Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 507

Export CSV
CVE-2026-93847

Improper post type validation on scheduled post endpoints

Mattermost versions 11.7.x <= 11.7.10 fail to validate reserved system post types on the scheduled post creation and publication paths which allows an authenticated channel member to publish messages rendering as trusted system events via the scheduled post endpoint.. Mattermost Advisory ID: MMSA-2026-00732

CVSS 3.1 · 3.5 Low EPSS < 1% KEV · Not listed
Vendors
Mattermost
Products
Mattermost Mattermost Server
CVE-2026-93850

Unbounded memory consumption during PDF text extraction

Mattermost versions 11.9.x <= 11.9.1, 11.8.x <= 11.8.5, 11.7.x <= 11.7.10, 11.10.x <= 11.10.1 fail to bind the volume of text extracted from an uploaded PDF which allows an authenticated user to exhaust server memory and cause a denial of service via a crafted PDF whose compressed content stream expands into a very large amount of text.. Mattermost Advisory ID: MMSA-2026-00769

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed
Vendors
Mattermost
Products
Mattermost Mattermost Server
CVE-2026-93849

Mattermost allows authenticated users to trigger excessive memory allocation via crafted msgpack binary WebSocket frames

Mattermost versions 11.9.x <= 11.9.1, 11.8.x <= 11.8.5, 11.7.x <= 11.7.10, 11.10.x <= 11.10.1 Mattermost fail to apply allocation limits to the byte-string decode paths in its WebSocket msgpack decoder, which allows an authenticated remote attacker to cause excessive server memory allocation via a crafted binary WebSocket frame declaring a Bin32 payload length of up to 4,294,967,295 bytes.. Mattermost Advisory ID: MMSA-2026-00768

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed
Vendors
Mattermost
Products
Mattermost Mattermost Server
CVE-2026-93848

Mattermost OpenID discovery endpoint request bypasses outbound connection filtering, allowing SSRF by a System Administrator

Mattermost versions 11.7.x <= 11.7.10 fail to apply outbound internal-connection filtering to the OpenID discovery endpoint request which allows a System Administrator to determine whether internal addresses and ports are reachable from the server via an unauthenticated login request that triggers the discovery fetch.. Mattermost Advisory ID: MMSA-2026-00774

CVSS 3.1 · 2.7 Low EPSS < 1% KEV · Not listed
Vendors
Mattermost
Products
Mattermost Mattermost Server
CVE-2026-13411

Null condition in Playbooks import crashes the plugin

Mattermost versions 11.7.x <= 11.7.11 fail to validate null elements when decoding playbook import conditions which allows an authenticated attacker to crash the Playbooks plugin instance-wide via a crafted import request containing a null condition. Mattermost Advisory ID: MMSA-2026-00709

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed
Vendors
Mattermost
Products
Mattermost Mattermost Server
CVE-2026-19603

Private channel ID disclosure via user status endpoints

Mattermost versions 11.9.x <= 11.9.1, 11.8.x <= 11.8.5, 11.7.x <= 11.7.10, 11.10.x <= 11.10.1 fail to sanitize the active channel field returned by the user status API endpoints, which allows an authenticated user to learn the channel ID of a private channel another user is actively viewing via the status endpoints, without being a member of that channel. Mattermost Advisory ID: MMSA-2026-00765

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed
Vendors
Mattermost
Products
Mattermost Mattermost Server
CVE-2026-19867

Uncapped mention keys in user notification properties allow CPU exhaustion during post processing

Mattermost versions 11.10.x <= 11.10.0, 11.9.x <= 11.9.1, 11.8.x <= 11.8.5, 11.7.x <= 11.7.10 fail to cap the number and size of mention keys stored in a user's notification properties, and to bound the quadratic multibyte-keyword matching performed for each post, which allows an authenticated user to degrade post-processing latency and consume excessive CPU on behalf of other members of any channel they share via storing an oversized notify_props.mention_keys list on their own profile.. Mattermost Advisory ID: MMSA-2026-00773

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed
Vendors
Mattermost
Products
Mattermost Mattermost Server
CVE-2026-16251

