MatterMost

By the Year

In 2026 there have been 34 vulnerabilities in MatterMost with an average score of 4.9 out of ten. Last year, in 2025 MatterMost had 93 security vulnerabilities published. If vulnerabilities keep coming in at the current rate, it appears that number of security vulnerabilities in MatterMost in 2026 could surpass last years number. Last year, the average CVE base score was greater by 0.27

Recent MatterMost Security Vulnerabilities

CVE	Date	Vulnerability	Products
CVE-2026-1629	Mar 16, 2026	Mattermost <=10.11.10 Cached Permalink Preview Persistence Mattermost versions 10.11.x <= 10.11.10 Fail to invalidate cached permalink preview data when a user loses channel access which allows the user to continue viewing private channel content via previously cached permalink previews until cache reset or relogin.. Mattermost Advisory ID: MMSA-2026-00580	Mattermost
CVE-2026-26230	Mar 16, 2026	Mattermost 10.11.x <=10.11.10 Permission Validation Flaw in Roles API Mattermost versions 10.11.x <= 10.11.10 fail to properly validate permission requirements in the team member roles API endpoint which allows team administrators to demote members to guest role. Mattermost Advisory ID: MMSA-2025-00531	Mattermost
CVE-2026-2454	Mar 16, 2026	Mattermost <=11.3.0, 11.2.2, 10.11.10 OOM via corrupted msgpack WS frames Mattermost versions 11.3.x <= 11.3.0, 11.2.x <= 11.2.2, 10.11.x <= 10.11.10 fail to handle incorrectly reported array lengths which allows malicious user to cause OOM errors and crash the server via sending corrupted msgpack frames within websocket messages to calls plugin. Mattermost Advisory ID: MMSA-2025-00537	Mattermost
CVE-2026-26304	Mar 16, 2026	Mattermost <=11.3.0/<=11.2.2 run_create Perm Bypass Unauthorized Playbook Run Mattermost versions 11.3.x <= 11.3.0, 11.2.x <= 11.2.2 fail to verify run_create permission for empty playbookId, which allows team members to create unauthorized runs via the playbook run API. Mattermost Advisory ID: MMSA-2025-00542	Mattermost
CVE-2026-24692	Mar 16, 2026	Mattermost <v11.3.0: Search API Read Permission Bypass (CVE-2026-24692) Mattermost versions 11.3.x <= 11.3.0, 11.2.x <= 11.2.2, 10.11.x <= 10.11.10 fail to properly enforce read permissions in search API endpoints which allows guest users without read permissions to access posts and files in channels via search API requests. Mattermost Advisory ID: MMSA-2025-00554	Mattermost
CVE-2026-22545	Mar 16, 2026	Auth Method Switch Flaw Enables Password Change in Mattermost <=10.11.10 Mattermost versions 10.11.x <= 10.11.10 fail to validate user's authentication method when processing account auth type switch which allows an authenticated attacker to change account password without confirmation via falsely claiming a different auth provider.. Mattermost Advisory ID: MMSA-2026-00583	Mattermost
CVE-2026-2455	Mar 16, 2026	Mattermost SSRF before v11.3.0 via IPv4-mapped IPv6 Mattermost versions 11.3.x <= 11.3.0, 11.2.x <= 11.2.2, 10.11.x <= 10.11.10 fail to canonicalize IPv4-mapped IPv6 addresses before reserved IP validation which allows an attacker to perform SSRF attacks against internal services via IPv4-mapped IPv6 literals (e.g., [::ffff:127.0.0.1]).. Mattermost Advisory ID: MMSA-2026-00585	Mattermost
CVE-2026-21386	Mar 16, 2026	Mattermost 11.3.0, 11.2.2, 10.11.10: /mute ErrResp Enables Private Disclosure Mattermost versions 11.3.x <= 11.3.0, 11.2.x <= 11.2.2, 10.11.x <= 10.11.10 fail to use consistent error responses when handling the /mute command which allows an authenticated team member to enumerate private channels they are not authorized to know about via differing error messages for nonexistent versus private channels. Mattermost Advisory ID: MMSA-2026-00588	Mattermost
