Mattermost vulnerabilities
512 CVEs and advisories name Mattermost as an affected vendor, newest first. Follow it as a feed.
- CVE-2026-6341Incomplete group locking implementation
- CVE-2026-6342Group prefix matching bypass for subscriptions
- CVE-2026-3495Unescaped variables during error page composition
- CVE-2026-4273Insufficient token rotation validation in remote cluster invite confirmation
- CVE-2026-3637Mattermost fails to enforce create_post permission when editing posts
- CVE-2026-2325Improper Input Validation in MS Teams Meetings API Handler
- CVE-2026-28759Insufficient authorization in shared channel membership sync allows remote cluster to remove users from arbitrary channels
- CVE-2026-6334OAuth authorization code client binding not enforced during token redemption in Mattermost
- CVE-2026-4053post edit time limit is not enforced on some post update operations
- CVE-2026-4054SVG content served through Mattermost image proxy despite Content-Type restrictions causes client-side denial of service
- CVE-2026-3590Race Condition in Guest Magic Link Authentication Allows Token Reuse
- CVE-2026-28741CSRF Protection Bypass Allows Updating a User's Authentication Method
- CVE-2026-27769Connected Workspaces: Malicious remote server can manipulate arbitrary user's status
- CVE-2026-24661Unbounded Request Body Read in MS Teams Plugin {{/changes}} Webhook Endpoint
- CVE-2026-21388Unbounded Request Body Read in MS Teams Plugin {{/lifecycle}} Webhook Endpoint
- CVE-2026-3524Authorization Bypass in Mattermost Legal Hold Plugin Due to Missing Return After Permission Check
- CVE-2026-28736Focalboard IDOR in file content endpoint allows cross-user file access (unsupported product, no fix)
- CVE-2026-25773Focalboard Second-Order SQL Injection in category reorder endpoint allows data exfiltration (unsupported product, no fix)
- CVE-2026-3112Arbitrary File Read via Advanced Logging Support Packet
- CVE-2026-3109Missing timestamp validation in Zoom webhook handler
- CVE-2026-3115Guest users can view group member IDs without respecting view restrictions
- CVE-2026-3114Zip Bomb Denial of Service via Unrestricted Archive Decompression
- CVE-2026-3116Improper Input Validation in Zoom Plugin Webhook Handler
- CVE-2026-3113mmctl export download command doesn’t restrict permissions to created file to file owner
- CVE-2026-3108Terminal Escape Injection in mmctl Report Posts Command
- CVE-2026-4274Insufficient authorization in shared channel membership sync grants team-level access instead of channel-level access
- CVE-2026-27659CSRF vulnerability in UpdateAccessControlPolicyActiveStatus endpoint
- CVE-2026-20719DoS via URL Previews Rendering Malicious SVGs
- CVE-2026-27656Account Takeover via Substring Matching in OpenID Connect Authentication
- CVE-2026-26233Denial of Service via HTTP/2 single packet attack on login endpoint