Mattermost local image proxy allows server memory exhaustion via unbounded image response buffering

Mattermost versions 11.10.x <= 11.10.0, 11.7.x <= 11.7.9, 11.9.x <= 11.9.1, 11.8.x <= 11.8.5 fail to limit the size of remote image responses buffered in memory during local image proxy direct fetches, which allows a remote attacker to cause memory exhaustion on the server via a crafted oversized image response.. Mattermost Advisory ID: MMSA-2026-00726

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed
Vendors
Mattermost
Products
Mattermost Mattermost Server
CVE-2026-19601

Disclosure of AD/LDAP bind password via Test Connection

Mattermost versions 11.9.x <= 11.9.1, 11.8.x <= 11.8.5, 11.7.x <= 11.7.10, 11.10.x <= 11.10.1 fail to invalidate the stored AD/LDAP bind password when other connection settings (such as the server address) are changed, which allows a System Console administrator to disclose the plaintext bind password to an attacker-controlled server via the Test Connection / diagnostics feature. Mattermost Advisory ID: MMSA-2026-00764

CVSS 3.1 · 4.9 Medium EPSS < 1% KEV · Not listed
Vendors
Mattermost
Products
Mattermost Mattermost Server
CVE-2026-19541

Outgoing OAuth connection client secret exposure during connection validation

Mattermost versions 11.9.x <= 11.9.1, 11.8.x <= 11.8.5, 11.7.x <= 11.7.10, 11.10.x <= 11.10.1 fail to require re-entry of the stored client secret when validating an outgoing OAuth connection, which allows an authenticated user with permission to manage outgoing OAuth connections to obtain the secret via pointing the token URL at an attacker-controlled endpoint and triggering validation.. Mattermost Advisory ID: MMSA-2026-00761

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed
Vendors
Mattermost
Products
Mattermost Mattermost Server
CVE-2026-18795

Missing server side validation allowed user to quarantine a DM and GM post

Mattermost versions 11.10.x <= 11.10.0, 11.7.x <= 11.7.9, 11.9.x <= 11.9.1, 11.8.x <= 11.8.5 fail to enforce DM/GM check on server side which allows an authenticated user to quarantine a post belonging to DM or GM via direct API call.. Mattermost Advisory ID: MMSA-2026-00756

CVSS 3.1 · 6.4 Medium EPSS < 1% KEV · Not listed
Vendors
Mattermost
Products
Mattermost Mattermost Server
CVE-2026-16453

Mattermost SAML RelayState forgery allows unauthorized team membership

Mattermost versions 11.10.x <= 11.10.0, 11.7.x <= 11.7.9, 11.9.x <= 11.9.1, 11.8.x <= 11.8.5 fail to verify the integrity of the SAML RelayState POST parameter which allows an authenticated SAML user to join any team, including invite-only teams, via forging the team_id or invite_id fields in the RelayState.. Mattermost Advisory ID: MMSA-2026-00727

CVSS 3.1 · 7.1 High EPSS < 1% KEV · Not listed
Vendors
Mattermost
Products
Mattermost Mattermost Server
CVE-2026-18223

Mattermost invitation tokens not bound to invited email address allowing unauthorized team and private channel access

Mattermost versions 11.10.x <= 11.10.0, 11.7.x <= 11.7.9, 11.9.x <= 11.9.1, 11.8.x <= 11.8.5 fail to validate the invited recipient's email address when redeeming team and guest invitation tokens, which allows an authenticated attacker to join a team or gain unauthorized access to private channels via a forwarded or leaked invitation link.. Mattermost Advisory ID: MMSA-2026-00747

CVSS 3.1 · 5 Medium EPSS < 1% KEV · Not listed
Vendors
Mattermost
Products
Mattermost Mattermost Server
CVE-2026-18256

Private team metadata disclosure via the team search API

Mattermost versions 11.10.x <= 11.10.0, 11.7.x <= 11.7.9, 11.9.x <= 11.9.1, 11.8.x <= 11.8.5 fail to properly restrict private teams from public team search results, which allows an authenticated user without permission to list private teams to disclose the ID, name, and display name of private teams via a modified team search request. Mattermost Advisory ID: MMSA-2026-00748