CVE-2026-25780	Mar 16, 2026	Memory Allocation Bug in Mattermost DOC Parsing (10.11.10, 11.2.2, 11.3.0) Mattermost versions 11.3.x <= 11.3.0, 11.2.x <= 11.2.2, 10.11.x <= 10.11.10 fail to bound memory allocation when processing DOC files which allows an authenticated attacker to cause server memory exhaustion and denial of service via uploading a specially crafted DOC file.. Mattermost Advisory ID: MMSA-2026-00581	Mattermost
CVE-2026-4265	Mar 16, 2026	Mattermost <11.3.0/11.2.2/10.11.10: Guest upload_file bypass via metadata reuse Mattermost versions 11.3.x <= 11.3.0, 11.2.x <= 11.2.2, 10.11.x <= 10.11.10 fail to validate team-specific upload_file permissions which allows a guest user to post files in channels where they lack upload_file permission via uploading files in a team where they have permission and reusing the file metadata in a POST request to a different team. Mattermost Advisory ID: MMSA-2025-00553	Mattermost
CVE-2026-25783	Mar 16, 2026	Mattermost <=11.3.0: Invalid User-Agent Header Causes Panic Mattermost versions 11.3.x <= 11.3.0, 11.2.x <= 11.2.2, 10.11.x <= 10.11.10 fail to properly validate User-Agent header tokens which allows an authenticated attacker to cause a request panic via a specially crafted User-Agent header. Mattermost Advisory ID: MMSA-2026-00586	Mattermost
CVE-2026-24458	Mar 16, 2026	Mattermost 10-11.3.x Auth, Big Password DoS Mattermost versions 11.3.x <= 11.3.0, 11.2.x <= 11.2.2, 10.11.x <= 10.11.10 fail to properly handle very long passwords, which allows an attacker to overload the server CPU and memory via executing login attempts with multi-megabyte passwords. Mattermost Advisory ID: MMSA-2026-00587	Mattermost
CVE-2026-2462	Mar 16, 2026	Mattermost <=11.3.0 RCE via plugin install on CI test with default admin creds Mattermost versions 11.3.x <= 11.3.0, 11.2.x <= 11.2.2, 10.11.x <= 10.11.10 fail to restrict plugin installation on CI test instances with default admin credentials which allows an unauthenticated attacker to achieve remote code execution and exfiltrate sensitive configuration data including AWS and SMTP credentials via uploading a malicious plugin after changing the import directory. Mattermost Advisory ID: MMSA-2025-00528	Mattermost
CVE-2026-2578	Mar 16, 2026	Mattermost 11.3.x WebSocket Leak Exposes BurnonRead Posts Mattermost versions 11.3.x <= 11.3.0 fail to preserve the redacted state of burn-on-read posts during deletion which allows channel members to access unrevealed burn-on-read message contents via the WebSocket post deletion event.. Mattermost Advisory ID: MMSA-2026-00579	Mattermost
CVE-2026-26246	Mar 16, 2026	Memory Exhaustion in Mattermost PSD Handler (v<11.3.0) Mattermost versions 11.3.x <= 11.3.0, 11.2.x <= 11.2.2, 10.11.x <= 10.11.10 fail to bound memory allocation when processing PSD image files which allows an authenticated attacker to cause server memory exhaustion and denial of service via uploading a specially crafted PSD file. Mattermost Advisory ID: MMSA-2026-00572	Mattermost
CVE-2026-2458	Mar 16, 2026	Mattermost <=11.3.0, 11.2.2, 10.11.10: Channel Search Enum Mattermost versions 11.3.x <= 11.3.0, 11.2.x <= 11.2.2, 10.11.x <= 10.11.10 fail to properly validate team membership when searching channels which allows a removed team member to enumerate all public channels within a private team via the channel search API endpoint.. Mattermost Advisory ID: MMSA-2025-00568	Mattermost
CVE-2026-2457	Mar 16, 2026	Mattermost 11.3.0/11.2.2/10.11.10: Authenticated Metadata Sanitize Bypass Mattermost versions 11.3.x <= 11.3.0, 11.2.x <= 11.2.2, 10.11.x <= 10.11.10 fail to sanitize client-supplied post metadata which allows an authenticated attacker to spoof permalink embeds impersonating other users via crafted PUT requests to the post update API endpoint.. Mattermost Advisory ID: MMSA-2025-00569	Mattermost
