Vulnerabilidades en Mattermost

489 resultados
Análisis Vexday

Com 434 CVEs catalogadas e nenhuma entrada confirmada no catálogo CISA KEV, o Mattermost apresenta taxa de exploração ativa abaixo da média geral do catálogo, o que indica risco operacional imediato relativamente contido. No entanto, o volume de 60 vulnerabilidades surgidas nos últimos 90 dias merece atenção, sinalizando um ritmo elevado de descoberta recente. A falha mais comum é CWE-863 (autorização incorreta), padrão que tende a permitir acesso não autorizado a recursos e funcionalidades, e que exige revisão cuidadosa de controles de acesso nas implementações. A CVE mais perigosa atualmente identificada, CVE-2025-25279, registra escore EPSS de 0,2081 — o mais alto observado no portfólio — e, embora ainda sem exploração confirmada, deve ser priorizada dado o risco potencial de aproveitamento próximo.

CVE-2026-3472LOWMarkdown image rendering bypass in AI bot tool result posts in MattermostEPSS 0.3%CVE-2026-9693LOWMattermost thread memberships persist after team removal, exposing private channel thread metadata on re-inviteEPSS 0.3%CVE-2026-6343MEDIUMMattermost Playbooks Plugin fails to enforce view permissions in list endpoints, allowing unauthorized access to public playbooksEPSS 0.3%CVE-2026-28736MEDIUMFocalboard IDOR in file content endpoint allows cross-user file access (unsupported product, no fix)EPSS 0.3%CVE-2026-16047MEDIUMBoard channel linking without read channel permission validationEPSS 0.3%CVE-2026-9824MEDIUMRemote cluster metadata enumeration via /share-channel autocompleteEPSS 0.3%CVE-2026-3115MEDIUMGuest users can view group member IDs without respecting view restrictionsEPSS 0.3%CVE-2026-4053LOWpost edit time limit is not enforced on some post update operationsEPSS 0.3%CVE-2025-9081LOWIDOR in board file download allows any user to download any file by UUIDEPSS 0.3%CVE-2025-27571MEDIUMChannel metadata visible in archived channels despite configuration settingEPSS 0.3%CVE-2026-27769LOWConnected Workspaces: Malicious remote server can manipulate arbitrary user's statusEPSS 0.3%CVE-2024-1949LOWA race condition in Mattermost versions 8.1.x before 8.1.9, and 9.4.x before 9.4.2 allows an authenticated attacker to gain unauthorized accEPSS 0.3%CVE-2025-14273HIGHMattermost Jira plugin user spoofing enables Jira request forgery.EPSS 0.3%CVE-2023-3581MEDIUMWebSockets accept connections from HTTPS originEPSS 0.3%CVE-2024-39836MEDIUMMunged email address used for password resets and notificationsEPSS 0.3%CVE-2026-16048MEDIUMChannel member roles accept out-of-scope rolesEPSS 0.3%CVE-2025-9076MEDIUMMattermost Server exposes sensitive user credentials during shared channel membership synchronizationEPSS 0.3%CVE-2026-10527MEDIUMBoards plugin retains Board Admin rights for users demoted to System GuestEPSS 0.3%CVE-2024-9155MEDIUMInsufficient Authorization On Unlinked Channel FilesEPSS 0.3%CVE-2024-34152MEDIUMPlaybook Run Metadata leak to GuestEPSS 0.3%