Vulnerabilidades em Mattermost

512 resultados
Análise Vexday

Com 434 CVEs catalogadas e nenhuma entrada confirmada no catálogo CISA KEV, o Mattermost apresenta taxa de exploração ativa abaixo da média geral do catálogo, o que indica risco operacional imediato relativamente contido. No entanto, o volume de 60 vulnerabilidades surgidas nos últimos 90 dias merece atenção, sinalizando um ritmo elevado de descoberta recente. A falha mais comum é CWE-863 (autorização incorreta), padrão que tende a permitir acesso não autorizado a recursos e funcionalidades, e que exige revisão cuidadosa de controles de acesso nas implementações. A CVE mais perigosa atualmente identificada, CVE-2025-25279, registra escore EPSS de 0,2081 — o mais alto observado no portfólio — e, embora ainda sem exploração confirmada, deve ser priorizada dado o risco potencial de aproveitamento próximo.

CVE-2026-11993MEDIUMFix authenticated members disabling file content indexing server-wide via extraction pool exhaustionEPSS 0.4%CVE-2023-4106MEDIUMA guest user can perform various actions on public playbooksEPSS 0.4%CVE-2024-39777HIGHMalicious remote can invite itself to an arbitrary local channelEPSS 0.4%CVE-2023-2000MEDIUMUnrestricted navigation due to unvalidated mattermost server redirectionEPSS 0.4%CVE-2026-116516MEDIUMInsufficient length validation when parsing Zoom chat transcriptionsEPSS 0.4%CVE-2024-41144MEDIUMMalicious remote can create/update/delete arbitrary posts in arbitrary channelsEPSS 0.4%CVE-2026-9708MEDIUMIncoming webhook user attribution via unvalidated webhook ownerEPSS 0.4%CVE-2024-1942MEDIUMMattermost versions 8.1.x before 8.1.9, 9.2.x before 9.2.5, and 9.3.0 fail to sanitize the metadata on posts containing permalinks under speEPSS 0.4%CVE-2023-47858MEDIUMDetails of archived public channels are leaked to members of another teamEPSS 0.4%CVE-2026-20719MEDIUMDoS via URL Previews Rendering Malicious SVGsEPSS 0.4%CVE-2026-3116MEDIUMImproper Input Validation in Zoom Plugin Webhook HandlerEPSS 0.4%CVE-2026-3114MEDIUMZip Bomb Denial of Service via Unrestricted Archive DecompressionEPSS 0.4%CVE-2023-2786MEDIUMChannel commands execution doesn't properly verify permissionsEPSS 0.4%CVE-2023-3582MEDIUMLack of channel membership check when linking a board to a channelEPSS 0.4%CVE-2023-3584LOWMember can create team with team override scheme EPSS 0.4%CVE-2023-3614MEDIUMDenial of Service via specially crafted gif imageEPSS 0.4%CVE-2025-31947MEDIUMRepeated LDAP login failures can lock an LDAP accountEPSS 0.4%CVE-2026-9816HIGHInsufficient server-side validation of board member role fields permits privilege escalationEPSS 0.4%CVE-2026-2462MEDIUMAdmin RCE via Malicious Plugin Upload on CI Test InstancesEPSS 0.3%CVE-2025-14822LOWDoS from quadratic complexity in model.ParseHashtagsEPSS 0.3%