What’s Vulnerable › Products
Mattermost vulnerabilities
510 known vulnerabilities, 0 confirmed exploited in the wild (CISA KEV), 181 published in the last 12 months.
Check whether your Mattermost version is affected
Latest Mattermost vulnerabilities
- CVE-2026-93846 — Team admin can escalate a team member's permissions via the team member roles endpoint (CVSS 3.8)
- CVE-2026-93850 — Unbounded memory consumption during PDF text extraction (CVSS 6.5)
- CVE-2026-93849 — Mattermost allows authenticated users to trigger excessive memory allocation via crafted msgpack binary WebSocket frames (CVSS 6.5)
- CVE-2026-93848 — Mattermost OpenID discovery endpoint request bypasses outbound connection filtering, allowing SSRF by a System Administrator (CVSS 2.7)
- CVE-2026-116516 — Insufficient length validation when parsing Zoom chat transcriptions (CVSS 6.5)
- CVE-2026-93847 — Improper post type validation on scheduled post endpoints (CVSS 3.5)
- CVE-2026-13411 — Null condition in Playbooks import crashes the plugin (CVSS 4.3)
- CVE-2026-19621 — Mattermost leaks interactive-message integration secrets to non-admin users via post-deletion events and thread reads (CVSS 6.5)
- CVE-2026-19600 — Mattermost logs plaintext authentication tokens in debug-level server logs on failed auth attempts (CVSS 4.9)
- CVE-2026-19076 — Mattermost fails to reject OAuth application sessions in account type switch, allowing account takeover via bearer token (CVSS 4.9)
- CVE-2026-18799 — Mattermost Server fails to restrict Slack import account binding, allowing team admins to forge posts as existing users (CVSS 4.3)
- CVE-2026-18560 — Improper order of authorisations in Mattermost GetFile API leads to an authenticated user to determine a post’s quarantined status (CVSS 4.3)
- CVE-2026-18256 — Private team metadata disclosure via the team search API (CVSS 4.3)
- CVE-2026-18223 — Mattermost invitation tokens not bound to invited email address allowing unauthorized team and private channel access (CVSS 5.0)
- CVE-2026-16453 — Mattermost SAML RelayState forgery allows unauthorized team membership (CVSS 7.1)
- CVE-2026-16251 — Mattermost local image proxy allows server memory exhaustion via unbounded image response buffering (CVSS 6.5)
- CVE-2026-19867 — Uncapped mention keys in user notification properties allow CPU exhaustion during post processing (CVSS 4.3)
- CVE-2026-19603 — Private channel ID disclosure via user status endpoints (CVSS 4.3)
- CVE-2026-19601 — Disclosure of AD/LDAP bind password via Test Connection (CVSS 4.9)
- CVE-2026-19541 — Outgoing OAuth connection client secret exposure during connection validation (CVSS 6.5)
- CVE-2026-18795 — Missing server side validation allowed user to quarantine a DM and GM post (CVSS 6.4)
- CVE-2026-18551 — Mattermost guest account privilege escalation via member roles API (CVSS 6.5)
- CVE-2026-96260 — Mattermost server missing request body size limit on plugin routes allows denial of service by an authenticated user (CVSS 6.5)
- CVE-2026-96259 — Mattermost server-side request forgery via OAuth endpoints configurable by a System Administrator (CVSS 5.5)
- CVE-2026-95666 — Unbounded post ID array in the bulk reactions endpoint allows denial of service (CVSS 4.3)