Mattermost vulnerabilities
512 CVEs and advisories name Mattermost as an affected vendor, newest first. Follow it as a feed.
- CVE-2025-48731Unauthorized Subscription Edit to Confluence Space in Mattermost Confluence Plugin
- CVE-2025-44004Unauthenticated Channel Subscription Creation in Mattermost Confluence Plugin
- CVE-2025-44001Unauthorized Channel Subscription Read in Mattermost Confluence Plugin
- CVE-2025-6227Invite token is used as part of the secure communication
- CVE-2025-6233Arbitrary file read by system admin via path traversal
- CVE-2025-6226IDOR in CreatePost API allows for timeboxed message disclosure
- CVE-2025-47871Mattermost Playbooks exposes private channel metadata to unauthorized users via run metadata API
- CVE-2025-46702Mattermost Playbooks allows privilege escalation through improper access control in playbook run participant management
- CVE-2025-3228Unauthorized Guest user access to Playbook
- CVE-2025-3227Unauthorized channel member management through playbook runs
- CVE-2025-4981Path Traversal Leading to RCE by Any Authenticated Mattermost User
- CVE-2025-4128Mattermost Guest User Information Disclosure Vulnerability
- CVE-2025-4573LDAP Injection in Mattermost Enterprise Edition When Using Active Directory
- CVE-2025-3611Improper Access Control in Mattermost allows System Managers to view team details despite role restrictions
- CVE-2025-3230Bypass of System Admin User Deactivation Controls for Personal Access Tokens in Mattermost Server
- CVE-2025-2571Google OAuth Authentication Bypass for Converted Bot Accounts
- CVE-2025-1792Improper Access Control in Mattermost Channel Member API
- CVE-2025-3913Team Privacy Settings Authorization Bypass in Mattermost Server
- CVE-2025-2570System Admin Cannot Access Environment settings in System Console While System Manager Can
- CVE-2025-2527Improper access control to group information
- CVE-2025-3446Members Without Guest Invite Permissions Can Add Guests to Teams
- CVE-2025-31947Repeated LDAP login failures can lock an LDAP account
- CVE-2025-41423Unauthorized Playbooks Post Deletion in Mattermost Playbooks Plugin
- CVE-2025-35965DoS in Mattermost Playbooks via Excessive Task Actions
- CVE-2025-41395Webapp DoS via malicious retrospective post in Playbooks
- CVE-2025-2564Unauthorized View Access to Archived Channel Member Info
- CVE-2025-27936Webhook Secret Exposure via Timing attack in MSteams plugin
- CVE-2025-31363Data exfiltration via AI plugin Jira tool
- CVE-2025-27571Channel metadata visible in archived channels despite configuration setting
- CVE-2025-27538MFA Enforcement Bypass Allows Unauthorized Removal of MFA for Other Users