Exposure of Mattermost

Message boards
47
exposure score
1
sites use
0
exploited
6
critical

CVEs

480 results
CVE-2026-3117MEDIUMInstance and webhook GitLab plugin commands were able to be run by non-admin usersEPSS 0.2%CVE-2025-3230MEDIUMBypass of System Admin User Deactivation Controls for Personal Access Tokens in Mattermost ServerEPSS 0.2%CVE-2025-24839LOWUnauthorized AI bot activation via Wrangler pluginEPSS 0.2%CVE-2026-19541MEDIUMOutgoing OAuth connection client secret exposure during connection validationEPSS 0.2%CVE-2026-75588LOWMattermost Desktop App plugin popout scheme validation bypassEPSS 0.2%CVE-2024-2447MEDIUMMattermost versions 8.1.x before 8.1.11, 9.3.x before 9.3.3, 9.4.x before 9.4.4, and 9.5.x before 9.5.2 fail to authenticate the source of cEPSS 0.2%CVE-2026-18551MEDIUMMattermost guest account privilege escalation via member roles APIEPSS 0.2%CVE-2025-4128LOWMattermost Guest User Information Disclosure VulnerabilityEPSS 0.2%CVE-2024-42406MEDIUMUnauthorized access on archived channelsEPSS 0.2%CVE-2024-32939MEDIUMEmail addresses of remote users visible in props regardless of server settingsEPSS 0.2%CVE-2025-47870MEDIUMTeam invite ID leaked to team admin with no member invite privilegesEPSS 0.2%CVE-2026-20796LOWTime-of-check time-of-use vulnerability in common teams APIEPSS 0.2%CVE-2026-19867MEDIUMUncapped mention keys in user notification properties allow CPU exhaustion during post processingEPSS 0.2%CVE-2025-27715LOWAuto-Enrollment of Team Admins into Private Channels without explicit consentEPSS 0.2%CVE-2025-46702MEDIUMMattermost Playbooks allows privilege escalation through improper access control in playbook run participant managementEPSS 0.2%CVE-2025-6227LOWInvite token is used as part of the secure communicationEPSS 0.2%CVE-2024-45843LOWWeak SSRF FilteringEPSS 0.2%CVE-2025-2571MEDIUMGoogle OAuth Authentication Bypass for Converted Bot AccountsEPSS 0.2%CVE-2024-36250LOWMFA Code ReplayEPSS 0.2%CVE-2025-27933MEDIUMUnauthorized Private-to-Public Channel ConversionEPSS 0.2%