Exposure of Mattermost

Message boards
47
exposure score
1
sites use
0
exploited
6
critical

CVEs

480 results
CVE-2026-6046MEDIUMPlugin bot username conflict allows user account to be used as bot identity in Mattermost ServerEPSS 0.2%CVE-2024-36287LOWBypass of TCC restrictions on macOSEPSS 0.2%CVE-2025-14350MEDIUMInformation disclosure via channel mentions in postsEPSS 0.2%CVE-2026-2476HIGHMS Teams plugin sensitive config values not properly masked in support packetsEPSS 0.2%CVE-2026-6517MEDIUMMattermost Desktop App fails to restrict the allow list of domains which NTLM credentials are passedEPSS 0.2%CVE-2026-3471MEDIUMOpening a window with {{javascript:alert()}} as URL causes crash in the Mattermost Desktop AppEPSS 0.2%CVE-2026-3636MEDIUMSanitize team member data returned by APIEPSS 0.2%CVE-2025-14573LOWTeam Admin Bypass of Invite Permissions via allow_open_invite FieldEPSS 0.2%CVE-2024-36255MEDIUMPost actions can run playbook checklist task commandsEPSS 0.2%CVE-2026-27656MEDIUMAccount Takeover via Substring Matching in OpenID Connect AuthenticationEPSS 0.2%CVE-2025-55074LOWChannel member objects leak read statusEPSS 0.2%CVE-2025-41436LOWUnauthorized access to archived channel content via threads interfaceEPSS 0.2%CVE-2026-18560MEDIUMImproper order of authorisations in Mattermost GetFile API leads to an authenticated user to determine a post’s quarantined statusEPSS 0.2%CVE-2026-19603MEDIUMPrivate channel ID disclosure via user status endpointsEPSS 0.2%CVE-2026-3433MEDIUMMattermost fails to scope role_updated websocket events to authorized team and channel membersEPSS 0.2%CVE-2026-0998MEDIUMMattermost Zoom Plugin allows unauthorized meeting creation and post modification via insufficient API access controlsEPSS 0.2%CVE-2026-2463MEDIUMUnauthorized access to invite ID during team creationEPSS 0.2%CVE-2026-0997MEDIUMMattermost Zoom Plugin channel preference API lacks authorization checksEPSS 0.2%CVE-2025-9072HIGHOne-Click Mattermost Account Takeover via Poisoned RelayState SAML ParameterEPSS 0.2%CVE-2025-64641MEDIUMMattermost Jira plugin crafted action leaks Jira issue detailsEPSS 0.2%