CVE-2026-2461	Mar 16, 2026	Mattermost Plugins <=11.3 Auth Checks Missing on Comment Mods Mattermost Plugins versions <=11.3 11.0.3 11.2.2 10.10.11.0 fail to implement authorisation checks on comment block modifications, which allows an authorised attacker with editor permission to modify comments created by other board members. Mattermost Advisory ID: MMSA-2025-00559	Mattermost
CVE-2026-2463	Mar 16, 2026	ACL Bypass via Invite ID in Mattermost 10.11.10 & lower Mattermost versions 11.3.x <= 11.3.0, 11.2.x <= 11.2.2, 10.11.x <= 10.11.10 fail to filter invite IDs based on user permissions, which allows regular users to bypass access control restrictions and register unauthorized accounts via leaked invite IDs during team creation.. Mattermost Advisory ID: MMSA-2025-00565	Mattermost
CVE-2026-2476	Mar 16, 2026	Mattermost Plugins <=2.0.3.0: Sensitive Config Not Masked on Export Mattermost Plugins versions <=2.0.3.0 fail to properly mask sensitive configuration values which allows an attacker with access to support packets to obtain original plugin settings via exported configuration data. Mattermost Advisory ID: MMSA-2026-00606	Mattermost
CVE-2026-2456	Mar 16, 2026	Mattermost <=11.3.0 Denial via Unbounded Integration Response Mattermost versions 11.3.x <= 11.3.0, 11.2.x <= 11.2.2, 10.11.x <= 10.11.10 Mattermost fails to limit the size of responses from integration action endpoints, which allows an authenticated attacker to cause server memory exhaustion and denial of service via a malicious integration server that returns an arbitrarily large response when a user clicks an interactive message button.. Mattermost Advisory ID: MMSA-2026-00571	Mattermost
CVE-2026-1628	Mar 02, 2026	Mattermost Desktop App <=5.13.3: External Navigation Leak Exposes Preload Scripts Mattermost Desktop App versions <=5.13.3 fail to attach listeners restricting navigation to external sites within the Mattermost app which allows a malicious server to expose preload script functionality to untrusted servers via having a user open an external link in their Mattermost server. Mattermost Advisory ID: MMSA-2026-00596	Mattermost
CVE-2025-14573	Feb 16, 2026	Mattermost <=10.11.9 Bypass Invite Permissions via API Mattermost versions 10.11.x <= 10.11.9 fail to enforce invite permissions when updating team settings, which allows team administrators without proper permissions to bypass restrictions and add users to their team via API requests. Mattermost Advisory ID: MMSA-2025-00561	Mattermost
CVE-2026-1046	Feb 16, 2026	Mattermost Desktop App <=6.0 Help Link RCE CVE-2026-1046 via Malicious Server Mattermost Desktop App versions <=6.0 6.2.0 5.2.13.0 fail to validate help links which allows a malicious Mattermost server to execute arbitrary executables on a users system via the user clicking on certain items in the Help menu Mattermost Advisory ID: MMSA-2026-00577	Mattermost Mattermost Desktop
CVE-2025-14350	Feb 16, 2026	Mattermost <11.2.1 Channel Mention Member Validation Flaw (CVE-2025-14350) Mattermost versions 11.1.x <= 11.1.2, 10.11.x <= 10.11.9, 11.2.x <= 11.2.1 fail to properly validate team membership when processing channel mentions which allows authenticated users to determine the existence of teams and their URL names via posting channel shortlinks and observing the channel_mentions property in the API response. Mattermost Advisory ID: MMSA-2025-00563	Mattermost
