Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 671

Export CSV
CVE-2025-53857

Lack of Authorization on Get Channel Subscriptions for Autocomplete in Mattermost Confluence Plugin

Mattermost Confluence Plugin version <1.5.0 fails to check the access of the user to the channel which allows attackers to get channel subscription details without proper access to the channel via API call to the GET autocomplete/GetChannelSubscriptions endpoint.

CVSS 3.1 · 3.7 Low EPSS < 1% KEV · Not listed
Vendors
Mattermost
Products
Confluence Mattermost
CVE-2025-53514

Unexpected Input to Server Webhook endpoint Causes DoS in Mattermost Confluence Plugin

Mattermost Confluence Plugin version <1.5.0 fails to handle unexpected request body which allows attackers to crash the plugin via constant hit to server webhook endpoint with an invalid request body.

CVSS 3.1 · 5.9 Medium EPSS < 1% KEV · Not listed
Vendors
Mattermost
Products
Confluence Mattermost
CVE-2025-48731

Unauthorized Subscription Edit to Confluence Space in Mattermost Confluence Plugin

Mattermost Confluence Plugin version <1.5.0 fails to check the access of the user to the Confluence space which allows attackers to edit a subscription for a Confluence space the user does not have access for via edit subscription endpoint.

CVSS 3.1 · 6.4 Medium EPSS < 1% KEV · Not listed
Vendors
Mattermost
Products
Confluence Mattermost
CVE-2025-44004

Unauthenticated Channel Subscription Creation in Mattermost Confluence Plugin

Mattermost Confluence Plugin version <1.5.0 fails to check the authorization of the user to the Mattermost instance which allows attackers to create a channel subscription without proper authorization via API call to the create channel subscription endpoint.

CVSS 3.1 · 7.2 High EPSS < 1% KEV · Not listed
Vendors
Mattermost
Products
Confluence Mattermost
CVE-2025-52931

Unexpected input to Update Channel Subscription endpoint causes DoS in Mattermost Confluence Plugin

Mattermost Confluence Plugin version <1.5.0 fails to handle unexpected request body which allows attackers to crash the plugin via constant hit to update channel subscription endpoint with an invalid request body.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed
Vendors
Mattermost
Products
Confluence Mattermost
CVE-2025-44001

Unauthorized Channel Subscription Read in Mattermost Confluence Plugin

Mattermost Confluence Plugin version <1.5.0 fails to check the access of the user to the channel which allows attackers to get channel subscription details without proper access to the channel via API call to the Get Channel Subscriptions details endpoint.

CVSS 3.1 · 4 Medium EPSS < 1% KEV · Not listed
Vendors
Mattermost
Products
Confluence Mattermost
CVE-2025-49221

Unauthenticated Access to Channel Subscription in Mattermost Confluence Plugin

Mattermost Confluence Plugin version <1.5.0 fails to enforce authentication of the user to the Mattermost instance which allows unauthenticated attackers to access subscription details without via API call to GET subscription endpoint.

CVSS 3.1 · 3.7 Low EPSS < 1% KEV · Not listed
Vendors
Mattermost
Products
Confluence Mattermost
CVE-2024-11358

Insecure Android File Provider Paths

Mattermost Android Mobile Apps versions <=2.21.0 fail to properly configure file providers which allows an attacker with local access to access files via file provider.

CVSS 3.1 · 5.7 Medium EPSS < 1% KEV · Not listed
Vendors
Google Mattermost
Products
Android Mattermost Mattermost Mobile
CVE-2025-0476

Mobile crash via file with specially crafted filename

Mattermost Mobile Apps versions <=2.22.0 fail to properly handle specially crafted attachment names, which allows an attacker to crash the mobile app for any user who opened a channel containing the specially crafted attachment

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed
Vendors
Mattermost
Products
Mattermost Mobile
CVE-2025-20072

Mobile crash via improper validation of proto style in attachments

Mattermost Mobile versions <= 2.22.0 fail to properly validate the style of proto supplied to an action's style in post.props.attachments, which allows an attacker to crash the mobile via crafted malicious input.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed
Vendors
Mattermost
Products
Mattermost Mattermost Mobile
CVE-2025-20630

