Mattermost vulnerabilities
512 CVEs and advisories name Mattermost as an affected vendor, newest first. Follow it as a feed.
- CVE-2026-22892Insufficient Authorization in Mattermost Jira Plugin Allows Unauthorized Access to Post Attachments
- CVE-2025-13523Cross-Site Scripting (XSS) via Unescaped Display Names in Mattermost Confluence Plugin OAuth2 Flow
- CVE-2025-14435Application-Level DoS via infinite re-render loop in user profile handling
- CVE-2025-14822DoS from quadratic complexity in model.ParseHashtags
- CVE-2025-64641Mattermost Jira plugin crafted action leaks Jira issue details
- CVE-2025-13767Unauthorized Read Access to Private Channel Posts via Mattermost Jira Plugin
- CVE-2025-14273Mattermost Jira plugin user spoofing enables Jira request forgery.
- CVE-2025-13326Mattermost Desktop App fails to enable Hardened Runtime when packaged for Mac App Store
- CVE-2025-13324Lack of Invalidation of Legacy Remote Cluster Invite Tokens After Confirmation
- CVE-2025-13321Mattermost Desktop App logging sensitive information and fails to clear data on server deletion
- CVE-2025-12689DoS in Calls plugin via malformed UTF-8 in WebSocket request
- CVE-2025-62690Open redirect in error page when link opened in new tab
- CVE-2025-13352Mattermost GitHub Plugin allows unauthorized GitHub reactions via reaction forwarding hijacking
- CVE-2025-62190CSRF Allows Call Initiation and Message Delivery
- CVE-2025-13870Unauthorized access and subscription vulnerability in Boards
- CVE-2025-12756Insecure Direct Object Reference in Mattermost Boards Plugin Enables Unauthorised Comment Deletion
- CVE-2025-12421Account Takeover via Code Exchange Endpoint
- CVE-2025-12559Information Disclosure in Common Teams API
- CVE-2025-12419Account takeover on OAuth/OpenID-enabled servers
- CVE-2025-55074Channel member objects leak read status
- CVE-2025-11794Password hash and MFA secret returned in user email verification endpoint
- CVE-2025-55073MS Teams plugin OAuth allows editing arbitrary posts
- CVE-2025-55070Lack of MFA enforcement in WebSocket connections
- CVE-2025-41436Unauthorized access to archived channel content via threads interface
- CVE-2025-11776Guest user can discover archived public channels
- CVE-2025-59480Inadequate validation of SSO redirect credentials permits credential theft
- CVE-2025-11777Cross-team channel membership access
- CVE-2025-55035Mattermost Desktop DoS when user has basic authentication server configured
- CVE-2025-58073Arbitrary Mattermost Team can be joined by manipulating the OAuth state
- CVE-2025-41410Slack import bypasses email verification for team access controls