Mattermost vulnerabilities
512 CVEs and advisories name Mattermost as an affected vendor, newest first. Follow it as a feed.
- CVE-2026-1629Permalink Preview Information Disclosure After Permission Revocation
- CVE-2026-26230Team Admin Privilege Escalation to Demote Members to Guest
- CVE-2026-2454DoS in Calls plugin via malformed msgpack in websocket request.
- CVE-2026-26304Permission Bypass in Playbook Run Creation
- CVE-2026-24692Guest users can bypass read permissions via search API
- CVE-2026-22545Password Change Bypass via Auth Switch Endpoint
- CVE-2026-2455SSRF bypass via IPv4-mapped IPv6 literals
- CVE-2026-21386Private channel enumeration via /mute slash command
- CVE-2026-25780Memory Exhaustion via Malformed DOC File Upload
- CVE-2026-4265Guest user can upload files without permission across teams
- CVE-2026-25783Denial of service via malformed User-Agent header in getBrowserVersion
- CVE-2026-24458DoS attack via login attempts with multi-megabyte passwords
- CVE-2026-2462Admin RCE via Malicious Plugin Upload on CI Test Instances
- CVE-2026-2578Information Disclosure via WebSocket Event When Deleting Unrevealed Burn on Read Posts
- CVE-2026-26246Memory Exhaustion via Malformed PSD File Upload
- CVE-2026-2458Unauthorized channel enumeration in private teams after member removal
- CVE-2026-2457WebSocket Message Spoofing via Permalink Embed Manipulation
- CVE-2026-2461Missing authorization check allows unauthorized modification of other users' comments on a board
- CVE-2026-2463Unauthorized access to invite ID during team creation
- CVE-2026-2476MS Teams plugin sensitive config values not properly masked in support packets
- CVE-2026-2456Denial of Service via Unbounded Memory Allocation in Integration Actions
- CVE-2026-1628Mattermost allows external websites to open within the app, exposing preload functionality to non-trusted sites.
- CVE-2025-14573Team Admin Bypass of Invite Permissions via allow_open_invite Field
- CVE-2026-1046Arbitrary application execution via unvalidated server-controlled URLs in Help menu
- CVE-2025-14350Information disclosure via channel mentions in posts
- CVE-2025-13821User profile update exposes password hash and MFA secrets
- CVE-2026-0997Mattermost Zoom Plugin channel preference API lacks authorization checks
- CVE-2026-0998Mattermost Zoom Plugin allows unauthorized meeting creation and post modification via insufficient API access controls
- CVE-2026-0999Authentication bypass via userID login when email and username login are disabled
- CVE-2026-20796Time-of-check time-of-use vulnerability in common teams API