and recent CVEs
- CVE-2026-93851 Path traversal in Mattermost Agents plugin mention reminder allows plugin replacement via crafted post 0.3%
- CVE-2026-93846 Team admin can escalate a team member's permissions via the team member roles endpoint 0.2%
- CVE-2026-93848 Mattermost OpenID discovery endpoint request bypasses outbound connection filtering, allowing SSRF by a System Administrator 0.3%
- CVE-2026-93850 Unbounded memory consumption during PDF text extraction 0.4%
- CVE-2026-93849 Mattermost allows authenticated users to trigger excessive memory allocation via crafted msgpack binary WebSocket frames 0.5%
- CVE-2026-93847 Improper post type validation on scheduled post endpoints 0.2%
- CVE-2026-116516 Insufficient length validation when parsing Zoom chat transcriptions 0.4%
- CVE-2026-13411 Null condition in Playbooks import crashes the plugin 0.3%
- CVE-2026-18799 Mattermost Server fails to restrict Slack import account binding, allowing team admins to forge posts as existing users 0.2%
- CVE-2026-16251 Mattermost local image proxy allows server memory exhaustion via unbounded image response buffering 0.3%
- CVE-2026-18256 Private team metadata disclosure via the team search API 0.2%
- CVE-2026-18223 Mattermost invitation tokens not bound to invited email address allowing unauthorized team and private channel access 0.2%
- CVE-2026-19076 Mattermost fails to reject OAuth application sessions in account type switch, allowing account takeover via bearer token 0.2%
- CVE-2026-18560 Improper order of authorisations in Mattermost GetFile API leads to an authenticated user to determine a post’s quarantined status 0.2%
- CVE-2026-16453 Mattermost SAML RelayState forgery allows unauthorized team membership 0.2%
- CVE-2026-19600 Mattermost logs plaintext authentication tokens in debug-level server logs on failed auth attempts 0.2%
- CVE-2026-19621 Mattermost leaks interactive-message integration secrets to non-admin users via post-deletion events and thread reads 0.3%
- CVE-2026-19603 Private channel ID disclosure via user status endpoints 0.2%
- CVE-2026-18795 Missing server side validation allowed user to quarantine a DM and GM post 0.1%
- CVE-2026-19867 Uncapped mention keys in user notification properties allow CPU exhaustion during post processing 0.2%
- CVE-2026-19601 Disclosure of AD/LDAP bind password via Test Connection 0.2%
- CVE-2026-18551 Mattermost guest account privilege escalation via member roles API 0.2%
- CVE-2026-19541 Outgoing OAuth connection client secret exposure during connection validation 0.2%
- CVE-2026-96260 Mattermost server missing request body size limit on plugin routes allows denial of service by an authenticated user 0.4%
- CVE-2026-96259 Mattermost server-side request forgery via OAuth endpoints configurable by a System Administrator 0.3%
- CVE-2026-95666 Unbounded post ID array in the bulk reactions endpoint allows denial of service 0.4%
- CVE-2026-12284 Mattermost Desktop App Missing IPC Sender Validation in Calls Leave Handler 0.2%
- CVE-2026-75588 Mattermost Desktop App plugin popout scheme validation bypass 0.2%
- CVE-2026-75025 Mattermost Desktop local network access from server-rendered content 0.2%
- CVE-2026-91181 Data Retention Teams Endpoint Leaks Private Team Invite ID 0.4%