Exposure of Mattermost

Message boards
47
exposure score
1
sites use
0
exploited
6
critical

CVEs

480 results
CVE-2023-3581MEDIUMWebSockets accept connections from HTTPS originEPSS 0.3%CVE-2024-39836MEDIUMMunged email address used for password resets and notificationsEPSS 0.3%CVE-2025-9076MEDIUMMattermost Server exposes sensitive user credentials during shared channel membership synchronizationEPSS 0.3%CVE-2026-16048MEDIUMChannel member roles accept out-of-scope rolesEPSS 0.3%CVE-2026-10527MEDIUMBoards plugin retains Board Admin rights for users demoted to System GuestEPSS 0.3%CVE-2026-1046HIGHArbitrary application execution via unvalidated server-controlled URLs in Help menuEPSS 0.3%CVE-2024-48872MEDIUMBypass of "Max failed attempts" restriction via race conditionEPSS 0.3%CVE-2024-34152MEDIUMPlaybook Run Metadata leak to GuestEPSS 0.3%CVE-2024-9155MEDIUMInsufficient Authorization On Unlinked Channel FilesEPSS 0.3%CVE-2024-36241LOW/playbook add slash command allows viewing arbitrary post contentsEPSS 0.3%CVE-2026-6739MEDIUMMattermost: Delegated admins could patch protected default system rolesEPSS 0.3%CVE-2025-1412LOWSession Persistence After User-to-Bot ConversionEPSS 0.3%CVE-2025-2424LOWLeaked Metadata of Deleted Files via Bookmark CreationEPSS 0.3%CVE-2026-7184MEDIUMMattermost Remote Cluster PATCH API Leaks Authentication TokensEPSS 0.3%CVE-2026-19621MEDIUMMattermost leaks interactive-message integration secrets to non-admin users via post-deletion events and thread readsEPSS 0.3%CVE-2026-82920MEDIUMMattermost ABAC parent policy bypass via policy update endpointEPSS 0.3%CVE-2026-96259MEDIUMMattermost server-side request forgery via OAuth endpoints configurable by a System AdministratorEPSS 0.3%CVE-2025-3446MEDIUMMembers Without Guest Invite Permissions Can Add Guests to TeamsEPSS 0.3%CVE-2026-9820LOWMattermost schemes teams endpoint exposes private team invite IDsEPSS 0.3%CVE-2026-5308MEDIUMMissing request body size limits on Zoom plugin HTTP endpointsEPSS 0.3%