Mattermost vulnerabilities
512 CVEs and advisories name Mattermost as an affected vendor, newest first. Follow it as a feed.
- CVE-2026-6689*Missing* {{invite_user}} *permission check on team creation allows unprivileged users to set open-invite and allowed-domains team settings*
- CVE-2026-7184Mattermost Remote Cluster PATCH API Leaks Authentication Tokens
- CVE-2026-6739Mattermost: Delegated admins could patch protected default system roles
- CVE-2026-3433Mattermost fails to scope role_updated websocket events to authorized team and channel members
- CVE-2026-6957Path traversal in Mattermost Legal Hold plugin via unsanitized file name from federated peer allows arbitrary file write.
- CVE-2026-4915Server panic via outgoing webhook responses
- CVE-2026-28735GitHub OAuth Scope Validation
- CVE-2026-4635Persistent notification timing attack causing server denial of service
- CVE-2026-3473Improper file ownership validation in the Boards API allows unauthorised file access
- CVE-2026-4646Insufficient input validation in GitHub plugin API causes denial of service
- CVE-2026-3636Sanitize team member data returned by API
- CVE-2026-5740Unauthenticated WebSocket binary frame causes denial of service in Mattermost Server
- CVE-2026-5308Missing request body size limits on Zoom plugin HTTP endpoints
- CVE-2026-5755Denial of service via crafted TIFF file upload
- CVE-2026-22880Mobile SSO authentication flow allows credential theft via malicious server
- CVE-2026-4858Path traversal in integration action URL leading to arbitrary API execution via system admin’s auth token.
- CVE-2026-4055Insufficient permission validation on cross-team playbook run creation
- CVE-2026-3471Opening a window with {{javascript:alert()}} as URL causes crash in the Mattermost Desktop App
- CVE-2026-4643Calling window.close() from server-side content causes crash in the Mattermost Desktop App
- CVE-2026-6333SSRF via Host Header Spoofing in Custom Slash Commands
- CVE-2026-6345Prevent password disclosure and force reset during Slack import
- CVE-2026-6346Sensitive credentials exposed in plaintext in Mattermost support packets
- CVE-2026-28732Slash command trigger-word update allowed command hijacking
- CVE-2026-6343Mattermost Playbooks Plugin fails to enforce view permissions in list endpoints, allowing unauthorized access to public playbooks
- CVE-2026-6347Mattermost Calls plugin exposes TURN server credentials in plaintext in support packets
- CVE-2026-5163Missing authorization check in AI message rewrite endpoint allows access to private thread content
- CVE-2026-3117Instance and webhook GitLab plugin commands were able to be run by non-admin users
- CVE-2026-4286Playbooks Plugin fails to validate team transfers, allowing unauthorized removal of member access via playbook update
- CVE-2026-6339Missing request origin validation on burn-on-read reveal endpoint
- CVE-2026-6340Memory Exhaustion via Malicious 7zip File Upload