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed
Vendors
Mattermost
Products
Mattermost Mattermost Server
CVE-2026-18560

Improper order of authorisations in Mattermost GetFile API leads to an authenticated user to determine a post’s quarantined status

Mattermost versions 11.10.x <= 11.10.0, 11.7.x <= 11.7.9, 11.9.x <= 11.9.1, 11.8.x <= 11.8.5 fail to validate user’s permissions before other validations which allows non-content reviewers to infer a post’s flagged status via direct API call.. Mattermost Advisory ID: MMSA-2026-00754

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed
Vendors
Mattermost
Products
Mattermost Mattermost Server
CVE-2026-18799

Mattermost Server fails to restrict Slack import account binding, allowing team admins to forge posts as existing users

Mattermost versions 11.10.x <= 11.10.0, 11.7.x <= 11.7.9, 11.9.x <= 11.9.1, 11.8.x <= 11.8.5 fail to restrict Slack import account binding to system administrator-initiated imports which allows an authenticated attacker with team admin privileges to force-add existing Mattermost users to their team and forge posts attributed to those users' identities via a crafted Slack export containing target users' email addresses.. Mattermost Advisory ID: MMSA-2026-00757

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed
Vendors
Mattermost
Products
Mattermost Mattermost Server
CVE-2026-18551

Mattermost guest account privilege escalation via member roles API

Mattermost versions 11.10.x <= 11.10.0, 11.7.x <= 11.7.9, 11.9.x <= 11.9.1, 11.8.x <= 11.8.5 fail to validate the combination of guest and admin scheme roles which allows an authenticated attacker to escalate a guest account to team or channel admin via a crafted PUT request to the member roles API endpoint.. Mattermost Advisory ID: MMSA-2026-00752

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed
Vendors
Mattermost
Products
Mattermost Mattermost Server
CVE-2026-19621

Mattermost leaks interactive-message integration secrets to non-admin users via post-deletion events and thread reads

Mattermost versions 11.10.x <= 11.10.0, 11.7.x <= 11.7.9, 11.9.x <= 11.9.1, 11.8.x <= 11.8.5 fail to strip action integration secrets from post payloads before broadcasting post-deletion web socket events and returning thread API responses, which allows an authenticated channel member to obtain server-side webhook URLs and authentication context from interactive-message posts via the post_deleted websocket event or the threads REST API.. Mattermost Advisory ID: MMSA-2026-00766

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed
Vendors
Mattermost
Products
Mattermost Mattermost Server
CVE-2026-19600

Mattermost logs plaintext authentication tokens in debug-level server logs on failed auth attempts

Mattermost versions 11.9.x <= 11.9.1, 11.8.x <= 11.8.5, 11.7.x <= 11.7.10, 11.10.x <= 11.10.1 fail to sanitize authentication tokens before writing them to server log entries, which allows an attacker with access to server logs to obtain valid session tokens or OAuth access tokens and impersonate authenticated users via the debug-level Mattermost server log.. Mattermost Advisory ID: MMSA-2026-00763

CVSS 3.1 · 4.5 Medium EPSS < 1% KEV · Not listed
Vendors
Mattermost
Products
Mattermost Mattermost Server
CVE-2026-19076

Mattermost fails to reject OAuth application sessions in account type switch, allowing account takeover via bearer token

Mattermost versions 11.10.x <= 11.10.0, 11.7.x <= 11.7.9, 11.9.x <= 11.9.1, 11.8.x <= 11.8.5 fail to reject OAuth application sessions in the account type switch endpoint, which allows an attacker with a valid OAuth bearer token for a target user to permanently take over that user's SSO-backed account by setting an attacker-controlled password and detaching the account from its identity provider via a crafted request to POST /api/v4/users/login/switch.. Mattermost Advisory ID: MMSA-2026-00758

CVSS 3.1 · 4.4 Medium EPSS < 1% KEV · Not listed
Vendors
Mattermost
Products
Mattermost Mattermost Server