Mobile crash via object that can't be cast to String in Attachment Field

Mattermost Mobile versions <=2.22.0 fail to properly handle posts with attachments containing fields that cannot be cast to a String, which allows an attacker to cause the mobile to crash via creating and sending such a post to a channel.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed
Vendors
Mattermost
Products
Mattermost Mobile
CVE-2025-30516

Unauthorized Notification Exposure in Mobile App Under Specific Conditions

Mattermost Mobile Apps versions <=2.25.0  fail to terminate sessions during logout under certain conditions (e.g. poor connectivity), allowing unauthorized users on shared devices to access sensitive notification content via continued mobile notifications

CVSS 3.1 · 2 Low EPSS < 1% KEV · Not listed
Vendors
Mattermost
Products
Mattermost Mobile
CVE-2025-54463

Unexpected Input to Cloud Webhook endpoint Causes DoS in Mattermost Confluence Plugin

Mattermost Confluence Plugin version <1.5.0 fails to handle unexpected request body which allows attackers to crash the plugin via constant hit to server webhook endpoint with an invalid request body.

CVSS 3.1 · 5.9 Medium EPSS < 1% KEV · Not listed
Vendors
Mattermost
Products
Confluence Mattermost
CVE-2025-54478

Unauthenticated Channel Subscription Edit in Mattermost Confluence Plugin

Mattermost Confluence Plugin version <1.5.0 fails to enforce authentication of the user to the Mattermost instance which allows unauthenticated attackers to edit channel subscriptions via API call to the edit channel subscription endpoint.

CVSS 3.1 · 7.2 High EPSS < 1% KEV · Not listed
Vendors
Mattermost
Products
Confluence Mattermost
CVE-2025-54525

Unexpected input to Create Channel Subscription endpoint causes DoS in Mattermost Confluence Plugin

Mattermost Confluence Plugin version <1.5.0 fails to handle unexpected request body which allows attackers to crash the plugin via constant hit to create channel subscription endpoint with an invalid request body.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed
Vendors
Mattermost
Products
Confluence Mattermost
CVE-2025-8285

Unauthorized Channel Subscription Creation in Mattermost Confluence Plugin

Mattermost Confluence Plugin version <1.5.0 fails to check the access of the user to the channel which allows attackers to create channel subscription without proper access to the channel via API call to the create channel subscription endpoint.

CVSS 3.1 · 4 Medium EPSS < 1% KEV · Not listed
Vendors
Mattermost
Products
Confluence Mattermost
CVE-2025-9076

Mattermost Server exposes sensitive user credentials during shared channel membership synchronization

Mattermost versions 10.10.x <= 10.10.1 fail to properly sanitize user data during shared channel membership synchronization, which allows malicious or compromised remote clusters to access sensitive user information via unsanitized user objects. This vulnerability affects Mattermost Server instances with shared channels enabled.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed
Vendors
Mattermost
Products
Mattermost Mattermost Server
CVE-2025-9072

One-Click Mattermost Account Takeover via Poisoned RelayState SAML Parameter

Mattermost versions 10.10.x <= 10.10.1, 10.5.x <= 10.5.9, 10.9.x <= 10.9.4 fail to validate the redirect_to parameter, allowing an attacker to craft a malicious link that, once a user authenticates with their SAML provider, could post the user’s cookies to an attacker-controlled URL.

CVSS 3.1 · 7.6 High EPSS < 1% KEV · Not listed
Vendors
Mattermost
Products
Mattermost Mattermost Server
CVE-2025-9084

Open redirect in OAuth login

Mattermost versions 10.5.x <= 10.5.9 fail to properly validate redirect URLs which allows attackers to redirect users to malicious sites via crafted OAuth login URLs

CVSS 3.1 · 3.1 Low EPSS < 1% KEV · Not listed
Vendors
Mattermost
Products
Mattermost Mattermost Server
CVE-2025-9078

Weak cache keys lead to post IDOR and link preview poisoning

Mattermost versions 10.8.x <= 10.8.3, 10.5.x <= 10.5.8, 9.11.x <= 9.11.17, 10.10.x <= 10.10.1, 10.9.x <= 10.9.3 fail to properly validate cache keys for link metadata which allows authenticated users to access unauthorized posts and poison link previews via hash collision attacks on FNV-1 hashing

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed
Vendors
Mattermost
Products
Mattermost Mattermost Server