Mattermost vulnerabilities
512 CVEs and advisories name Mattermost as an affected vendor, newest first. Follow it as a feed.
- CVE-2026-10819Mattermost Server Denial of Service via Animated GIF Emoji Upload
- CVE-2026-10600Denial of service via unbounded document content extraction in Mattermost Server
- CVE-2026-8075Posting a malicious markdown image crashes the Mattermost Desktop App
- CVE-2026-9602Mattermost Desktop App crashes when malformed arguments are provided to some exposed IPC methods
- CVE-2026-6541Unscoped updates to other playbooks' metric configuration
- CVE-2026-9820Mattermost schemes teams endpoint exposes private team invite IDs
- CVE-2026-9824Remote cluster metadata enumeration via /share-channel autocomplete
- CVE-2026-9597Deactivated guest accounts can authenticate via magic-link token in Mattermost REST API login endpoint
- CVE-2026-6850Crafted message attachment causes client-side denial of service via markdown parser regex backtracking in Mattermost
- CVE-2026-10106Unauthorized users can trigger interactive post actions in private channels via action cookie channel mismatch in Mattermost
- CVE-2026-10085Ordinary group/direct message member can enable group_constrained and remove all channel participants
- CVE-2026-9708Incoming webhook user attribution via unvalidated webhook owner
- CVE-2026-10103Authenticated remote cluster can modify or delete posts it does not own in Mattermost Connected Workspaces shared channels
- CVE-2026-9571Deactivated user accounts can continue to obtain valid OAuth access tokens via refresh token grant in Mattermost
- CVE-2026-4339SSRF via unvalidated attachment URLs in Mattermost Agents plugin MCP server
- CVE-2026-9699Mattermost Agents plugin logs unsanitized OpenAI API keys on authentication errors
- CVE-2026-3472Markdown image rendering bypass in AI bot tool result posts in Mattermost
- CVE-2026-13426Client4 fails to validate path parameters
- CVE-2026-2299Improper Access Control in Mattermost Google Drive Plugin File Creation Endpoint
- CVE-2026-8823User Manager can demote bot accounts to guest without bot-management permission
- CVE-2026-6062IDOR in Jira plugin subscription edit endpoint
- CVE-2026-6673Mattermost Jira plugin had unauthenticated {{/ac/installed}} lifecycle callback during pending Jira Cloud install
- CVE-2026-8074Improper Permission Check Allows User Manager to Deactivate Bot Accounts
- CVE-2026-9162Global session revocation does not invalidate active WebSocket connections
- CVE-2026-5139GitLab Plugin Allows Non-Admin Users to Modify Default Instance Configuration
- CVE-2026-8683Overly long URLs crash the Mattermost Desktop App
- CVE-2026-6517Mattermost Desktop App fails to restrict the allow list of domains which NTLM credentials are passed
- CVE-2026-6961CVE-2026-6961: Path traversal via unsanitized FileInfo.Name in Mattermost federation sync
- CVE-2026-7387Mattermost group syncable endpoints allow privilege escalation via scheme_admin
- CVE-2026-6046Plugin bot username conflict allows user account to be used as bot identity in Mattermost Server