# cve.now: Mattermost

The newest entries naming Mattermost as an affected vendor (up to 200), of 512 in all, 0 known exploited. Older ones are in the full catalog at https://cve.now/latest.md.

- [CVE-2026-93851](https://cve.now/CVE-2026-93851.md): Path traversal in Mattermost Agents plugin mention reminder allows plugin replacement via crafted post (CVSS 8.0)
- [CVE-2026-93846](https://cve.now/CVE-2026-93846.md): Team admin can escalate a team member's permissions via the team member roles endpoint (CVSS 3.8)
- [CVE-2026-93848](https://cve.now/CVE-2026-93848.md): Mattermost OpenID discovery endpoint request bypasses outbound connection filtering, allowing SSRF by a System Administrator (CVSS 2.7)
- [CVE-2026-93850](https://cve.now/CVE-2026-93850.md): Unbounded memory consumption during PDF text extraction (CVSS 6.5)
- [CVE-2026-93849](https://cve.now/CVE-2026-93849.md): Mattermost allows authenticated users to trigger excessive memory allocation via crafted msgpack binary WebSocket frames (CVSS 6.5)
- [CVE-2026-93847](https://cve.now/CVE-2026-93847.md): Improper post type validation on scheduled post endpoints (CVSS 3.5)
- [CVE-2026-116516](https://cve.now/CVE-2026-116516.md): Insufficient length validation when parsing Zoom chat transcriptions (CVSS 6.5)
- [CVE-2026-13411](https://cve.now/CVE-2026-13411.md): Null condition in Playbooks import crashes the plugin (CVSS 4.3)
- [CVE-2026-18799](https://cve.now/CVE-2026-18799.md): Mattermost Server fails to restrict Slack import account binding, allowing team admins to forge posts as existing users (CVSS 4.3)
- [CVE-2026-16251](https://cve.now/CVE-2026-16251.md): Mattermost local image proxy allows server memory exhaustion via unbounded image response buffering (CVSS 6.5)
- [CVE-2026-18256](https://cve.now/CVE-2026-18256.md): Private team metadata disclosure via the team search API (CVSS 4.3)
- [CVE-2026-18223](https://cve.now/CVE-2026-18223.md): Mattermost invitation tokens not bound to invited email address allowing unauthorized team and private channel access (CVSS 5.0)
- [CVE-2026-19076](https://cve.now/CVE-2026-19076.md): Mattermost fails to reject OAuth application sessions in account type switch, allowing account takeover via bearer token (CVSS 4.4)
- [CVE-2026-18560](https://cve.now/CVE-2026-18560.md): Improper order of authorisations in Mattermost GetFile API leads to an authenticated user to determine a post’s quarantined status (CVSS 4.3)
- [CVE-2026-16453](https://cve.now/CVE-2026-16453.md): Mattermost SAML RelayState forgery allows unauthorized team membership (CVSS 7.1)
- [CVE-2026-19600](https://cve.now/CVE-2026-19600.md): Mattermost logs plaintext authentication tokens in debug-level server logs on failed auth attempts (CVSS 4.5)
- [CVE-2026-19621](https://cve.now/CVE-2026-19621.md): Mattermost leaks interactive-message integration secrets to non-admin users via post-deletion events and thread reads (CVSS 6.5)
- [CVE-2026-19603](https://cve.now/CVE-2026-19603.md): Private channel ID disclosure via user status endpoints (CVSS 4.3)
- [CVE-2026-18795](https://cve.now/CVE-2026-18795.md): Missing server side validation allowed user to quarantine a DM and GM post (CVSS 6.4)
- [CVE-2026-19867](https://cve.now/CVE-2026-19867.md): Uncapped mention keys in user notification properties allow CPU exhaustion during post processing (CVSS 4.3)
- [CVE-2026-19601](https://cve.now/CVE-2026-19601.md): Disclosure of AD/LDAP bind password via Test Connection (CVSS 4.9)
- [CVE-2026-18551](https://cve.now/CVE-2026-18551.md): Mattermost guest account privilege escalation via member roles API (CVSS 6.5)
