Vulnerabilities in Mattermost

489 results
Vexday analysis

Com 434 CVEs catalogadas e nenhuma entrada confirmada no catálogo CISA KEV, o Mattermost apresenta taxa de exploração ativa abaixo da média geral do catálogo, o que indica risco operacional imediato relativamente contido. No entanto, o volume de 60 vulnerabilidades surgidas nos últimos 90 dias merece atenção, sinalizando um ritmo elevado de descoberta recente. A falha mais comum é CWE-863 (autorização incorreta), padrão que tende a permitir acesso não autorizado a recursos e funcionalidades, e que exige revisão cuidadosa de controles de acesso nas implementações. A CVE mais perigosa atualmente identificada, CVE-2025-25279, registra escore EPSS de 0,2081 — o mais alto observado no portfólio — e, embora ainda sem exploração confirmada, deve ser priorizada dado o risco potencial de aproveitamento próximo.

CVE-2026-9693LOWMattermost thread memberships persist after team removal, exposing private channel thread metadata on re-inviteEPSS 0.2%CVE-2026-0997MEDIUMMattermost Zoom Plugin channel preference API lacks authorization checksEPSS 0.2%CVE-2026-0998MEDIUMMattermost Zoom Plugin allows unauthorized meeting creation and post modification via insufficient API access controlsEPSS 0.2%CVE-2026-10527MEDIUMBoards plugin retains Board Admin rights for users demoted to System GuestEPSS 0.2%CVE-2026-16048MEDIUMChannel member roles accept out-of-scope rolesEPSS 0.2%CVE-2024-46872MEDIUMClient-Side Path Traversal Leading to CSRF in PlaybooksEPSS 0.2%CVE-2026-16046LOWMissing run-state validation on finished playbook runsEPSS 0.2%CVE-2026-6689MEDIUM*Missing* {{invite_user}} *permission check on team creation allows unprivileged users to set open-invite and allowed-domains team settings*EPSS 0.2%CVE-2026-3637MEDIUMMattermost fails to enforce create_post permission when editing postsEPSS 0.2%CVE-2026-6341MEDIUMIncomplete group locking implementationEPSS 0.2%CVE-2026-6342MEDIUMGroup prefix matching bypass for subscriptionsEPSS 0.2%CVE-2026-4055MEDIUMInsufficient permission validation on cross-team playbook run creationEPSS 0.2%CVE-2026-14344MEDIUMInconsistent authorization checks in Mattermost Boards endpointsEPSS 0.2%CVE-2026-28759MEDIUMInsufficient authorization in shared channel membership sync allows remote cluster to remove users from arbitrary channelsEPSS 0.2%CVE-2026-28732MEDIUMSlash command trigger-word update allowed command hijackingEPSS 0.2%CVE-2026-14259MEDIUMBoard archive import bypasses team board creation permissionsEPSS 0.2%CVE-2026-82920MEDIUMMattermost ABAC parent policy bypass via policy update endpointEPSS 0.2%CVE-2025-9078MEDIUMWeak cache keys lead to post IDOR and link preview poisoningEPSS 0.2%CVE-2026-15754MEDIUMMissing per-channel team-scope check in ABAC access control policy unassign allows cross-team policy removalEPSS 0.1%CVE-2026-3473MEDIUMImproper file ownership validation in the Boards API allows unauthorised file accessEPSS 0.1%