Exposure of Mattermost

Message boards
47
exposure score
1
sites use
0
exploited
6
critical

CVEs

480 results
CVE-2026-14344MEDIUMInconsistent authorization checks in Mattermost Boards endpointsEPSS 0.3%CVE-2026-14259MEDIUMBoard archive import bypasses team board creation permissionsEPSS 0.3%CVE-2026-6541MEDIUMUnscoped updates to other playbooks' metric configurationEPSS 0.3%CVE-2026-16046LOWMissing run-state validation on finished playbook runsEPSS 0.3%CVE-2025-0503LOWLeaked User IDs and Metadata of Deleted DMsEPSS 0.3%CVE-2025-1472MEDIUMUnauthorized View Access to Site Statistics and Team StatisticsEPSS 0.3%CVE-2024-47145LOWUnauthorized access on archived channels via file linksEPSS 0.3%CVE-2025-1792LOWImproper Access Control in Mattermost Channel Member APIEPSS 0.3%CVE-2026-4646MEDIUMInsufficient input validation in GitHub plugin API causes denial of serviceEPSS 0.3%CVE-2025-32093MEDIUMSyatem admin profile modification by delegated granular administration roleEPSS 0.2%CVE-2025-3227MEDIUMUnauthorized channel member management through playbook runsEPSS 0.2%CVE-2026-15754MEDIUMMissing per-channel team-scope check in ABAC access control policy unassign allows cross-team policy removalEPSS 0.2%CVE-2026-5755MEDIUMDenial of service via crafted TIFF file uploadEPSS 0.2%CVE-2024-23319LOWCSRF issue allows disconnecting a user's Jira connection through a simple post message (Jira Plugin)EPSS 0.2%CVE-2024-29215MEDIUMSlash commands run in channel without channel membership via playbook task commandsEPSS 0.2%CVE-2024-43813MEDIUMIDOR when marking read a user's channelEPSS 0.2%CVE-2025-27538LOWMFA Enforcement Bypass Allows Unauthorized Removal of MFA for Other UsersEPSS 0.2%CVE-2026-10103MEDIUMAuthenticated remote cluster can modify or delete posts it does not own in Mattermost Connected Workspaces shared channelsEPSS 0.2%CVE-2024-31859MEDIUMMember promoted to channel admin via playbooks run linking to channelEPSS 0.2%CVE-2026-4054MEDIUMSVG content served through Mattermost image proxy despite Content-Type restrictions causes client-side denial of serviceEPSS 0.2%