Vulnerabilities in Mattermost
512 resultsCVE-2024-36255MEDIUMPost actions can run playbook checklist task commandsEPSS 0.2%CVE-2026-27656MEDIUMAccount Takeover via Substring Matching in OpenID Connect AuthenticationEPSS 0.2%CVE-2025-55074LOWChannel member objects leak read statusEPSS 0.2%CVE-2025-41436LOWUnauthorized access to archived channel content via threads interfaceEPSS 0.2%CVE-2026-19603MEDIUMPrivate channel ID disclosure via user status endpointsEPSS 0.2%CVE-2026-18560MEDIUMImproper order of authorisations in Mattermost GetFile API leads to an authenticated user to determine a post’s quarantined statusEPSS 0.2%CVE-2026-3433MEDIUMMattermost fails to scope role_updated websocket events to authorized team and channel membersEPSS 0.2%CVE-2026-0998MEDIUMMattermost Zoom Plugin allows unauthorized meeting creation and post modification via insufficient API access controlsEPSS 0.2%CVE-2026-0997MEDIUMMattermost Zoom Plugin channel preference API lacks authorization checksEPSS 0.2%CVE-2026-2463MEDIUMUnauthorized access to invite ID during team creationEPSS 0.2%CVE-2025-9072HIGHOne-Click Mattermost Account Takeover via Poisoned RelayState SAML ParameterEPSS 0.2%CVE-2024-41926LOWMalicious remote can claim that a user was synced from another remoteEPSS 0.2%CVE-2025-13352LOWMattermost GitHub Plugin allows unauthorized GitHub reactions via reaction forwarding hijackingEPSS 0.2%CVE-2025-64641MEDIUMMattermost Jira plugin crafted action leaks Jira issue detailsEPSS 0.2%CVE-2026-93847LOWImproper post type validation on scheduled post endpointsEPSS 0.2%CVE-2025-1398LOWmacOS TCC Bypass via Code InjectionEPSS 0.2%CVE-2024-12247MEDIUMImproper propagation of permission scheme updates across cluster nodesEPSS 0.2%CVE-2026-4635MEDIUMPersistent notification timing attack causing server denial of serviceEPSS 0.2%CVE-2026-2458MEDIUMUnauthorized channel enumeration in private teams after member removalEPSS 0.2%CVE-2026-24692MEDIUMGuest users can bypass read permissions via search APIEPSS 0.2%