CVE-2025-13821	Feb 16, 2026	Mattermost 10.11/11.1/11.2 WS Sensitive Data Leak (hash/mfa) Mattermost versions 11.1.x <= 11.1.2, 10.11.x <= 10.11.9, 11.2.x <= 11.2.1 fail to sanitize sensitive data in WebSocket messages which allows authenticated users to exfiltrate password hashes and MFA secrets via profile nickname updates or email verification events. Mattermost Advisory ID: MMSA-2025-00560	Mattermost
CVE-2026-0997	Feb 16, 2026	Mattermost Zoom Plugin: Auth Bypass Allows Channel Preference Change (11.2.1) Mattermost versions 11.1.x <= 11.1.2, 10.11.x <= 10.11.9, 11.2.x <= 11.2.1 and Mattermost Plugin Zoom versions <=1.11.0 fail to validate the authenticated user when processing {{/plugins/zoom/api/v1/channel-preference}}, which allows any logged-in user to change Zoom meeting restrictions for arbitrary channels via crafted API requests.. Mattermost Advisory ID: MMSA-2025-00558	Mattermost
CVE-2026-0998	Feb 16, 2026	Unauthorized API Use in Mattermost 10.11-11.2 and Zoom Plugin <=1.11.0 Mattermost versions 11.1.x <= 11.1.2, 10.11.x <= 10.11.9, 11.2.x <= 11.2.1 and Mattermost Plugin Zoom versions <=1.11.0 fail to validate user identity and post ownership in the {{/api/v1/askPMI}} endpoint which allows unauthorized users to start Zoom meetings as any user and overwrite arbitrary posts via direct API calls with manipulated user IDs and post data.. Mattermost Advisory ID: MMSA-2025-00534	Mattermost
CVE-2026-0999	Feb 16, 2026	Mattermost: Login Method Bypass via UID in v10.11.x-11.2.1 (SSO Bypass) Mattermost versions 11.1.x <= 11.1.2, 10.11.x <= 10.11.9, 11.2.x <= 11.2.1 fail to properly validate login method restrictions which allows an authenticated user to bypass SSO-only login requirements via userID-based authentication. Mattermost Advisory ID: MMSA-2025-00548	Mattermost
CVE-2026-20796	Feb 13, 2026	Mattermost 10.11.x <= 10.11.9 Channel Membership Leak via /common_teams Mattermost versions 10.11.x <= 10.11.9 fail to properly validate channel membership at the time of data retrieval which allows a deactivated user to learn team names they should not have access to via a race condition in the /common_teams API endpoint.. Mattermost Advisory ID: MMSA-2025-00549	Mattermost
CVE-2026-22892	Feb 13, 2026	Mattermost Jira Plugin Authenticated Read via /create-issue v11.2.1,10.11.9 Mattermost versions 11.1.x <= 11.1.2, 10.11.x <= 10.11.9, 11.2.x <= 11.2.1 fail to validate user permissions when creating Jira issues from Mattermost posts, which allows an authenticated attacker with access to the Jira plugin to read post content and attachments from channels they do not have access to via the /create-issue API endpoint by providing the post ID of an inaccessible post.. Mattermost Advisory ID: MMSA-2025-00550	Mattermost
CVE-2025-13523	Feb 06, 2026	Mattermost Confluence plugin <1.7.0 XSS via unsanitized user display name Mattermost Confluence plugin version <1.7.0 fails to properly escape user-controlled display names in HTML template rendering which allows authenticated Confluence users with malicious display names to execute arbitrary JavaScript in victim browsers via sending a specially crafted OAuth2 connection link that, when visited, renders the attacker's display name without proper sanitization. Mattermost Advisory ID: MMSA-2025-00557	Mattermost
CVE-2025-14435	Jan 16, 2026	Mattermost Web Client <=10.11.8, <=11.0.6, <=11.1.1: Infinite Re-render DoS Mattermost versions 10.11.x <= 10.11.8, 11.1.x <= 11.1.1, 11.0.x <= 11.0.6 fail to prevent infinite re-renders on API errors which allows authenticated users to cause application-level DoS via triggering unbounded component re-render loops.	Mattermost