- [CVE-2026-19541](https://cve.now/CVE-2026-19541.md): Outgoing OAuth connection client secret exposure during connection validation (CVSS 6.5)
- [CVE-2026-96260](https://cve.now/CVE-2026-96260.md): Mattermost server missing request body size limit on plugin routes allows denial of service by an authenticated user (CVSS 6.5)
- [CVE-2026-96259](https://cve.now/CVE-2026-96259.md): Mattermost server-side request forgery via OAuth endpoints configurable by a System Administrator (CVSS 5.5)
- [CVE-2026-95666](https://cve.now/CVE-2026-95666.md): Unbounded post ID array in the bulk reactions endpoint allows denial of service (CVSS 4.3)
- [CVE-2026-12284](https://cve.now/CVE-2026-12284.md): Mattermost Desktop App Missing IPC Sender Validation in Calls Leave Handler (CVSS 3.8)
- [CVE-2026-75588](https://cve.now/CVE-2026-75588.md): Mattermost Desktop App plugin popout scheme validation bypass (CVSS 2.6)
- [CVE-2026-75025](https://cve.now/CVE-2026-75025.md): Mattermost Desktop local network access from server-rendered content (CVSS 4.7)
- [CVE-2026-91181](https://cve.now/CVE-2026-91181.md): Data Retention Teams Endpoint Leaks Private Team Invite ID (CVSS 6.5)
- [CVE-2026-12985](https://cve.now/CVE-2026-12985.md): Mattermost DCR redirect URI allowlist bypass via improper URL component validation (CVSS 6.8)
- [CVE-2026-82920](https://cve.now/CVE-2026-82920.md): Mattermost ABAC parent policy bypass via policy update endpoint (CVSS 5.5)
- [CVE-2026-86348](https://cve.now/CVE-2026-86348.md): MS Calendar plugin: unrecovered handler panics from malformed post-action requests could crash the plugin process (CVSS 4.3)
- [CVE-2026-86349](https://cve.now/CVE-2026-86349.md): Mattermost Server Algorithmic DoS via Unbounded Markdown Block Nesting (CVSS 4.3)
- [CVE-2026-10556](https://cve.now/CVE-2026-10556.md): Unauthenticated webhook request with null notification entry could crash the Microsoft Calendar plugin. (CVSS 5.3)
- [CVE-2026-13417](https://cve.now/CVE-2026-13417.md): Boards plugin denial of service via unvalidated block fields.properties (CVSS 4.3)
- [CVE-2026-9812](https://cve.now/CVE-2026-9812.md): Missing property field ownership validation in Playbooks run property update endpoint (CVSS 6.5)
- [CVE-2026-8821](https://cve.now/CVE-2026-8821.md): Playbooks run owner channel membership permission bypass (CVSS 7.1)
- [CVE-2026-5132](https://cve.now/CVE-2026-5132.md): Unbounded zlib decompression in Calls SDP WebSocket messages (CVSS 6.5)
- [CVE-2026-15814](https://cve.now/CVE-2026-15814.md): Uploading a crafted image causes excessive memory allocation in the Mattermost Server (CVSS 6.5)
- [CVE-2026-10542](https://cve.now/CVE-2026-10542.md): Playbooks channel action update validation issue (CVSS 5.0)
- [CVE-2026-14344](https://cve.now/CVE-2026-14344.md): Inconsistent authorization checks in Mattermost Boards endpoints (CVSS 4.3)
- [CVE-2026-12882](https://cve.now/CVE-2026-12882.md): Mattermost Markdown autolink parsing denial of service (CVSS 4.3)
- [CVE-2026-11993](https://cve.now/CVE-2026-11993.md): Fix authenticated members disabling file content indexing server-wide via extraction pool exhaustion (CVSS 4.3)
- [CVE-2026-14259](https://cve.now/CVE-2026-14259.md): Board archive import bypasses team board creation permissions (CVSS 4.3)
- [CVE-2026-75587](https://cve.now/CVE-2026-75587.md): Plaintext pre-auth secret exposure via Desktop App diagnostics report (CVSS 3.6)
- [CVE-2026-9693](https://cve.now/CVE-2026-9693.md): Mattermost thread memberships persist after team removal, exposing private channel thread metadata on re-invite (CVSS 3.5)
