Vulnerabilidades en Mattermost

489 resultados
Análisis Vexday

Com 434 CVEs catalogadas e nenhuma entrada confirmada no catálogo CISA KEV, o Mattermost apresenta taxa de exploração ativa abaixo da média geral do catálogo, o que indica risco operacional imediato relativamente contido. No entanto, o volume de 60 vulnerabilidades surgidas nos últimos 90 dias merece atenção, sinalizando um ritmo elevado de descoberta recente. A falha mais comum é CWE-863 (autorização incorreta), padrão que tende a permitir acesso não autorizado a recursos e funcionalidades, e que exige revisão cuidadosa de controles de acesso nas implementações. A CVE mais perigosa atualmente identificada, CVE-2025-25279, registra escore EPSS de 0,2081 — o mais alto observado no portfólio — e, embora ainda sem exploração confirmada, deve ser priorizada dado o risco potencial de aproveitamento próximo.

CVE-2024-2445MEDIUMReflected XSS in Mattermost Jira pluginEPSS 0.3%CVE-2026-3109LOWMissing timestamp validation in Zoom webhook handlerEPSS 0.3%CVE-2025-41443MEDIUMGuest user can discover active public channelsEPSS 0.3%CVE-2025-41410MEDIUMSlack import bypasses email verification for team access controlsEPSS 0.3%CVE-2026-6046MEDIUMPlugin bot username conflict allows user account to be used as bot identity in Mattermost ServerEPSS 0.3%CVE-2026-9571MEDIUMDeactivated user accounts can continue to obtain valid OAuth access tokens via refresh token grant in MattermostEPSS 0.3%CVE-2024-36257LOWLack of permission check when updating the profile picture of a remote user (shared channels enabled)EPSS 0.3%CVE-2026-2578MEDIUMInformation Disclosure via WebSocket Event When Deleting Unrevealed Burn on Read PostsEPSS 0.3%CVE-2025-49222MEDIUMMattermost Shared Channel Upload Type Validation BypassEPSS 0.3%CVE-2025-2527MEDIUMImproper access control to group informationEPSS 0.3%CVE-2026-3433MEDIUMMattermost fails to scope role_updated websocket events to authorized team and channel membersEPSS 0.3%CVE-2026-3636MEDIUMSanitize team member data returned by APIEPSS 0.3%CVE-2024-37182MEDIUMLack of permissions prompting when opening external URLsEPSS 0.3%CVE-2026-6673MEDIUMMattermost Jira plugin had unauthenticated {{/ac/installed}} lifecycle callback during pending Jira Cloud installEPSS 0.3%CVE-2026-10106MEDIUMUnauthorized users can trigger interactive post actions in private channels via action cookie channel mismatch in MattermostEPSS 0.3%CVE-2024-39613MEDIUMRCE in desktop app in Windows by local attackerEPSS 0.3%CVE-2025-54463MEDIUMUnexpected Input to Cloud Webhook endpoint Causes DoS in Mattermost Confluence PluginEPSS 0.3%CVE-2024-34029MEDIUMAD/LDAP Group Members LeakEPSS 0.3%CVE-2025-55070MEDIUMLack of MFA enforcement in WebSocket connectionsEPSS 0.3%CVE-2024-52032MEDIUMPrivate channel names leaking when Elasticsearch is enabledEPSS 0.3%