# github.com/mattermost/mattermost-server/v6 (Go) vulnerabilities Source: https://junglewise.ai/threats/technologies/github-com-mattermost-mattermost-server-v6 Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats Updated: 13 November 2026, 03:07 UTC. Rebuilt every hour. Data: https://junglewise.ai/threats/technologies/github-com-mattermost-mattermost-server-v6.json License: CC BY 4.0 with a link back Junglewise Threat Intelligence has tracked 222 vulnerabilities in github.com/mattermost/mattermost-server/v6 (Go): 0 in the last 7 days and 0 in the last 90 days, 2 of them critical and 0 exploited in the wild. The most recent, CVE-2026-3114, was published on 25 June 2026. ## Counts - Last 7 days: 0 - Last 30 days: 0 - Last 90 days: 0 - All time: 222 (2 critical, 0 exploited in the wild) ## About github.com/mattermost/mattermost-server/v6 (Go) Go-based server implementation for Mattermost team collaboration and messaging platform. ## Latest github.com/mattermost/mattermost-server/v6 (Go) vulnerabilities - [CVE-2026-3114: Mattermost doesn't validate decompressed archive entry sizes during file extraction](https://junglewise.ai/threats/cve-2026-3114-mattermost-doesn-t-validate-decompressed-archive-entry-sizes) (low, CVSS 3.1, published 25 Jun 2026) - [CVE-2026-27659: GO-2026-5629 - Mattermost doesn't properly validate CSRF tokens in github.com/mattermost/mattermost-server](https://junglewise.ai/threats/cve-2026-27659-mattermost-doesn-t-properly-validate-csrf-tokens) (low, CVSS 3.1, published 25 Jun 2026) - [CVE-2026-3115: Mattermost allows authenticated guest users to enumerate user IDs outside their allowed visibility scope](https://junglewise.ai/threats/cve-2026-3115-mattermost-allows-authenticated-guest-users-to-enumerate-user-ids) (low, CVSS 3.1, published 25 Jun 2026) - [CVE-2026-28741: GO-2026-5495 - Mattermost doesn't validate CSRF tokens on an authentication endpoint in…](https://junglewise.ai/threats/cve-2026-28741-mattermost-doesn-t-validate-csrf-tokens-on-an-authentication) (low, CVSS 3.1, published 25 Jun 2026) - [CVE-2026-27656: Mattermost allows attackers to take over arbitrary user accounts via overly permissive substring matching flaw](https://junglewise.ai/threats/cve-2026-27656-mattermost-allows-attackers-to-take-over-arbitrary-user-accounts) (low, CVSS 3.1, published 25 Jun 2026) - [CVE-2026-4274: GO-2026-5393 - Mattermost has an Incorrect Authorization issue in github.com/mattermost/mattermost-server](https://junglewise.ai/threats/cve-2026-4274-mattermost-has-an-incorrect-authorization-issue) (low, CVSS 3.1, published 25 Jun 2026) - [CVE-2026-20719: Mattermost: Authenticated DoS through failure to prevent rendering of external SVGs on link embeds](https://junglewise.ai/threats/cve-2026-20719-mattermost-authenticated-dos-through-failure-to-prevent-rendering) (low, CVSS 3.1, published 25 Jun 2026) - [CVE-2026-3108: Mattermost allows attackers to manipulate administrator terminals via crafted messages containing ANSI and OSC escape…](https://junglewise.ai/threats/cve-2026-3108-mattermost-allows-attackers-to-manipulate-administrator-terminals) (low, CVSS 3.1, published 25 Jun 2026) - [CVE-2026-3112: Mattermost allows system administrators to read arbitrary host files via malicious AdvancedLoggingJSON configuration](https://junglewise.ai/threats/cve-2026-3112-mattermost-allows-system-administrators-to-read-arbitrary-host) (low, CVSS 3.1, published 25 Jun 2026) - [CVE-2026-8823: Mattermost incorrect authorization in demote-user API](https://junglewise.ai/threats/cve-2026-8823-mattermost-incorrect-authorization-in-demote-user-api) (low, CVSS 3.8, published 22 Jun 2026) - [CVE-2026-7387: Mattermost privilege escalation