- [CVE-2026-9859](https://cve.now/CVE-2026-9859.md): Mattermost Boards plugin didn’t enforce role-based authorization on board channel link allowing board editors to expose boards to arbitrary channels (CVSS 6.5)
- [CVE-2026-9816](https://cve.now/CVE-2026-9816.md): Insufficient server-side validation of board member role fields permits privilege escalation (CVSS 8.3)
- [CVE-2026-10080](https://cve.now/CVE-2026-10080.md): Boards plugin panics on WebSocket command with non-string field types (CVSS 6.5)
- [CVE-2026-10527](https://cve.now/CVE-2026-10527.md): Boards plugin retains Board Admin rights for users demoted to System Guest (CVSS 6.3)
- [CVE-2026-15754](https://cve.now/CVE-2026-15754.md): Missing per-channel team-scope check in ABAC access control policy unassign allows cross-team policy removal (CVSS 4.2)
- [CVE-2026-16044](https://cve.now/CVE-2026-16044.md): Insufficient validation of guest board admin privileges on archive import (CVSS 3.9)
- [CVE-2026-16045](https://cve.now/CVE-2026-16045.md): Delegated OAuth tokens could revoke unrelated OAuth application authorizations (CVSS 2.7)
- [CVE-2026-16049](https://cve.now/CVE-2026-16049.md): \_GitLab Plugin allows cross-channel post injection and phishing via missing channel permission checks in issue API endpoints\_ (CVSS 3.9)
- [CVE-2026-16047](https://cve.now/CVE-2026-16047.md): Board channel linking without read channel permission validation (CVSS 4.3)
- [CVE-2026-16046](https://cve.now/CVE-2026-16046.md): Missing run-state validation on finished playbook runs (CVSS 3.5)
- [CVE-2026-16048](https://cve.now/CVE-2026-16048.md): Channel member roles accept out-of-scope roles (CVSS 6.3)
- [CVE-2026-14298](https://cve.now/CVE-2026-14298.md): Boards archive import endpoint allows resource exhaustion via zip bomb and file size limit bypass in Mattermost (CVSS 6.5)
- [CVE-2026-7521](https://cve.now/CVE-2026-7521.md): SAML certificate deletion allows path traversal to delete arbitrary files outside the config directory (CVSS 5.5)
- [CVE-2026-10819](https://cve.now/CVE-2026-10819.md): Mattermost Server Denial of Service via Animated GIF Emoji Upload (CVSS 6.5)
- [CVE-2026-10600](https://cve.now/CVE-2026-10600.md): Denial of service via unbounded document content extraction in Mattermost Server (CVSS 4.3)
- [CVE-2026-8075](https://cve.now/CVE-2026-8075.md): Posting a malicious markdown image crashes the Mattermost Desktop App (CVSS 6.5)
- [CVE-2026-9602](https://cve.now/CVE-2026-9602.md): Mattermost Desktop App crashes when malformed arguments are provided to some exposed IPC methods (CVSS 5.7)
- [CVE-2026-6541](https://cve.now/CVE-2026-6541.md): Unscoped updates to other playbooks' metric configuration (CVSS 4.3)
- [CVE-2026-9820](https://cve.now/CVE-2026-9820.md): Mattermost schemes teams endpoint exposes private team invite IDs (CVSS 3.8)
- [CVE-2026-9824](https://cve.now/CVE-2026-9824.md): Remote cluster metadata enumeration via /share-channel autocomplete (CVSS 4.3)
- [CVE-2026-9597](https://cve.now/CVE-2026-9597.md): Deactivated guest accounts can authenticate via magic-link token in Mattermost REST API login endpoint (CVSS 5.4)
- [CVE-2026-6850](https://cve.now/CVE-2026-6850.md): Crafted message attachment causes client-side denial of service via markdown parser regex backtracking in Mattermost (CVSS 6.5)
- [CVE-2026-10106](https://cve.now/CVE-2026-10106.md): Unauthorized users can trigger interactive post actions in private channels via action cookie channel mismatch in Mattermost (CVSS 6.5)
- [CVE-2026-10085](https://cve.now/CVE-2026-10085.md): Ordinary group/direct message member can enable group\_constrained and remove all channel participants (CVSS 5.4)
