Mattermost vulnerabilities
512 CVEs and advisories name Mattermost as an affected vendor, newest first. Follow it as a feed.
- CVE-2025-24839Unauthorized AI bot activation via Wrangler plugin
- CVE-2025-2475Unauthorized Bot Login Using Credentials
- CVE-2025-2424Leaked Metadata of Deleted Files via Bookmark Creation
- CVE-2025-32093Syatem admin profile modification by delegated granular administration role
- CVE-2025-30516Unauthorized Notification Exposure in Mobile App Under Specific Conditions
- CVE-2025-24866Unauthorized Access to User Activity Logs API by delegated granular administration roles
- CVE-2025-1558Denial of Service Via Malicious GIF
- CVE-2025-25068Bypassing MFA Enforcement on Plugin Endpoints
- CVE-2025-24920Unauthorized Bookmark Creation and Modification in Archived Channels
- CVE-2025-30179MFA Enforcement Bypass in Search APIs
- CVE-2025-25274Unauthorized Command Execution in Archived Channels
- CVE-2025-27933Unauthorized Private-to-Public Channel Conversion
- CVE-2025-27715Auto-Enrollment of Team Admins into Private Channels without explicit consent
- CVE-2025-1472Unauthorized View Access to Site Statistics and Team Statistics
- CVE-2025-1398macOS TCC Bypass via Code Injection
- CVE-2025-20051Arbitrary file read via block duplication in Mattermost Boards
- CVE-2025-24490SQL Injection in Mattermost Boards via board category ID reordering
- CVE-2025-25279Arbitrary file read in Mattermost Boards via import & export board archive
- CVE-2025-1412Session Persistence After User-to-Bot Conversion
- CVE-2025-24526Channel export permitted on archived channel when viewing archived channels is disabled
- CVE-2025-0503Leaked User IDs and Metadata of Deleted DMs
- CVE-2025-20630Mobile crash via object that can't be cast to String in Attachment Field
- CVE-2025-20621Webapp crash via object that can't be cast to String in Attachment Field
- CVE-2025-20072Mobile crash via improper validation of proto style in attachments
- CVE-2025-0476Mobile crash via file with specially crafted filename
- CVE-2025-20088Insufficient Input Validation on Post Props
- CVE-2025-20086Insufficient Input Validation on Post Props
- CVE-2025-21083Insufficient Input Validation on Post Props
- CVE-2025-20036Insufficient Input Validation on Post Props
- CVE-2025-21088WebApp crash via improper validation of proto style in attachments