CVE-2025-14822	Jan 16, 2026	Mattermost 10.11.x <=10.11.8: HASHTAG Size Check Flaw Exposes CPU Exhaustion Mattermost versions 10.11.x <= 10.11.8 fail to validate input size before processing hashtags which allows an authenticated attacker to exhaust CPU resources via a single HTTP request containing a post with thousands space-separated tokens	Mattermost
CVE-2025-64641	Dec 24, 2025	Mattermost <=11.1.x issue exfil via /share-issue-publicly Jira POST Mattermost versions 11.1.x <= 11.1.0, 11.0.x <= 11.0.5, 10.12.x <= 10.12.3, 10.11.x <= 10.11.7 fail to verify that post actions invoking /share-issue-publicly were created by the Jira plugin which allowed a malicious Mattermost user to exfiltrate Jira tickets when victim users interacted with affected posts	Mattermost
CVE-2025-13767	Dec 24, 2025	Mattermost <=11.1 Vulnerable Jira Plugin Allows Unauthorized Channel Read Mattermost versions 11.1.x <= 11.1.0, 11.0.x <= 11.0.5, 10.12.x <= 10.12.3, 10.11.x <= 10.11.7 fails to validate user channel membership when attaching Mattermost posts as comments to Jira issues, which allows an authenticated attacker with access to the Jira plugin to read post content and attachments from channels they do not have access to.	Mattermost
CVE-2025-14273	Dec 22, 2025	Unauth Auth via Mattermost Jira Plug <=4.4.0 Mattermost versions 11.1.x <= 11.1.0, 11.0.x <= 11.0.5, 10.12.x <= 10.12.3, 10.11.x <= 10.11.7 with the Jira plugin enabled and Mattermost Jira plugin versions <=4.4.0 fail to enforce authentication and issue-key path restrictions in the Jira plugin, which allows an unauthenticated attacker who knows a valid user ID to issue authenticated GET and POST requests to the Jira server via crafted plugin payloads that spoof the user ID and inject arbitrary issue key paths. Mattermost Advisory ID: MMSA-2025-00555	Mattermost
CVE-2025-13326	Dec 17, 2025	Mattermost <6.0.0 HR Disabled on MacAppStore TCC Inherit Attack Mattermost Desktop App versions <6.0.0 fail to enable the Hardened Runtime on the Mattermost Desktop App when packaged for Mac App Store which allows an attacker to inherit TCC permissions via copying the binary to a tmp folder.	Mattermost Mattermost Desktop
CVE-2025-13324	Dec 17, 2025	Mattermost 10.11.x-10.11.5 & 11.0.x-11.0.4: Invite Token Replay Enables Channel Control Mattermost versions 10.11.x <= 10.11.5, 11.0.x <= 11.0.4, 10.12.x <= 10.12.2 fail to invalidate remote cluster invite tokens when using the legacy (version 1) protocol or when the confirming party does not provide a refreshed token, which allows an attacker who has obtained an invite token to authenticate as the remote cluster and perform limited actions on shared channels even after the invitation has been legitimately confirmed.	Mattermost
CVE-2025-13321	Dec 17, 2025	Mattermost Desktop <6.0 Log Sanitization Bypass Mattermost Desktop App versions <6.0.0 fail to sanitize sensitive information from Mattermost logs and clear data on server deletion which allows an attacker with access to the users system to gain access to potentially sensitive information via reading the application logs.	Mattermost Mattermost Desktop
CVE-2025-12689	Dec 17, 2025	Mattermost 11.0.4/10.12.2/10.11.6 DoS via WS UTF8 Check Failure Mattermost versions 11.0.x <= 11.0.4, 10.12.x <= 10.12.2, 10.11.x <= 10.11.6 fail to check WebSocket request field for proper UTF-8 format, which allows attacker to crash Calls plug-in via sending malformed request.	Mattermost
CVE-2025-62690	Dec 17, 2025	Mattermost <10.11.5 /error page redirect flaw Mattermost versions 10.11.x <= 10.11.4 fail to validate redirect URLs on the /error page, which allows an attacker to redirect a victim to a malicious site via a crafted link opened in a new tab.	Mattermost