- [CVE-2026-9708](https://cve.now/CVE-2026-9708.md): Incoming webhook user attribution via unvalidated webhook owner (CVSS 4.9)
- [CVE-2026-10103](https://cve.now/CVE-2026-10103.md): Authenticated remote cluster can modify or delete posts it does not own in Mattermost Connected Workspaces shared channels (CVSS 4.3)
- [CVE-2026-9571](https://cve.now/CVE-2026-9571.md): Deactivated user accounts can continue to obtain valid OAuth access tokens via refresh token grant in Mattermost (CVSS 5.9)
- [CVE-2026-4339](https://cve.now/CVE-2026-4339.md): SSRF via unvalidated attachment URLs in Mattermost Agents plugin MCP server (CVSS 6.5)
- [CVE-2026-9699](https://cve.now/CVE-2026-9699.md): Mattermost Agents plugin logs unsanitized OpenAI API keys on authentication errors (CVSS 6.8)
- [CVE-2026-3472](https://cve.now/CVE-2026-3472.md): Markdown image rendering bypass in AI bot tool result posts in Mattermost (CVSS 3.5)
- [CVE-2026-13426](https://cve.now/CVE-2026-13426.md): Client4 fails to validate path parameters (CVSS 5.4)
- [CVE-2026-2299](https://cve.now/CVE-2026-2299.md): Improper Access Control in Mattermost Google Drive Plugin File Creation Endpoint (CVSS 4.2)
- [CVE-2026-8823](https://cve.now/CVE-2026-8823.md): User Manager can demote bot accounts to guest without bot-management permission (CVSS 3.8)
- [CVE-2026-6062](https://cve.now/CVE-2026-6062.md): IDOR in Jira plugin subscription edit endpoint (CVSS 6.4)
- [CVE-2026-6673](https://cve.now/CVE-2026-6673.md): Mattermost Jira plugin had unauthenticated {{/ac/installed}} lifecycle callback during pending Jira Cloud install (CVSS 6.4)
- [CVE-2026-8074](https://cve.now/CVE-2026-8074.md): Improper Permission Check Allows User Manager to Deactivate Bot Accounts (CVSS 3.8)
- [CVE-2026-9162](https://cve.now/CVE-2026-9162.md): Global session revocation does not invalidate active WebSocket connections (CVSS 4.3)
- [CVE-2026-5139](https://cve.now/CVE-2026-5139.md): GitLab Plugin Allows Non-Admin Users to Modify Default Instance Configuration (CVSS 5.4)
- [CVE-2026-8683](https://cve.now/CVE-2026-8683.md): Overly long URLs crash the Mattermost Desktop App (CVSS 6.5)
- [CVE-2026-6517](https://cve.now/CVE-2026-6517.md): Mattermost Desktop App fails to restrict the allow list of domains which NTLM credentials are passed (CVSS 6.3)
- [CVE-2026-6961](https://cve.now/CVE-2026-6961.md): CVE-2026-6961: Path traversal via unsanitized FileInfo.Name in Mattermost federation sync (CVSS 7.6)
- [CVE-2026-7387](https://cve.now/CVE-2026-7387.md): Mattermost group syncable endpoints allow privilege escalation via scheme\_admin (CVSS 8.8)
- [CVE-2026-6046](https://cve.now/CVE-2026-6046.md): Plugin bot username conflict allows user account to be used as bot identity in Mattermost Server (CVSS 5.3)
- [CVE-2026-6689](https://cve.now/CVE-2026-6689.md): \*Missing\* {{invite\_user}} \*permission check on team creation allows unprivileged users to set open-invite and allowed-domains team settings\* (CVSS 4.3)
- [CVE-2026-7184](https://cve.now/CVE-2026-7184.md): Mattermost Remote Cluster PATCH API Leaks Authentication Tokens (CVSS 6.5)
- [CVE-2026-6739](https://cve.now/CVE-2026-6739.md): Mattermost: Delegated admins could patch protected default system roles (CVSS 6.7)
- [CVE-2026-3433](https://cve.now/CVE-2026-3433.md): Mattermost fails to scope role\_updated websocket events to authorized team and channel members (CVSS 4.3)
- [CVE-2026-6957](https://cve.now/CVE-2026-6957.md): Path traversal in Mattermost Legal Hold plugin via unsanitized file name from federated peer allows arbitrary file write. (CVSS 8.0)
