Mattermost vulnerabilities
512 CVEs and advisories name Mattermost as an affected vendor, newest first. Follow it as a feed.
- CVE-2026-12985Mattermost DCR redirect URI allowlist bypass via improper URL component validation
- CVE-2026-82920Mattermost ABAC parent policy bypass via policy update endpoint
- CVE-2026-86348MS Calendar plugin: unrecovered handler panics from malformed post-action requests could crash the plugin process
- CVE-2026-86349Mattermost Server Algorithmic DoS via Unbounded Markdown Block Nesting
- CVE-2026-10556Unauthenticated webhook request with null notification entry could crash the Microsoft Calendar plugin.
- CVE-2026-13417Boards plugin denial of service via unvalidated block fields.properties
- CVE-2026-9812Missing property field ownership validation in Playbooks run property update endpoint
- CVE-2026-8821Playbooks run owner channel membership permission bypass
- CVE-2026-5132Unbounded zlib decompression in Calls SDP WebSocket messages
- CVE-2026-15814Uploading a crafted image causes excessive memory allocation in the Mattermost Server
- CVE-2026-10542Playbooks channel action update validation issue
- CVE-2026-14344Inconsistent authorization checks in Mattermost Boards endpoints
- CVE-2026-12882Mattermost Markdown autolink parsing denial of service
- CVE-2026-11993Fix authenticated members disabling file content indexing server-wide via extraction pool exhaustion
- CVE-2026-14259Board archive import bypasses team board creation permissions
- CVE-2026-75587Plaintext pre-auth secret exposure via Desktop App diagnostics report
- CVE-2026-9693Mattermost thread memberships persist after team removal, exposing private channel thread metadata on re-invite
- CVE-2026-9859Mattermost Boards plugin didn’t enforce role-based authorization on board channel link allowing board editors to expose boards to arbitrary channels
- CVE-2026-9816Insufficient server-side validation of board member role fields permits privilege escalation
- CVE-2026-10080Boards plugin panics on WebSocket command with non-string field types
- CVE-2026-10527Boards plugin retains Board Admin rights for users demoted to System Guest
- CVE-2026-15754Missing per-channel team-scope check in ABAC access control policy unassign allows cross-team policy removal
- CVE-2026-16044Insufficient validation of guest board admin privileges on archive import
- CVE-2026-16045Delegated OAuth tokens could revoke unrelated OAuth application authorizations
- CVE-2026-16049_GitLab Plugin allows cross-channel post injection and phishing via missing channel permission checks in issue API endpoints_
- CVE-2026-16047Board channel linking without read channel permission validation
- CVE-2026-16046Missing run-state validation on finished playbook runs
- CVE-2026-16048Channel member roles accept out-of-scope roles
- CVE-2026-14298Boards archive import endpoint allows resource exhaustion via zip bomb and file size limit bypass in Mattermost
- CVE-2026-7521SAML certificate deletion allows path traversal to delete arbitrary files outside the config directory