in group syncable link and patch endpoints](https://junglewise.ai/threats/cve-2026-7387-mattermost-privilege-escalation-in-group-syncable-link-and-patch) (high, CVSS 8.8, published 12 Jun 2026) - [CVE-2026-7184: Mattermost sensitive information disclosure in Remote Cluster API](https://junglewise.ai/threats/cve-2026-7184-mattermost-sensitive-information-disclosure-in-remote-cluster-api) (medium, CVSS 6.5, published 12 Jun 2026) - [CVE-2026-6961: Mattermost path traversal in shared channel file sync](https://junglewise.ai/threats/cve-2026-6961-mattermost-path-traversal-in-shared-channel-file-sync) (high, CVSS 7.6, published 12 Jun 2026) - [CVE-2026-6739: Mattermost privilege escalation in role patch API](https://junglewise.ai/threats/cve-2026-6739-mattermost-privilege-escalation-in-role-patch-api) (medium, CVSS 6.7, published 12 Jun 2026) - [CVE-2026-6689: Mattermost missing authorization for invite settings during team creation](https://junglewise.ai/threats/cve-2026-6689-mattermost-missing-authorization-for-invite-settings-during-team) (medium, CVSS 4.3, published 12 Jun 2026) - [CVE-2026-6046: Mattermost message interception via predictable bot usernames](https://junglewise.ai/threats/cve-2026-6046-mattermost-message-interception-via-predictable-bot-usernames) (medium, CVSS 5.3, published 12 Jun 2026) - [CVE-2026-3433: Mattermost information disclosure in role_updated WebSocket events](https://junglewise.ai/threats/cve-2026-3433-mattermost-information-disclosure-in-role-updated-websocket-events) (medium, CVSS 4.3, published 12 Jun 2026) - [CVE-2026-4915: Mattermost Server denial of service via null webhook attachment](https://junglewise.ai/threats/cve-2026-4915-mattermost-server-denial-of-service-via-null-webhook-attachment) (medium, CVSS 6.5, published 25 May 2026) - [CVE-2026-5740: Mattermost Server denial of service via msgpack WebSocket frames](https://junglewise.ai/threats/cve-2026-5740-mattermost-server-denial-of-service-via-msgpack-websocket-frames) (high, CVSS 7.5, published 22 May 2026) - [CVE-2026-4055: Mattermost incorrect authorization in Playbook run creation](https://junglewise.ai/threats/cve-2026-4055-mattermost-incorrect-authorization-in-playbook-run-creation) (medium, CVSS 4.3, published 21 May 2026) - [CVE-2026-6346: Mattermost sensitive information disclosure in support packet generation](https://junglewise.ai/threats/cve-2026-6346-mattermost-sensitive-information-disclosure-in-support-packet) (high, CVSS 8.7, published 18 May 2026) - [CVE-2026-6345: Mattermost password disclosure in user creation](https://junglewise.ai/threats/cve-2026-6345-mattermost-password-disclosure-in-user-creation) (medium, CVSS 6.5, published 18 May 2026) - [CVE-2026-6343: Mattermost Incorrect Authorization in Playbooks via /get endpoint](https://junglewise.ai/threats/cve-2026-6343-mattermost-incorrect-authorization-in-playbooks-via-get-endpoint) (medium, CVSS 4.3, published 18 May 2026) - [CVE-2026-6339: Mattermost origin validation error in burn-on-read reveal endpoint](https://junglewise.ai/threats/cve-2026-6339-mattermost-origin-validation-error-in-burn-on-read-reveal-endpoint) (medium, CVSS 4.3, published 18 May 2026) - [CVE-2026-6333: Mattermost Server SSRF via Host header in slash commands](https://junglewise.ai/threats/cve-2026-6333-mattermost-server-ssrf-via-host-header-in-slash-commands) (low, CVSS 3.5, published 18 May 2026) ## Most severe github.com/mattermost/mattermost-server/v6 (Go) vulnerabilities - [CVE-2025-12421: GO-2025-4170 - Mattermost fails to to verify the token used during code exchange in github.com/mattermost/mattermost-server](https://junglewise.ai/threats/cve-2025-12421-mattermost-fails-to-to-verify-the-token-used-during-code-exchange) (critical, CVSS 