- [CVE-2026-4915](https://cve.now/CVE-2026-4915.md): Server panic via outgoing webhook responses (CVSS 6.5)
- [CVE-2026-28735](https://cve.now/CVE-2026-28735.md): GitHub OAuth Scope Validation (CVSS 5.4)
- [CVE-2026-4635](https://cve.now/CVE-2026-4635.md): Persistent notification timing attack causing server denial of service (CVSS 6.5)
- [CVE-2026-3473](https://cve.now/CVE-2026-3473.md): Improper file ownership validation in the Boards API allows unauthorised file access (CVSS 5.9)
- [CVE-2026-4646](https://cve.now/CVE-2026-4646.md): Insufficient input validation in GitHub plugin API causes denial of service (CVSS 4.3)
- [CVE-2026-3636](https://cve.now/CVE-2026-3636.md): Sanitize team member data returned by API (CVSS 4.3)
- [CVE-2026-5740](https://cve.now/CVE-2026-5740.md): Unauthenticated WebSocket binary frame causes denial of service in Mattermost Server (CVSS 7.5)
- [CVE-2026-5308](https://cve.now/CVE-2026-5308.md): Missing request body size limits on Zoom plugin HTTP endpoints (CVSS 4.9)
- [CVE-2026-5755](https://cve.now/CVE-2026-5755.md): Denial of service via crafted TIFF file upload (CVSS 6.5)
- [CVE-2026-22880](https://cve.now/CVE-2026-22880.md): Mobile SSO authentication flow allows credential theft via malicious server (CVSS 6.1)
- [CVE-2026-4858](https://cve.now/CVE-2026-4858.md): Path traversal in integration action URL leading to arbitrary API execution via system admin’s auth token. (CVSS 8.0)
- [CVE-2026-4055](https://cve.now/CVE-2026-4055.md): Insufficient permission validation on cross-team playbook run creation (CVSS 4.3)
- [CVE-2026-3471](https://cve.now/CVE-2026-3471.md): Opening a window with {{javascript:alert()}} as URL causes crash in the Mattermost Desktop App (CVSS 6.5)
- [CVE-2026-4643](https://cve.now/CVE-2026-4643.md): Calling window.close() from server-side content causes crash in the Mattermost Desktop App (CVSS 3.5)
- [CVE-2026-6333](https://cve.now/CVE-2026-6333.md): SSRF via Host Header Spoofing in Custom Slash Commands (CVSS 3.5)
- [CVE-2026-6345](https://cve.now/CVE-2026-6345.md): Prevent password disclosure and force reset during Slack import (CVSS 6.5)
- [CVE-2026-6346](https://cve.now/CVE-2026-6346.md): Sensitive credentials exposed in plaintext in Mattermost support packets (CVSS 8.7)
- [CVE-2026-28732](https://cve.now/CVE-2026-28732.md): Slash command trigger-word update allowed command hijacking (CVSS 4.3)
- [CVE-2026-6343](https://cve.now/CVE-2026-6343.md): Mattermost Playbooks Plugin fails to enforce view permissions in list endpoints, allowing unauthorized access to public playbooks (CVSS 4.3)
- [CVE-2026-6347](https://cve.now/CVE-2026-6347.md): Mattermost Calls plugin exposes TURN server credentials in plaintext in support packets (CVSS 7.6)
- [CVE-2026-5163](https://cve.now/CVE-2026-5163.md): Missing authorization check in AI message rewrite endpoint allows access to private thread content (CVSS 6.5)
- [CVE-2026-3117](https://cve.now/CVE-2026-3117.md): Instance and webhook GitLab plugin commands were able to be run by non-admin users (CVSS 6.5)
- [CVE-2026-4286](https://cve.now/CVE-2026-4286.md): Playbooks Plugin fails to validate team transfers, allowing unauthorized removal of member access via playbook update (CVSS 3.1)
- [CVE-2026-6339](https://cve.now/CVE-2026-6339.md): Missing request origin validation on burn-on-read reveal endpoint (CVSS 4.3)
- [CVE-2026-6340](https://cve.now/CVE-2026-6340.md): Memory Exhaustion via Malicious 7zip File Upload (CVSS 4.3)
- [CVE-2026-6341](https://cve.now/CVE-2026-6341.md): Incomplete group locking implementation (CVSS 4.3)
- [CVE-2026-6342](https://cve.now/CVE-2026-6342.md): Group prefix matching bypass for subscriptions (CVSS 4.3)
