CVE-2025-35965

DoS in Mattermost Playbooks via Excessive Task Actions

Mattermost versions 10.4.x <= 10.4.2, 10.5.x <= 10.5.0, 9.11.x <= 9.11.10 fail to validate the uniqueness and quantity of task actions within the UpdateRunTaskActions GraphQL operation, which allows an attacker to create task items containing an excessive number of actions triggered by specific posts, overloading the server and leading to a denial-of-service (DoS) condition.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed

Vendors

Mattermost

Products

Mattermost Mattermost Server

CVE-2025-41423

Unauthorized Playbooks Post Deletion in Mattermost Playbooks Plugin

Mattermost versions 10.4.x <= 10.4.2, 10.5.x <= 10.5.0, 9.11.x <= 9.11.10 fail to properly validate permissions for the API endpoint /plugins/playbooks/api/v0/signal/keywords/ignore-thread, allowing any user or attacker to delete posts containing actions created by the Playbooks bot, even without channel access or appropriate permissions.

CVSS 3.1 · 3.1 Low EPSS < 1% KEV · Not listed

Vendors

Mattermost

Products

Mattermost Server Playbooks

CVE-2025-3446

Members Without Guest Invite Permissions Can Add Guests to Teams

Mattermost versions 10.6.x <= 10.6.1, 10.5.x <= 10.5.2, 10.4.x <= 10.4.4, 9.11.x <= 9.11.11 fail to check the correct permissions which allows authenticated users who only have permission to invite non-guest users to a team to add guest users to that team via the API to add a single user to a team.

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed

Vendors

Mattermost

Products

Mattermost Mattermost Server

CVE-2025-0503

Leaked User IDs and Metadata of Deleted DMs

Mattermost versions 9.11.x <= 9.11.6 fail to filter out DMs from the deleted channels endpoint which allows an attacker to infer user IDs and other metadata from deleted DMs if someone had manually marked DMs as deleted in the database.

CVSS 3.1 · 3.1 Low EPSS < 1% KEV · Not listed

Vendors

Mattermost

Products

Mattermost Mattermost Server

CVE-2025-22449

Access control flaw for team admins allows unauthorized team additions

Mattermost versions 9.11.x <= 9.11.5 fail to enforce invite permissions, which allows team admins, with no permission to invite users to their team, to invite users by updating the "allow_open_invite" field via making their team public.

CVSS 3.1 · 3.8 Low EPSS < 1% KEV · Not listed

Vendors

Mattermost

Products

Mattermost Mattermost Server

CVE-2024-50052

Arbitrary post deletion via Playbooks /ignore-thread endpoint

Mattermost versions 9.10.x <= 9.10.2, 9.11.x <= 9.11.1, 9.5.x <= 9.5.9 fail to check that the origin of the message in an integration action matches with the original post metadata which allows an authenticated user to delete an arbitrary post.

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed

Vendors

Mattermost

Products

Mattermost Mattermost Server

CVE-2024-47401

DoS via Amplified GraphQL Response in Playbooks

Mattermost versions 9.10.x <= 9.10.2, 9.11.x <= 9.11.1 and 9.5.x <= 9.5.9 fail to prevent detailed error messages from being displayed in Playbooks which allows an attacker to generate a large response and cause an amplified GraphQL response which in turn could cause the application to crash by sending a specially crafted request to Playbooks.

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed

Vendors

Mattermost

Products

Mattermost Mattermost Server

CVE-2024-9155

Insufficient Authorization On Unlinked Channel Files

Mattermost versions 9.10.x <= 9.10.1, 9.9.x <= 9.9.2, 9.5.x <= 9.5.8 fail to limit access to channels files that have not been linked to a post which allows an attacker to view them in channels that they are a member of.

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed

Vendors

Mattermost

Products

Mattermost Mattermost Server

CVE-2025-9081

IDOR in board file download allows any user to download any file by UUID

Mattermost versions 10.5.x <= 10.5.8, 9.11.x <= 9.11.17 fail to properly validate access controls which allows any authenticated user to download sensitive files via board file download endpoint using UUID enumeration

CVSS 3.1 · 3.1 Low EPSS < 1% KEV · Not listed

Vendors

Mattermost

Products

Mattermost Mattermost Server

CVE-2025-54458

Unauthorized Subscription Creation to Confluence Space in Mattermost Confluence Plugin

Mattermost Confluence Plugin version <1.5.0 fails to check the access of the user to the Confluence space which allows attackers to create a subscription for a Confluence space the user does not have access to via the create subscription endpoint.

