Vulnerabilities in Mattermost

489 results
Vexday analysis

Com 434 CVEs catalogadas e nenhuma entrada confirmada no catálogo CISA KEV, o Mattermost apresenta taxa de exploração ativa abaixo da média geral do catálogo, o que indica risco operacional imediato relativamente contido. No entanto, o volume de 60 vulnerabilidades surgidas nos últimos 90 dias merece atenção, sinalizando um ritmo elevado de descoberta recente. A falha mais comum é CWE-863 (autorização incorreta), padrão que tende a permitir acesso não autorizado a recursos e funcionalidades, e que exige revisão cuidadosa de controles de acesso nas implementações. A CVE mais perigosa atualmente identificada, CVE-2025-25279, registra escore EPSS de 0,2081 — o mais alto observado no portfólio — e, embora ainda sem exploração confirmada, deve ser priorizada dado o risco potencial de aproveitamento próximo.

CVE-2026-24458HIGHDoS attack via login attempts with multi-megabyte passwordsEPSS 0.3%CVE-2026-3472LOWMarkdown image rendering bypass in AI bot tool result posts in MattermostEPSS 0.3%CVE-2026-9824MEDIUMRemote cluster metadata enumeration via /share-channel autocompleteEPSS 0.3%CVE-2025-54499LOWInsecure string comparison enables timing attacksEPSS 0.3%CVE-2025-27571MEDIUMChannel metadata visible in archived channels despite configuration settingEPSS 0.3%CVE-2025-9081LOWIDOR in board file download allows any user to download any file by UUIDEPSS 0.3%CVE-2026-25780MEDIUMMemory Exhaustion via Malformed DOC File UploadEPSS 0.3%CVE-2024-1949LOWA race condition in Mattermost versions 8.1.x before 8.1.9, and 9.4.x before 9.4.2 allows an authenticated attacker to gain unauthorized accEPSS 0.3%CVE-2026-6347HIGHMattermost Calls plugin exposes TURN server credentials in plaintext in support packetsEPSS 0.3%CVE-2023-3581MEDIUMWebSockets accept connections from HTTPS originEPSS 0.3%CVE-2024-39836MEDIUMMunged email address used for password resets and notificationsEPSS 0.3%CVE-2025-14273HIGHMattermost Jira plugin user spoofing enables Jira request forgery.EPSS 0.3%CVE-2026-9816HIGHInsufficient server-side validation of board member role fields permits privilege escalationEPSS 0.3%CVE-2025-9076MEDIUMMattermost Server exposes sensitive user credentials during shared channel membership synchronizationEPSS 0.3%CVE-2024-9155MEDIUMInsufficient Authorization On Unlinked Channel FilesEPSS 0.3%CVE-2024-48872MEDIUMBypass of "Max failed attempts" restriction via race conditionEPSS 0.3%CVE-2024-34152MEDIUMPlaybook Run Metadata leak to GuestEPSS 0.3%CVE-2024-36241LOW/playbook add slash command allows viewing arbitrary post contentsEPSS 0.3%CVE-2025-1412LOWSession Persistence After User-to-Bot ConversionEPSS 0.3%CVE-2026-6739MEDIUMMattermost: Delegated admins could patch protected default system rolesEPSS 0.3%