Vulnerabilities in Mattermost
512 resultsCVE-2026-8683MEDIUMOverly long URLs crash the Mattermost Desktop AppEPSS 0.2%CVE-2025-13324LOWLack of Invalidation of Legacy Remote Cluster Invite Tokens After ConfirmationEPSS 0.2%CVE-2026-18799MEDIUMMattermost Server fails to restrict Slack import account binding, allowing team admins to forge posts as existing usersEPSS 0.2%CVE-2025-48731MEDIUMUnauthorized Subscription Edit to Confluence Space in Mattermost Confluence PluginEPSS 0.2%CVE-2023-5920LOWLack Of Secure Keyboard Entry Protection in MacOS DesktopEPSS 0.2%CVE-2025-12756MEDIUMInsecure Direct Object Reference in Mattermost Boards Plugin Enables Unauthorised Comment DeletionEPSS 0.2%CVE-2025-55073MEDIUMMS Teams plugin OAuth allows editing arbitrary postsEPSS 0.2%CVE-2025-11777LOWCross-team channel membership accessEPSS 0.2%CVE-2025-13767MEDIUMUnauthorized Read Access to Private Channel Posts via Mattermost Jira PluginEPSS 0.2%CVE-2026-21386MEDIUMPrivate channel enumeration via /mute slash commandEPSS 0.2%CVE-2025-47700LOWAI plugin APIs can be triggered using post actionsEPSS 0.2%CVE-2026-16453HIGHMattermost SAML RelayState forgery allows unauthorized team membershipEPSS 0.2%CVE-2024-36287LOWBypass of TCC restrictions on macOSEPSS 0.2%CVE-2026-6046MEDIUMPlugin bot username conflict allows user account to be used as bot identity in Mattermost ServerEPSS 0.2%CVE-2025-14350MEDIUMInformation disclosure via channel mentions in postsEPSS 0.2%CVE-2026-2476HIGHMS Teams plugin sensitive config values not properly masked in support packetsEPSS 0.2%CVE-2026-6517MEDIUMMattermost Desktop App fails to restrict the allow list of domains which NTLM credentials are passedEPSS 0.2%CVE-2025-14573LOWTeam Admin Bypass of Invite Permissions via allow_open_invite FieldEPSS 0.2%CVE-2026-3636MEDIUMSanitize team member data returned by APIEPSS 0.2%CVE-2026-3471MEDIUMOpening a window with {{javascript:alert()}} as URL causes crash in the Mattermost Desktop AppEPSS 0.2%