CVSS 3.1 · 5 Medium EPSS < 1% KEV · Not listed

Vendors

Mattermost

Products

Confluence Mattermost

CVE-2025-1558

Denial of Service Via Malicious GIF

Mattermost Mobile Apps versions <=2.25.0 fail to properly validate GIF images prior to rendering which allows a malicious user to cause the Android application to crash via message containing a maliciously crafted GIF.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed

Vendors

Mattermost

Products

Mattermost Mobile

CVE-2025-1398

macOS TCC Bypass via Code Injection

Mattermost Desktop App versions <=5.10.0 explicitly declared unnecessary macOS entitlements which allows an attacker with remote access to bypass Transparency, Consent, and Control (TCC) via code injection.

CVSS 3.1 · 3.3 Low EPSS < 1% KEV · Not listed

Vendors

Apple Mattermost

Products

Macos Mattermost Mattermost Desktop

CVE-2025-21083

Insufficient Input Validation on Post Props

Mattermost Mobile Apps versions <=2.22.0 fail to properly validate post props which allows a malicious authenticated user to cause a crash via a malicious post.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed

Vendors

Mattermost

Products

Mattermost Mobile

CVE-2025-20036

Insufficient Input Validation on Post Props

Mattermost Mobile Apps versions <=2.22.0 fail to properly validate post props which allows a malicious authenticated user to cause a crash via a malicious post.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed

Vendors

Mattermost

Products

Mattermost Mobile

CVE-2025-53910

Unauthorized Channel Subscription Edit in Mattermost Confluence Plugin

Mattermost Confluence Plugin version <1.5.0 fails to check the access of the user to the channel which allows attackers to create a channel subscription without proper access to the channel via API call to the edit channel subscription endpoint.

CVSS 3.1 · 4 Medium EPSS < 1% KEV · Not listed

Vendors

Mattermost

Products

Confluence Mattermost

CVE-2025-53857

Lack of Authorization on Get Channel Subscriptions for Autocomplete in Mattermost Confluence Plugin

Mattermost Confluence Plugin version <1.5.0 fails to check the access of the user to the channel which allows attackers to get channel subscription details without proper access to the channel via API call to the GET autocomplete/GetChannelSubscriptions endpoint.

CVSS 3.1 · 3.7 Low EPSS < 1% KEV · Not listed

Vendors

Mattermost

Products

Confluence Mattermost

CVE-2025-53514

Unexpected Input to Server Webhook endpoint Causes DoS in Mattermost Confluence Plugin

Mattermost Confluence Plugin version <1.5.0 fails to handle unexpected request body which allows attackers to crash the plugin via constant hit to server webhook endpoint with an invalid request body.

CVSS 3.1 · 5.9 Medium EPSS < 1% KEV · Not listed

Vendors

Mattermost

Products

Confluence Mattermost

CVE-2025-48731

Unauthorized Subscription Edit to Confluence Space in Mattermost Confluence Plugin

Mattermost Confluence Plugin version <1.5.0 fails to check the access of the user to the Confluence space which allows attackers to edit a subscription for a Confluence space the user does not have access for via edit subscription endpoint.

CVSS 3.1 · 6.4 Medium EPSS < 1% KEV · Not listed

Vendors

Mattermost

Products

Confluence Mattermost

CVE-2025-44004

Unauthenticated Channel Subscription Creation in Mattermost Confluence Plugin

Mattermost Confluence Plugin version <1.5.0 fails to check the authorization of the user to the Mattermost instance which allows attackers to create a channel subscription without proper authorization via API call to the create channel subscription endpoint.

CVSS 3.1 · 7.2 High EPSS < 1% KEV · Not listed

Vendors

Mattermost

Products

Confluence Mattermost

CVE-2025-52931

Unexpected input to Update Channel Subscription endpoint causes DoS in Mattermost Confluence Plugin

Mattermost Confluence Plugin version <1.5.0 fails to handle unexpected request body which allows attackers to crash the plugin via constant hit to update channel subscription endpoint with an invalid request body.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed

Vendors

Mattermost

Products

Confluence Mattermost