Vulnerabilidades en Mattermost

489 resultados
Análisis Vexday

Com 434 CVEs catalogadas e nenhuma entrada confirmada no catálogo CISA KEV, o Mattermost apresenta taxa de exploração ativa abaixo da média geral do catálogo, o que indica risco operacional imediato relativamente contido. No entanto, o volume de 60 vulnerabilidades surgidas nos últimos 90 dias merece atenção, sinalizando um ritmo elevado de descoberta recente. A falha mais comum é CWE-863 (autorização incorreta), padrão que tende a permitir acesso não autorizado a recursos e funcionalidades, e que exige revisão cuidadosa de controles de acesso nas implementações. A CVE mais perigosa atualmente identificada, CVE-2025-25279, registra escore EPSS de 0,2081 — o mais alto observado no portfólio — e, embora ainda sem exploração confirmada, deve ser priorizada dado o risco potencial de aproveitamento próximo.

CVE-2024-48872MEDIUMBypass of "Max failed attempts" restriction via race conditionEPSS 0.3%CVE-2024-36241LOW/playbook add slash command allows viewing arbitrary post contentsEPSS 0.3%CVE-2025-1412LOWSession Persistence After User-to-Bot ConversionEPSS 0.3%CVE-2026-82920MEDIUMMattermost ABAC parent policy bypass via policy update endpointEPSS 0.3%CVE-2026-96259MEDIUMMattermost server-side request forgery via OAuth endpoints configurable by a System AdministratorEPSS 0.3%CVE-2026-9820LOWMattermost schemes teams endpoint exposes private team invite IDsEPSS 0.3%CVE-2026-26230LOWTeam Admin Privilege Escalation to Demote Members to GuestEPSS 0.3%CVE-2025-0503LOWLeaked User IDs and Metadata of Deleted DMsEPSS 0.3%CVE-2026-28759MEDIUMInsufficient authorization in shared channel membership sync allows remote cluster to remove users from arbitrary channelsEPSS 0.3%CVE-2026-26304MEDIUMPermission Bypass in Playbook Run CreationEPSS 0.3%CVE-2026-28732MEDIUMSlash command trigger-word update allowed command hijackingEPSS 0.3%CVE-2026-6342MEDIUMGroup prefix matching bypass for subscriptionsEPSS 0.3%CVE-2026-4055MEDIUMInsufficient permission validation on cross-team playbook run creationEPSS 0.3%CVE-2026-6341MEDIUMIncomplete group locking implementationEPSS 0.3%CVE-2026-6689MEDIUM*Missing* {{invite_user}} *permission check on team creation allows unprivileged users to set open-invite and allowed-domains team settings*EPSS 0.3%CVE-2026-6541MEDIUMUnscoped updates to other playbooks' metric configurationEPSS 0.3%CVE-2026-16046LOWMissing run-state validation on finished playbook runsEPSS 0.3%CVE-2026-3637MEDIUMMattermost fails to enforce create_post permission when editing postsEPSS 0.3%CVE-2025-2424LOWLeaked Metadata of Deleted Files via Bookmark CreationEPSS 0.3%CVE-2024-47145LOWUnauthorized access on archived channels via file linksEPSS 0.3%