Vulnerabilities in Mattermost

489 results
Vexday analysis

Com 434 CVEs catalogadas e nenhuma entrada confirmada no catálogo CISA KEV, o Mattermost apresenta taxa de exploração ativa abaixo da média geral do catálogo, o que indica risco operacional imediato relativamente contido. No entanto, o volume de 60 vulnerabilidades surgidas nos últimos 90 dias merece atenção, sinalizando um ritmo elevado de descoberta recente. A falha mais comum é CWE-863 (autorização incorreta), padrão que tende a permitir acesso não autorizado a recursos e funcionalidades, e que exige revisão cuidadosa de controles de acesso nas implementações. A CVE mais perigosa atualmente identificada, CVE-2025-25279, registra escore EPSS de 0,2081 — o mais alto observado no portfólio — e, embora ainda sem exploração confirmada, deve ser priorizada dado o risco potencial de aproveitamento próximo.

CVE-2023-2784MEDIUMApps Framework allows install requests from regular members via an internal pathEPSS 0.3%CVE-2025-8402MEDIUMNil pointer dereference in bulk import crashes serverEPSS 0.3%CVE-2023-50333LOWLack of restriction to manage group names for freshly demoted guestsEPSS 0.3%CVE-2023-5331MEDIUMFile Information Leak via IDOR in file_id in Draft PostsEPSS 0.3%CVE-2026-8823LOWUser Manager can demote bot accounts to guest without bot-management permissionEPSS 0.3%CVE-2026-8074LOWImproper Permission Check Allows User Manager to Deactivate Bot AccountsEPSS 0.3%CVE-2023-1774MEDIUMUnauthorized email invite to a private channelEPSS 0.3%CVE-2023-6547LOWPlaybooks access/modification by removed team memberEPSS 0.3%CVE-2025-6226MEDIUMIDOR in CreatePost API allows for timeboxed message disclosureEPSS 0.3%CVE-2025-55035MEDIUMMattermost Desktop DoS when user has basic authentication server configuredEPSS 0.3%CVE-2024-24776LOW Incorrect Authorization leads to Channel Member Count LeakEPSS 0.3%CVE-2024-23488LOWFiles of archived channels accessible with the “Allow users to view archived channels” option disabledEPSS 0.3%CVE-2024-39772LOWSilent Desktop Screenshot CaptureEPSS 0.3%CVE-2025-3913MEDIUMTeam Privacy Settings Authorization Bypass in Mattermost ServerEPSS 0.3%CVE-2026-24661LOWUnbounded Request Body Read in MS Teams Plugin {{/changes}} Webhook EndpointEPSS 0.3%CVE-2024-21848LOWUsers maintain access to active call after being removed from a channelEPSS 0.3%CVE-2026-21388LOWUnbounded Request Body Read in MS Teams Plugin {{/lifecycle}} Webhook EndpointEPSS 0.3%CVE-2023-45316HIGHReflected client side path traversal leading to CSRF in PlaybooksEPSS 0.3%CVE-2025-14435MEDIUMApplication-Level DoS via infinite re-render loop in user profile handlingEPSS 0.3%CVE-2026-7387HIGHMattermost group syncable endpoints allow privilege escalation via scheme_adminEPSS 0.3%