Github.com/mattermost/mattermost/server/v8

This hub aggregates every CVE we track for Github.com/mattermost/mattermost/server/v8, a product in the oss libraries space. Use it to gauge the current risk picture and drill into individual advisories.

Severity distribution

Monthly trend

The 15 most recently published vulnerabilities affecting Github.com/mattermost/mattermost/server/v8.

• CVE-2025-14573Team Admin Bypass of Invite Permissions via allow_open_invite Field3.8Feb 16, 2026
• CVE-2025-14350Information disclosure via channel mentions in posts4.3Feb 16, 2026
• CVE-2025-13821User profile update exposes password hash and MFA secrets5.7Feb 16, 2026
• CVE-2026-0999Authentication bypass via userID login when email and username login are disabled5.4Feb 16, 2026
• CVE-2025-64641Mattermost Jira plugin crafted action leaks Jira issue details4.1Dec 24, 2025
• CVE-2025-13767Unauthorized Read Access to Private Channel Posts via Mattermost Jira Plugin4.3Dec 24, 2025
• CVE-2025-14273Mattermost Jira plugin user spoofing enables Jira request forgery.7.2Dec 22, 2025
• CVE-2025-13324Lack of Invalidation of Legacy Remote Cluster Invite Tokens After Confirmation3.7Dec 17, 2025
• CVE-2025-62690Open redirect in error page when link opened in new tab3.1Dec 17, 2025
• CVE-2025-13352Mattermost GitHub Plugin allows unauthorized GitHub reactions via reaction forwarding hijacking3.0Dec 17, 2025
• CVE-2025-13870Unauthorized access and subscription vulnerability in Boards3.1Dec 2, 2025
• CVE-2025-12756Insecure Direct Object Reference in Mattermost Boards Plugin Enables Unauthorised Comment Deletion4.3Dec 1, 2025
• CVE-2025-12421Account Takeover via Code Exchange Endpoint9.9Nov 27, 2025
• CVE-2025-12559Information Disclosure in Common Teams API4.3Nov 27, 2025
• CVE-2025-12419Account takeover on OAuth/OpenID-enabled servers9.9Nov 27, 2025