- [CVE-2026-3495](https://cve.now/CVE-2026-3495.md): Unescaped variables during error page composition (CVSS 3.8)
- [CVE-2026-4273](https://cve.now/CVE-2026-4273.md): Insufficient token rotation validation in remote cluster invite confirmation (CVSS 3.7)
- [CVE-2026-3637](https://cve.now/CVE-2026-3637.md): Mattermost fails to enforce create\_post permission when editing posts (CVSS 4.3)
- [CVE-2026-2325](https://cve.now/CVE-2026-2325.md): Improper Input Validation in MS Teams Meetings API Handler (CVSS 4.3)
- [CVE-2026-28759](https://cve.now/CVE-2026-28759.md): Insufficient authorization in shared channel membership sync allows remote cluster to remove users from arbitrary channels (CVSS 4.3)
- [CVE-2026-6334](https://cve.now/CVE-2026-6334.md): OAuth authorization code client binding not enforced during token redemption in Mattermost (CVSS 3.1)
- [CVE-2026-4053](https://cve.now/CVE-2026-4053.md): post edit time limit is not enforced on some post update operations (CVSS 3.1)
- [CVE-2026-4054](https://cve.now/CVE-2026-4054.md): SVG content served through Mattermost image proxy despite Content-Type restrictions causes client-side denial of service (CVSS 4.3)
- [CVE-2026-3590](https://cve.now/CVE-2026-3590.md): Race Condition in Guest Magic Link Authentication Allows Token Reuse (CVSS 6.5)
- [CVE-2026-28741](https://cve.now/CVE-2026-28741.md): CSRF Protection Bypass Allows Updating a User's Authentication Method (CVSS 6.8)
- [CVE-2026-27769](https://cve.now/CVE-2026-27769.md): Connected Workspaces: Malicious remote server can manipulate arbitrary user's status (CVSS 2.7)
- [CVE-2026-24661](https://cve.now/CVE-2026-24661.md): Unbounded Request Body Read in MS Teams Plugin {{/changes}} Webhook Endpoint (CVSS 3.7)
- [CVE-2026-21388](https://cve.now/CVE-2026-21388.md): Unbounded Request Body Read in MS Teams Plugin {{/lifecycle}} Webhook Endpoint (CVSS 3.7)
- [CVE-2026-3524](https://cve.now/CVE-2026-3524.md): Authorization Bypass in Mattermost Legal Hold Plugin Due to Missing Return After Permission Check (CVSS 8.3)
- [CVE-2026-28736](https://cve.now/CVE-2026-28736.md): Focalboard IDOR in file content endpoint allows cross-user file access (unsupported product, no fix) (CVSS 4.3)
- [CVE-2026-25773](https://cve.now/CVE-2026-25773.md): Focalboard Second-Order SQL Injection in category reorder endpoint allows data exfiltration (unsupported product, no fix) (CVSS 8.1)
- [CVE-2026-3112](https://cve.now/CVE-2026-3112.md): Arbitrary File Read via Advanced Logging Support Packet (CVSS 6.8)
- [CVE-2026-3109](https://cve.now/CVE-2026-3109.md): Missing timestamp validation in Zoom webhook handler (CVSS 2.2)
- [CVE-2026-3115](https://cve.now/CVE-2026-3115.md): Guest users can view group member IDs without respecting view restrictions (CVSS 4.3)
- [CVE-2026-3114](https://cve.now/CVE-2026-3114.md): Zip Bomb Denial of Service via Unrestricted Archive Decompression (CVSS 6.5)
- [CVE-2026-3116](https://cve.now/CVE-2026-3116.md): Improper Input Validation in Zoom Plugin Webhook Handler (CVSS 4.9)
- [CVE-2026-3113](https://cve.now/CVE-2026-3113.md): mmctl export download command doesn’t restrict permissions to created file to file owner (CVSS 5.0)
- [CVE-2026-3108](https://cve.now/CVE-2026-3108.md): Terminal Escape Injection in mmctl Report Posts Command (CVSS 8.0)
- [CVE-2026-4274](https://cve.now/CVE-2026-4274.md): Insufficient authorization in shared channel membership sync grants team-level access instead of channel-level access (CVSS 5.4)
- [CVE-2026-27659](https://cve.now/CVE-2026-27659.md): CSRF vulnerability in UpdateAccessControlPolicyActiveStatus endpoint (CVSS 4.6)
