Vulnerabilities in Mattermost

489 results
Vexday analysis

Com 434 CVEs catalogadas e nenhuma entrada confirmada no catálogo CISA KEV, o Mattermost apresenta taxa de exploração ativa abaixo da média geral do catálogo, o que indica risco operacional imediato relativamente contido. No entanto, o volume de 60 vulnerabilidades surgidas nos últimos 90 dias merece atenção, sinalizando um ritmo elevado de descoberta recente. A falha mais comum é CWE-863 (autorização incorreta), padrão que tende a permitir acesso não autorizado a recursos e funcionalidades, e que exige revisão cuidadosa de controles de acesso nas implementações. A CVE mais perigosa atualmente identificada, CVE-2025-25279, registra escore EPSS de 0,2081 — o mais alto observado no portfólio — e, embora ainda sem exploração confirmada, deve ser priorizada dado o risco potencial de aproveitamento próximo.

CVE-2026-7521MEDIUMSAML certificate deletion allows path traversal to delete arbitrary files outside the config directoryEPSS 0.3%CVE-2025-53514MEDIUMUnexpected Input to Server Webhook endpoint Causes DoS in Mattermost Confluence PluginEPSS 0.3%CVE-2024-5272MEDIUMRun Details leak to guest via webhook event "custom_playbooks_playbook_run_updated"EPSS 0.3%CVE-2026-12985MEDIUMMattermost DCR redirect URI allowlist bypass via improper URL component validationEPSS 0.3%CVE-2025-2564MEDIUMUnauthorized View Access to Archived Channel Member InfoEPSS 0.3%CVE-2023-3586MEDIUM Disabling publicly-shared boards does not disable existing publicly available board linksEPSS 0.3%CVE-2025-11794MEDIUMPassword hash and MFA secret returned in user email verification endpointEPSS 0.3%CVE-2026-3108HIGHTerminal Escape Injection in mmctl Report Posts CommandEPSS 0.3%CVE-2025-22449LOWAccess control flaw for team admins allows unauthorized team additionsEPSS 0.3%CVE-2024-43780MEDIUMUnauthorized channel file uploadEPSS 0.3%CVE-2024-50052MEDIUMArbitrary post deletion via Playbooks /ignore-thread endpointEPSS 0.3%CVE-2026-4915MEDIUMServer panic via outgoing webhook responsesEPSS 0.3%CVE-2024-39361LOWCreating posts with user-defined IDs permitted in CreatePost APIEPSS 0.3%CVE-2024-41162MEDIUMMalicious remote can make an arbitrary local channel read-onlyEPSS 0.3%CVE-2024-29977LOWMalicious remote can create arbitrary reactions on arbitrary postsEPSS 0.3%CVE-2025-4573MEDIUMLDAP Injection in Mattermost Enterprise Edition When Using Active DirectoryEPSS 0.3%CVE-2025-30516LOWUnauthorized Notification Exposure in Mobile App Under Specific ConditionsEPSS 0.3%CVE-2026-2454MEDIUMDoS in Calls plugin via malformed msgpack in websocket request.EPSS 0.3%CVE-2024-5270MEDIUMSAML to email switch possible when email signin is disabledEPSS 0.3%CVE-2025-41423LOWUnauthorized Playbooks Post Deletion in Mattermost Playbooks PluginEPSS 0.3%