CVE Tools
Track your stack

Mattermost

488 CVEs tracked. None of them is in CISA KEV.

This hub aggregates every CVE we track for Mattermost, a product in the devtools ci space. Use it to gauge the current risk picture and drill into individual advisories.

Mattermost CVEs per month

Dec 2024 to Nov 2026. Point at a month, or focus the strip and use the arrow keys.
Mattermost CVEs per month
MonthCVEs
2024-125
2025-0112
2025-026
2025-039
2025-0414
2025-059
2025-067
2025-073
2025-089
2025-096
2025-108
2025-1111
2025-1212
2026-012
2026-029
2026-0334
2026-046
2026-0536
2026-0618
2026-0715
2026-0814
2026-0922
2026-1023
2026-110

Severity

How the 488 CVEs score on CVSS. Severity is not exploitation: KEV is counted above.

  • Critical71%
  • High378%
  • Medium32366%
  • Low12125%

Latest CVEs

The 15 most recently published vulnerabilities affecting Mattermost.

  1. CVE-2026-93851Path traversal in Mattermost Agents plugin mention reminder allows plugin replacement via crafted post8.0
  2. CVE-2026-93846Team admin can escalate a team member's permissions via the team member roles endpoint3.8
  3. CVE-2026-93848Mattermost OpenID discovery endpoint request bypasses outbound connection filtering, allowing SSRF by a System Administrator2.7
  4. CVE-2026-93850Unbounded memory consumption during PDF text extraction6.5
  5. CVE-2026-93849Mattermost allows authenticated users to trigger excessive memory allocation via crafted msgpack binary WebSocket frames6.5
  6. CVE-2026-93847Improper post type validation on scheduled post endpoints3.5
  7. CVE-2026-116516Insufficient length validation when parsing Zoom chat transcriptions6.5
  8. CVE-2026-13411Null condition in Playbooks import crashes the plugin4.3
  9. CVE-2026-18799Mattermost Server fails to restrict Slack import account binding, allowing team admins to forge posts as existing users4.3
  10. CVE-2026-16251Mattermost local image proxy allows server memory exhaustion via unbounded image response buffering6.5
  11. CVE-2026-18256Private team metadata disclosure via the team search API4.3
  12. CVE-2026-18223Mattermost invitation tokens not bound to invited email address allowing unauthorized team and private channel access5.0
  13. CVE-2026-19076Mattermost fails to reject OAuth application sessions in account type switch, allowing account takeover via bearer token4.4
  14. CVE-2026-18560Improper order of authorisations in Mattermost GetFile API leads to an authenticated user to determine a post’s quarantined status4.3
  15. CVE-2026-16453Mattermost SAML RelayState forgery allows unauthorized team membership7.1

Product grouping is registry-driven, with AI assist and human review. How it works