Github.com/mattermost/mattermost-server

This hub aggregates every CVE we track for Github.com/mattermost/mattermost-server, a product in the oss libraries space. Use it to gauge the current risk picture and drill into individual advisories.

Severity distribution

Monthly trend

The 15 most recently published vulnerabilities affecting Github.com/mattermost/mattermost-server.

• CVE-2025-14573Team Admin Bypass of Invite Permissions via allow_open_invite Field3.8Feb 16, 2026
• CVE-2025-14350Information disclosure via channel mentions in posts4.3Feb 16, 2026
• CVE-2025-13821User profile update exposes password hash and MFA secrets5.7Feb 16, 2026
• CVE-2026-0999Authentication bypass via userID login when email and username login are disabled5.4Feb 16, 2026
• CVE-2026-20796Time-of-check time-of-use vulnerability in common teams API3.1Feb 13, 2026
• CVE-2026-22892Insufficient Authorization in Mattermost Jira Plugin Allows Unauthorized Access to Post Attachments4.3Feb 13, 2026
• CVE-2025-14435Application-Level DoS via infinite re-render loop in user profile handling6.8Jan 16, 2026
• CVE-2025-14822DoS from quadratic complexity in model.ParseHashtags3.1Jan 16, 2026
• CVE-2025-64641Mattermost Jira plugin crafted action leaks Jira issue details4.1Dec 24, 2025
• CVE-2025-13767Unauthorized Read Access to Private Channel Posts via Mattermost Jira Plugin4.3Dec 24, 2025
• CVE-2025-13324Lack of Invalidation of Legacy Remote Cluster Invite Tokens After Confirmation3.7Dec 17, 2025
• CVE-2025-12421Account Takeover via Code Exchange Endpoint9.9Nov 27, 2025
• CVE-2025-12559Information Disclosure in Common Teams API4.3Nov 27, 2025
• CVE-2025-12419Account takeover on OAuth/OpenID-enabled servers9.9Nov 27, 2025
• CVE-2025-55074Channel member objects leak read status3.0Nov 18, 2025