Vulnerabilities in Mattermost

489 results
Vexday analysis

Com 434 CVEs catalogadas e nenhuma entrada confirmada no catálogo CISA KEV, o Mattermost apresenta taxa de exploração ativa abaixo da média geral do catálogo, o que indica risco operacional imediato relativamente contido. No entanto, o volume de 60 vulnerabilidades surgidas nos últimos 90 dias merece atenção, sinalizando um ritmo elevado de descoberta recente. A falha mais comum é CWE-863 (autorização incorreta), padrão que tende a permitir acesso não autorizado a recursos e funcionalidades, e que exige revisão cuidadosa de controles de acesso nas implementações. A CVE mais perigosa atualmente identificada, CVE-2025-25279, registra escore EPSS de 0,2081 — o mais alto observado no portfólio — e, embora ainda sem exploração confirmada, deve ser priorizada dado o risco potencial de aproveitamento próximo.

CVE-2024-32045MEDIUMPlaybook run link to private channel grants channel accessEPSS 0.2%CVE-2025-2475MEDIUMUnauthorized Bot Login Using CredentialsEPSS 0.2%CVE-2026-3117MEDIUMInstance and webhook GitLab plugin commands were able to be run by non-admin usersEPSS 0.2%CVE-2026-91181MEDIUMData Retention Teams Endpoint Leaks Private Team Invite IDEPSS 0.2%CVE-2025-3611LOWImproper Access Control in Mattermost allows System Managers to view team details despite role restrictionsEPSS 0.2%CVE-2024-2447MEDIUMMattermost versions 8.1.x before 8.1.11, 9.3.x before 9.3.3, 9.4.x before 9.4.4, and 9.5.x before 9.5.2 fail to authenticate the source of cEPSS 0.2%CVE-2025-24839LOWUnauthorized AI bot activation via Wrangler pluginEPSS 0.2%CVE-2025-4128LOWMattermost Guest User Information Disclosure VulnerabilityEPSS 0.2%CVE-2025-13870LOWUnauthorized access and subscription vulnerability in BoardsEPSS 0.2%CVE-2024-42406MEDIUMUnauthorized access on archived channelsEPSS 0.2%CVE-2026-28736MEDIUMFocalboard IDOR in file content endpoint allows cross-user file access (unsupported product, no fix)EPSS 0.2%CVE-2026-26246MEDIUMMemory Exhaustion via Malformed PSD File UploadEPSS 0.2%CVE-2025-47870MEDIUMTeam invite ID leaked to team admin with no member invite privilegesEPSS 0.2%CVE-2024-32939MEDIUMEmail addresses of remote users visible in props regardless of server settingsEPSS 0.2%CVE-2026-2578MEDIUMInformation Disclosure via WebSocket Event When Deleting Unrevealed Burn on Read PostsEPSS 0.2%CVE-2025-3230MEDIUMBypass of System Admin User Deactivation Controls for Personal Access Tokens in Mattermost ServerEPSS 0.2%CVE-2026-16049LOW_GitLab Plugin allows cross-channel post injection and phishing via missing channel permission checks in issue API endpoints_EPSS 0.2%CVE-2026-4265MEDIUMGuest user can upload files without permission across teamsEPSS 0.2%CVE-2026-10600MEDIUMDenial of service via unbounded document content extraction in Mattermost ServerEPSS 0.2%CVE-2026-86348MEDIUMMS Calendar plugin: unrecovered handler panics from malformed post-action requests could crash the plugin processEPSS 0.2%