Mattermost vulnerabilities
512 CVEs and advisories name Mattermost as an affected vendor, newest first. Follow it as a feed.
- CVE-2025-22445Misleading UI for undefined admin console settings in Calls causes security confusion
- CVE-2025-20033DoS via custom post type for sysconsole plugin readers
- CVE-2025-22449Access control flaw for team admins allows unauthorized team additions
- CVE-2024-11358Insecure Android File Provider Paths
- CVE-2024-54682Zipbomb DoS via Missing Slack Import Validation
- CVE-2024-54083DoS via lack of type validation in Calls
- CVE-2024-48872Bypass of "Max failed attempts" restriction via race condition
- CVE-2024-12247Improper propagation of permission scheme updates across cluster nodes
- CVE-2024-11599Domain Restriction Bypass on Registration
- CVE-2024-52032Private channel names leaking when Elasticsearch is enabled
- CVE-2024-36250MFA Code Replay
- CVE-2024-42000Unauthorized Access to view channels' details
- CVE-2024-46872Client-Side Path Traversal Leading to CSRF in Playbooks
- CVE-2024-47401DoS via Amplified GraphQL Response in Playbooks
- CVE-2024-50052Arbitrary post deletion via Playbooks /ignore-thread endpoint
- CVE-2024-10241Private channel names leaked with Ctrl+K when ElasticSearch is enabled
- CVE-2024-10214Incorrect Session Creation with Desktop SSO
- CVE-2024-9155Insufficient Authorization On Unlinked Channel Files
- CVE-2024-47003DoS via non-string message using permalink embed
- CVE-2024-42406Unauthorized access on archived channels
- CVE-2024-45843Weak SSRF Filtering
- CVE-2024-47145Unauthorized access on archived channels via file links
- CVE-2024-45835Insufficient Electron Fuses Configuration
- CVE-2024-39772Silent Desktop Screenshot Capture
- CVE-2024-45833Mobile password gets saved in dictionary under conditions
- CVE-2024-39613RCE in desktop app in Windows by local attacker
- CVE-2024-43105Excessive Resource Consumption via `/export`
- CVE-2024-43780Unauthorized channel file upload
- CVE-2024-42497Insufficient permissions checks on teams
- CVE-2024-40884Unauthorized disabling of invite URL