Vulnerabilities in Mattermost

489 results
Vexday analysis

Com 434 CVEs catalogadas e nenhuma entrada confirmada no catálogo CISA KEV, o Mattermost apresenta taxa de exploração ativa abaixo da média geral do catálogo, o que indica risco operacional imediato relativamente contido. No entanto, o volume de 60 vulnerabilidades surgidas nos últimos 90 dias merece atenção, sinalizando um ritmo elevado de descoberta recente. A falha mais comum é CWE-863 (autorização incorreta), padrão que tende a permitir acesso não autorizado a recursos e funcionalidades, e que exige revisão cuidadosa de controles de acesso nas implementações. A CVE mais perigosa atualmente identificada, CVE-2025-25279, registra escore EPSS de 0,2081 — o mais alto observado no portfólio — e, embora ainda sem exploração confirmada, deve ser priorizada dado o risco potencial de aproveitamento próximo.

CVE-2026-8821HIGHPlaybooks run owner channel membership permission bypassEPSS 0.2%CVE-2026-2463MEDIUMUnauthorized access to invite ID during team creationEPSS 0.2%CVE-2026-16044LOWInsufficient validation of guest board admin privileges on archive importEPSS 0.2%CVE-2025-1398LOWmacOS TCC Bypass via Code InjectionEPSS 0.2%CVE-2025-55074LOWChannel member objects leak read statusEPSS 0.2%CVE-2025-14350MEDIUMInformation disclosure via channel mentions in postsEPSS 0.2%CVE-2025-41436LOWUnauthorized access to archived channel content via threads interfaceEPSS 0.2%CVE-2026-75588LOWMattermost Desktop App plugin popout scheme validation bypassEPSS 0.2%CVE-2026-27769LOWConnected Workspaces: Malicious remote server can manipulate arbitrary user's statusEPSS 0.2%CVE-2026-4053LOWpost edit time limit is not enforced on some post update operationsEPSS 0.2%CVE-2026-2456MEDIUMDenial of Service via Unbounded Memory Allocation in Integration ActionsEPSS 0.2%CVE-2026-24692MEDIUMGuest users can bypass read permissions via search APIEPSS 0.2%CVE-2026-2455MEDIUMSSRF bypass via IPv4-mapped IPv6 literalsEPSS 0.2%CVE-2026-2458MEDIUMUnauthorized channel enumeration in private teams after member removalEPSS 0.2%CVE-2026-6343MEDIUMMattermost Playbooks Plugin fails to enforce view permissions in list endpoints, allowing unauthorized access to public playbooksEPSS 0.2%CVE-2025-14573LOWTeam Admin Bypass of Invite Permissions via allow_open_invite FieldEPSS 0.2%CVE-2026-2461MEDIUMMissing authorization check allows unauthorized modification of other users' comments on a boardEPSS 0.2%CVE-2026-16047MEDIUMBoard channel linking without read channel permission validationEPSS 0.2%CVE-2026-26230LOWTeam Admin Privilege Escalation to Demote Members to GuestEPSS 0.2%CVE-2026-26304MEDIUMPermission Bypass in Playbook Run CreationEPSS 0.2%