- [CVE-2026-20719](https://cve.now/CVE-2026-20719.md): DoS via URL Previews Rendering Malicious SVGs (CVSS 4.3)
- [CVE-2026-27656](https://cve.now/CVE-2026-27656.md): Account Takeover via Substring Matching in OpenID Connect Authentication (CVSS 5.7)
- [CVE-2026-26233](https://cve.now/CVE-2026-26233.md): Denial of Service via HTTP/2 single packet attack on login endpoint (CVSS 4.3)
- [CVE-2026-1629](https://cve.now/CVE-2026-1629.md): Permalink Preview Information Disclosure After Permission Revocation (CVSS 4.3)
- [CVE-2026-26230](https://cve.now/CVE-2026-26230.md): Team Admin Privilege Escalation to Demote Members to Guest (CVSS 3.8)
- [CVE-2026-2454](https://cve.now/CVE-2026-2454.md): DoS in Calls plugin via malformed msgpack in websocket request. (CVSS 5.8)
- [CVE-2026-26304](https://cve.now/CVE-2026-26304.md): Permission Bypass in Playbook Run Creation (CVSS 4.3)
- [CVE-2026-24692](https://cve.now/CVE-2026-24692.md): Guest users can bypass read permissions via search API (CVSS 4.3)
- [CVE-2026-22545](https://cve.now/CVE-2026-22545.md): Password Change Bypass via Auth Switch Endpoint (CVSS 3.1)
- [CVE-2026-2455](https://cve.now/CVE-2026-2455.md): SSRF bypass via IPv4-mapped IPv6 literals (CVSS 4.3)
- [CVE-2026-21386](https://cve.now/CVE-2026-21386.md): Private channel enumeration via /mute slash command (CVSS 4.3)
- [CVE-2026-25780](https://cve.now/CVE-2026-25780.md): Memory Exhaustion via Malformed DOC File Upload (CVSS 4.3)
- [CVE-2026-4265](https://cve.now/CVE-2026-4265.md): Guest user can upload files without permission across teams (CVSS 4.3)
- [CVE-2026-25783](https://cve.now/CVE-2026-25783.md): Denial of service via malformed User-Agent header in getBrowserVersion (CVSS 4.3)
- [CVE-2026-24458](https://cve.now/CVE-2026-24458.md): DoS attack via login attempts with multi-megabyte passwords (CVSS 7.5)
- [CVE-2026-2462](https://cve.now/CVE-2026-2462.md): Admin RCE via Malicious Plugin Upload on CI Test Instances (CVSS 6.6)
- [CVE-2026-2578](https://cve.now/CVE-2026-2578.md): Information Disclosure via WebSocket Event When Deleting Unrevealed Burn on Read Posts (CVSS 4.3)
- [CVE-2026-26246](https://cve.now/CVE-2026-26246.md): Memory Exhaustion via Malformed PSD File Upload (CVSS 4.3)
- [CVE-2026-2458](https://cve.now/CVE-2026-2458.md): Unauthorized channel enumeration in private teams after member removal (CVSS 4.3)
- [CVE-2026-2457](https://cve.now/CVE-2026-2457.md): WebSocket Message Spoofing via Permalink Embed Manipulation (CVSS 4.3)
- [CVE-2026-2461](https://cve.now/CVE-2026-2461.md): Missing authorization check allows unauthorized modification of other users' comments on a board (CVSS 4.3)
- [CVE-2026-2463](https://cve.now/CVE-2026-2463.md): Unauthorized access to invite ID during team creation (CVSS 4.3)
- [CVE-2026-2476](https://cve.now/CVE-2026-2476.md): MS Teams plugin sensitive config values not properly masked in support packets (CVSS 7.6)
- [CVE-2026-2456](https://cve.now/CVE-2026-2456.md): Denial of Service via Unbounded Memory Allocation in Integration Actions (CVSS 5.3)
- [CVE-2026-1628](https://cve.now/CVE-2026-1628.md): Mattermost allows external websites to open within the app, exposing preload functionality to non-trusted sites. (CVSS 4.6)
- [CVE-2025-14573](https://cve.now/CVE-2025-14573.md): Team Admin Bypass of Invite Permissions via allow\_open\_invite Field (CVSS 3.8)
- [CVE-2026-1046](https://cve.now/CVE-2026-1046.md): Arbitrary application execution via unvalidated server-controlled URLs in Help menu (CVSS 7.6)
- [CVE-2025-14350](https://cve.now/CVE-2025-14350.md): Information disclosure via channel mentions in posts (CVSS 4.3)
