Vulnerabilities in Mattermost

489 results
Vexday analysis

Com 434 CVEs catalogadas e nenhuma entrada confirmada no catálogo CISA KEV, o Mattermost apresenta taxa de exploração ativa abaixo da média geral do catálogo, o que indica risco operacional imediato relativamente contido. No entanto, o volume de 60 vulnerabilidades surgidas nos últimos 90 dias merece atenção, sinalizando um ritmo elevado de descoberta recente. A falha mais comum é CWE-863 (autorização incorreta), padrão que tende a permitir acesso não autorizado a recursos e funcionalidades, e que exige revisão cuidadosa de controles de acesso nas implementações. A CVE mais perigosa atualmente identificada, CVE-2025-25279, registra escore EPSS de 0,2081 — o mais alto observado no portfólio — e, embora ainda sem exploração confirmada, deve ser priorizada dado o risco potencial de aproveitamento próximo.

CVE-2026-86349MEDIUMMattermost Server Algorithmic DoS via Unbounded Markdown Block NestingEPSS 0.2%CVE-2024-45843LOWWeak SSRF FilteringEPSS 0.2%CVE-2024-36250LOWMFA Code ReplayEPSS 0.2%CVE-2025-12559MEDIUMInformation Disclosure in Common Teams APIEPSS 0.2%CVE-2025-27715LOWAuto-Enrollment of Team Admins into Private Channels without explicit consentEPSS 0.2%CVE-2026-13417MEDIUMBoards plugin denial of service via unvalidated block fields.propertiesEPSS 0.2%CVE-2026-11993MEDIUMFix authenticated members disabling file content indexing server-wide via extraction pool exhaustionEPSS 0.2%CVE-2026-12882MEDIUMMattermost Markdown autolink parsing denial of serviceEPSS 0.2%CVE-2025-54458MEDIUMUnauthorized Subscription Creation to Confluence Space in Mattermost Confluence PluginEPSS 0.2%CVE-2026-9812MEDIUMMissing property field ownership validation in Playbooks run property update endpointEPSS 0.2%CVE-2024-39767MEDIUMSpoofed push notifications from malicious serverEPSS 0.2%CVE-2025-27933MEDIUMUnauthorized Private-to-Public Channel ConversionEPSS 0.2%CVE-2026-20796LOWTime-of-check time-of-use vulnerability in common teams APIEPSS 0.2%CVE-2025-13821MEDIUMUser profile update exposes password hash and MFA secretsEPSS 0.2%CVE-2025-53857LOWLack of Authorization on Get Channel Subscriptions for Autocomplete in Mattermost Confluence PluginEPSS 0.2%CVE-2025-44001MEDIUMUnauthorized Channel Subscription Read in Mattermost Confluence PluginEPSS 0.2%CVE-2025-2571MEDIUMGoogle OAuth Authentication Bypass for Converted Bot AccountsEPSS 0.2%CVE-2024-45835LOWInsufficient Electron Fuses ConfigurationEPSS 0.2%CVE-2026-5163MEDIUMMissing authorization check in AI message rewrite endpoint allows access to private thread contentEPSS 0.2%CVE-2026-1629MEDIUMPermalink Preview Information Disclosure After Permission RevocationEPSS 0.2%