CVE-2025-13352	Dec 17, 2025	Mattermost 10.11.x<=10.11.6 & GitHub Plugin <=2.4.0: Improper Validation Enables Reaction Hijacking Mattermost versions 10.11.x <= 10.11.6 and Mattermost GitHub plugin versions <=2.4.0 fail to validate plugin bot identity in reaction forwarding which allows attackers to hijack the GitHub reaction feature to make users add reactions to arbitrary GitHub objects via crafted notification posts.	Mattermost Mattermost Server
CVE-2025-62190	Dec 17, 2025	Mattermost 10-11 CSRF on Calls Widget Allows Authenticated Call Injection Mattermost versions 11.0.x <= 11.0.4, 10.12.x <= 10.12.2, 10.11.x <= 10.11.6 and Mattermost Calls versions <=1.10.0 fail to implement CSRF protection on the Calls widget page which allows an authenticated attacker to initiate calls and inject messages into channels or direct messages via a malicious webpage or crafted link	Mattermost
CVE-2025-13870	Dec 02, 2025	Authenticated Boards File Access in Mattermost 10.11.4/10.5.12 Mattermost versions 10.11.x <= 10.11.4, 10.5.x <= 10.5.12 fail to validate the user permission when accessing the files and subscribing to the block in Boards, which allows an authenticated user to access other board files and was able to subscribe to the block from other boards that the user does not have access to	Mattermost
CVE-2025-12756	Dec 01, 2025	Mattermost 10-11 <=10.12.1: Auth. editor can delete others' Boards comments Mattermost versions 11.0.x <= 11.0.2, 10.12.x <= 10.12.1, 10.11.x <= 10.11.4, 10.5.x <= 10.5.12 fail to validate user permissions when deleting comments in Boards, which allows an authenticated user with the editor role to delete comments created by other users.	Mattermost
CVE-2025-12421	Nov 27, 2025	Mattermost <=11.0.2 Auth Flow Token Origin Verification Flaw (SSO Code Exchange) Mattermost versions 11.0.x <= 11.0.2, 10.12.x <= 10.12.1, 10.11.x <= 10.11.4, 10.5.x <= 10.5.12 fail to to verify that the token used during the code exchange originates from the same authentication flow, which allows an authenticated user to perform account takeover via a specially crafted email address used when switching authentication methods and sending a request to the /users/login/sso/code-exchange endpoint. The vulnerability requires ExperimentalEnableAuthenticationTransfer to be enabled (default: enabled) and RequireEmailVerification to be disabled (default: disabled).	Mattermost
CVE-2025-12559	Nov 27, 2025	Mattermost 10.x-11.x: Email Addresses Exposed via /api/v4/channels Endpoint Mattermost versions 11.0.x <= 11.0.2, 10.12.x <= 10.12.1, 10.11.x <= 10.11.4, 10.5.x <= 10.5.12 fail to sanitize team email addresses to be visible only to Team Admins, which allows any authenticated user to view team email addresses via the GET /api/v4/channels/{channel_id}/common_teams endpoint	Mattermost
CVE-2025-12419	Nov 27, 2025	Mattermost OAuth State Validation Flaw, Account Takeover in 10.x and 11.0.x Mattermost versions 10.12.x <= 10.12.1, 10.11.x <= 10.11.4, 10.5.x <= 10.5.12, 11.0.x <= 11.0.3 fail to properly validate OAuth state tokens during OpenID Connect authentication which allows an authenticated attacker with team creation privileges to take over a user account via manipulation of authentication data during the OAuth completion flow. This requires email verification to be disabled (default: disabled), OAuth/OpenID Connect to be enabled, and the attacker to control two users in the SSO system with one of them never having logged into Mattermost.	Mattermost
CVE-2025-55074	Nov 18, 2025	Mattermost 10.5.x-10.11.3 Agents Plugin Access Control Bypass Mattermost versions 10.11.x <= 10.11.3, 10.5.x <= 10.5.11 fail to enforce access permissions on the Agents plugin which allows other users to determine when users had read channels via channel member objects	Mattermost