- [CVE-2025-13821](https://cve.now/CVE-2025-13821.md): User profile update exposes password hash and MFA secrets (CVSS 5.7)
- [CVE-2026-0997](https://cve.now/CVE-2026-0997.md): Mattermost Zoom Plugin channel preference API lacks authorization checks (CVSS 4.3)
- [CVE-2026-0998](https://cve.now/CVE-2026-0998.md): Mattermost Zoom Plugin allows unauthorized meeting creation and post modification via insufficient API access controls (CVSS 4.3)
- [CVE-2026-0999](https://cve.now/CVE-2026-0999.md): Authentication bypass via userID login when email and username login are disabled (CVSS 5.4)
- [CVE-2026-20796](https://cve.now/CVE-2026-20796.md): Time-of-check time-of-use vulnerability in common teams API (CVSS 3.1)
- [CVE-2026-22892](https://cve.now/CVE-2026-22892.md): Insufficient Authorization in Mattermost Jira Plugin Allows Unauthorized Access to Post Attachments (CVSS 4.3)
- [CVE-2025-13523](https://cve.now/CVE-2025-13523.md): Cross-Site Scripting (XSS) via Unescaped Display Names in Mattermost Confluence Plugin OAuth2 Flow (CVSS 7.7)
- [CVE-2025-14435](https://cve.now/CVE-2025-14435.md): Application-Level DoS via infinite re-render loop in user profile handling (CVSS 6.8)
- [CVE-2025-14822](https://cve.now/CVE-2025-14822.md): DoS from quadratic complexity in model.ParseHashtags (CVSS 3.1)
- [CVE-2025-64641](https://cve.now/CVE-2025-64641.md): Mattermost Jira plugin crafted action leaks Jira issue details (CVSS 4.1)
- [CVE-2025-13767](https://cve.now/CVE-2025-13767.md): Unauthorized Read Access to Private Channel Posts via Mattermost Jira Plugin (CVSS 4.3)
- [CVE-2025-14273](https://cve.now/CVE-2025-14273.md): Mattermost Jira plugin user spoofing enables Jira request forgery. (CVSS 7.2)
- [CVE-2025-13326](https://cve.now/CVE-2025-13326.md): Mattermost Desktop App fails to enable Hardened Runtime when packaged for Mac App Store (CVSS 3.9)
- [CVE-2025-13324](https://cve.now/CVE-2025-13324.md): Lack of Invalidation of Legacy Remote Cluster Invite Tokens After Confirmation (CVSS 3.7)
- [CVE-2025-13321](https://cve.now/CVE-2025-13321.md): Mattermost Desktop App logging sensitive information and fails to clear data on server deletion (CVSS 3.3)
- [CVE-2025-12689](https://cve.now/CVE-2025-12689.md): DoS in Calls plugin via malformed UTF-8 in WebSocket request (CVSS 6.5)
- [CVE-2025-62690](https://cve.now/CVE-2025-62690.md): Open redirect in error page when link opened in new tab (CVSS 3.1)
- [CVE-2025-13352](https://cve.now/CVE-2025-13352.md): Mattermost GitHub Plugin allows unauthorized GitHub reactions via reaction forwarding hijacking (CVSS 3.0)
- [CVE-2025-62190](https://cve.now/CVE-2025-62190.md): CSRF Allows Call Initiation and Message Delivery (CVSS 4.3)
- [CVE-2025-13870](https://cve.now/CVE-2025-13870.md): Unauthorized access and subscription vulnerability in Boards (CVSS 3.1)
- [CVE-2025-12756](https://cve.now/CVE-2025-12756.md): Insecure Direct Object Reference in Mattermost Boards Plugin Enables Unauthorised Comment Deletion (CVSS 4.3)
- [CVE-2025-12421](https://cve.now/CVE-2025-12421.md): Account Takeover via Code Exchange Endpoint (CVSS 9.9)
- [CVE-2025-12559](https://cve.now/CVE-2025-12559.md): Information Disclosure in Common Teams API (CVSS 4.3)
- [CVE-2025-12419](https://cve.now/CVE-2025-12419.md): Account takeover on OAuth/OpenID-enabled servers (CVSS 9.9)
- [CVE-2025-55074](https://cve.now/CVE-2025-55074.md): Channel member objects leak read status (CVSS 3.0)

---

Source: cve.now
Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards.
Page: https://cve.now/vendors/mattermost
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.