Mattermost vulnerabilities
512 CVEs and advisories name Mattermost as an affected vendor, newest first. Follow it as a feed.
- CVE-2026-93851Path traversal in Mattermost Agents plugin mention reminder allows plugin replacement via crafted post
- CVE-2026-93846Team admin can escalate a team member's permissions via the team member roles endpoint
- CVE-2026-93848Mattermost OpenID discovery endpoint request bypasses outbound connection filtering, allowing SSRF by a System Administrator
- CVE-2026-93850Unbounded memory consumption during PDF text extraction
- CVE-2026-93849Mattermost allows authenticated users to trigger excessive memory allocation via crafted msgpack binary WebSocket frames
- CVE-2026-93847Improper post type validation on scheduled post endpoints
- CVE-2026-116516Insufficient length validation when parsing Zoom chat transcriptions
- CVE-2026-13411Null condition in Playbooks import crashes the plugin
- CVE-2026-18799Mattermost Server fails to restrict Slack import account binding, allowing team admins to forge posts as existing users
- CVE-2026-16251Mattermost local image proxy allows server memory exhaustion via unbounded image response buffering
- CVE-2026-18256Private team metadata disclosure via the team search API
- CVE-2026-18223Mattermost invitation tokens not bound to invited email address allowing unauthorized team and private channel access
- CVE-2026-19076Mattermost fails to reject OAuth application sessions in account type switch, allowing account takeover via bearer token
- CVE-2026-18560Improper order of authorisations in Mattermost GetFile API leads to an authenticated user to determine a post’s quarantined status
- CVE-2026-16453Mattermost SAML RelayState forgery allows unauthorized team membership
- CVE-2026-19600Mattermost logs plaintext authentication tokens in debug-level server logs on failed auth attempts
- CVE-2026-19621Mattermost leaks interactive-message integration secrets to non-admin users via post-deletion events and thread reads
- CVE-2026-19603Private channel ID disclosure via user status endpoints
- CVE-2026-18795Missing server side validation allowed user to quarantine a DM and GM post
- CVE-2026-19867Uncapped mention keys in user notification properties allow CPU exhaustion during post processing
- CVE-2026-19601Disclosure of AD/LDAP bind password via Test Connection
- CVE-2026-18551Mattermost guest account privilege escalation via member roles API
- CVE-2026-19541Outgoing OAuth connection client secret exposure during connection validation
- CVE-2026-96260Mattermost server missing request body size limit on plugin routes allows denial of service by an authenticated user
- CVE-2026-96259Mattermost server-side request forgery via OAuth endpoints configurable by a System Administrator
- CVE-2026-95666Unbounded post ID array in the bulk reactions endpoint allows denial of service
- CVE-2026-12284Mattermost Desktop App Missing IPC Sender Validation in Calls Leave Handler
- CVE-2026-75588Mattermost Desktop App plugin popout scheme validation bypass
- CVE-2026-75025Mattermost Desktop local network access from server-rendered content
- CVE-2026-91181Data Retention Teams Endpoint Leaks Private Team Invite ID