Mattermost server
This hub aggregates every CVE we track for Mattermost server, a product in the communications space. Use it to gauge the current risk picture and drill into individual advisories.
455
CVEs tracked
17
Critical
63
High
0
In CISA KEV
Severity distribution
MEDIUM286LOW89HIGH63CRITICAL17
Monthly trend
5
4
4
4
7
6
7
13
9
7
3
9
6
6
10
10
2
8
32
4
32
15
13
0
2024-092026-08
Latest CVEs
The 15 most recently published vulnerabilities affecting Mattermost server.
- CVE-2026-7521SAML certificate deletion allows path traversal to delete arbitrary files outside the config directory5.5
- CVE-2026-10819Mattermost Server Denial of Service via Animated GIF Emoji Upload6.5
- CVE-2026-10600Denial of service via unbounded document content extraction in Mattermost Server4.3
- CVE-2026-6541Unscoped updates to other playbooks' metric configuration4.3
- CVE-2026-9820Mattermost schemes teams endpoint exposes private team invite IDs3.8
- CVE-2026-9824Remote cluster metadata enumeration via /share-channel autocomplete4.3
- CVE-2026-9597Deactivated guest accounts can authenticate via magic-link token in Mattermost REST API login endpoint5.4
- CVE-2026-6850Crafted message attachment causes client-side denial of service via markdown parser regex backtracking in Mattermost6.5
- CVE-2026-10106Unauthorized users can trigger interactive post actions in private channels via action cookie channel mismatch in Mattermost6.5
- CVE-2026-10085Ordinary group/direct message member can enable group_constrained and remove all channel participants5.4
- CVE-2026-9708Incoming webhook user attribution via unvalidated webhook owner4.9
- CVE-2026-10103Authenticated remote cluster can modify or delete posts it does not own in Mattermost Connected Workspaces shared channels4.3
- CVE-2026-9571Deactivated user accounts can continue to obtain valid OAuth access tokens via refresh token grant in Mattermost5.9
- CVE-2026-4339SSRF via unvalidated attachment URLs in Mattermost Agents plugin MCP server6.5
- CVE-2026-3472Markdown image rendering bypass in AI bot tool result posts in Mattermost3.5
Product normalization is registry-driven with AI assist and human review. How it works