Vulnerabilities in Mattermost
512 resultsCVE-2024-28949MEDIUMDoS via a large number of User PreferencesEPSS 0.6%CVE-2023-2793MEDIUMStack exhaustion in PreparePostForClientWithEmbedsAndImagesEPSS 0.6%CVE-2024-4182MEDIUMMattermost versions 9.6.0, 9.5.x before 9.5.3, 9.4.x before 9.4.5, and 8.1.x before 8.1.12 fail to handle JSON parsing errors in custom statEPSS 0.6%CVE-2025-20072MEDIUMMobile crash via improper validation of proto style in attachmentsEPSS 0.5%CVE-2023-2514MEDIUMDB username/password revealed in application logsEPSS 0.5%CVE-2023-1775MEDIUMUnsanitized events sent over Websocket to regular users in a High Availability environmentEPSS 0.5%CVE-2025-21083MEDIUMInsufficient Input Validation on Post PropsEPSS 0.5%CVE-2025-20036MEDIUMInsufficient Input Validation on Post PropsEPSS 0.5%CVE-2023-2787MEDIUMCollapsed Reply Threads APIs leak message contents from private channelsEPSS 0.5%CVE-2023-3585MEDIUMchannel DoS by sharing a boards linkEPSS 0.5%CVE-2023-1777MEDIUMInformation disclosure in linked message previewsEPSS 0.5%CVE-2024-22091LOWExcessive resource consumption due to lack to request path size limitsEPSS 0.5%CVE-2023-6459MEDIUMPublic endpoint /metrics of Calls plugin reveals channel IDsEPSS 0.5%CVE-2023-5969MEDIUM Denial of Service via Link Preview in /api/v4/redirect_locationEPSS 0.5%CVE-2023-27266LOWDisclosure of team owner email address when when accessing the teams APIEPSS 0.5%CVE-2023-27265LOWDisclosure of team owner email address when regenerating Invite IDEPSS 0.5%CVE-2024-1402MEDIUMDenial of service in mattermost mobile apps and server via emoji reactionsEPSS 0.5%CVE-2023-5968MEDIUMPassword hash in response body after username updateEPSS 0.5%CVE-2023-4107MEDIUMIncorrect authorization allows a user manager to update a system adminEPSS 0.5%CVE-2025-24490CRITICALSQL Injection in Mattermost Boards via board category ID reorderingEPSS 0.5%