9.9, published 27 Nov 2025) - [CVE-2025-12419: Mattermost fails to properly validate OAuth state tokens during OpenID Connect authentication](https://junglewise.ai/threats/cve-2025-12419-mattermost-fails-to-properly-validate-oauth-state-tokens-during) (critical, CVSS 9.9, published 27 Nov 2025) - [CVE-2026-7387: Mattermost privilege escalation in group syncable link and patch endpoints](https://junglewise.ai/threats/cve-2026-7387-mattermost-privilege-escalation-in-group-syncable-link-and-patch) (high, CVSS 8.8, published 12 Jun 2026) - [CVE-2026-6346: Mattermost sensitive information disclosure in support packet generation](https://junglewise.ai/threats/cve-2026-6346-mattermost-sensitive-information-disclosure-in-support-packet) (high, CVSS 8.7, published 18 May 2026) - [CVE-2026-6961: Mattermost path traversal in shared channel file sync](https://junglewise.ai/threats/cve-2026-6961-mattermost-path-traversal-in-shared-channel-file-sync) (high, CVSS 7.6, published 12 Jun 2026) - [CVE-2026-5740: Mattermost Server denial of service via msgpack WebSocket frames](https://junglewise.ai/threats/cve-2026-5740-mattermost-server-denial-of-service-via-msgpack-websocket-frames) (high, CVSS 7.5, published 22 May 2026) - [CVE-2025-14273: Mattermost with Jira plugin enabled has Incorrect Implementation of Authentication Algorithm](https://junglewise.ai/threats/cve-2025-14273-mattermost-with-jira-plugin-enabled-has-incorrect-implementation) (high, CVSS 7.2, published 22 Dec 2025) - [CVE-2026-6739: Mattermost privilege escalation in role patch API](https://junglewise.ai/threats/cve-2026-6739-mattermost-privilege-escalation-in-role-patch-api) (medium, CVSS 6.7, published 12 Jun 2026) - [CVE-2026-7184: Mattermost sensitive information disclosure in Remote Cluster API](https://junglewise.ai/threats/cve-2026-7184-mattermost-sensitive-information-disclosure-in-remote-cluster-api) (medium, CVSS 6.5, published 12 Jun 2026) - [CVE-2026-6345: Mattermost password disclosure in user creation](https://junglewise.ai/threats/cve-2026-6345-mattermost-password-disclosure-in-user-creation) (medium, CVSS 6.5, published 18 May 2026) ## Vulnerabilities per week Nothing was published in the last eight weeks. | Week of | Vulns | Critical | Exploited | | --- | --- | --- | --- | | 17 Aug 2026 | 0 | 0 | 0 | | 24 Aug 2026 | 0 | 0 | 0 | | 31 Aug 2026 | 0 | 0 | 0 | | 7 Sep 2026 | 0 | 0 | 0 | | 14 Sep 2026 | 0 | 0 | 0 | | 21 Sep 2026 | 0 | 0 | 0 | | 28 Sep 2026 | 0 | 0 | 0 | | 5 Oct 2026 | 0 | 0 | 0 | | 12 Oct 2026 | 0 | 0 | 0 | | 19 Oct 2026 | 0 | 0 | 0 | | 26 Oct 2026 | 0 | 0 | 0 | | 2 Nov 2026 | 0 | 0 | 0 | | 9 Nov 2026 | 0 | 0 | 0 | ## Other Go technologies - [github.com/mattermost/mattermost-server (Go)](https://junglewise.ai/threats/technologies/github-com-mattermost-mattermost-server): 297 vulnerabilities - [github.com/mattermost/mattermost/server/v8 (Go)](https://junglewise.ai/threats/technologies/github-com-mattermost-mattermost-server-v8): 207 vulnerabilities - [github.com/mattermost/mattermost-server/v5 (Go)](https://junglewise.ai/threats/technologies/github-com-mattermost-mattermost-server-v5): 199 vulnerabilities - [stdlib (Go)](https://junglewise.ai/threats/technologies/go-stdlib): 178 vulnerabilities - [github.com/siyuan-note/siyuan/kernel (Go)](https://junglewise.ai/threats/technologies/github-com-siyuan-note-siyuan-kernel): 160 vulnerabilities - [code.gitea.io/gitea (Go)](https://junglewise.ai/threats/technologies/code-gitea-io-gitea): 126 vulnerabilities - [code.vikunja.io/api (Go)](https://junglewise.ai/threats/technologies/code-vikunja-io-api): 91 vulnerabilities - [gogs.io/gogs (Go)](https://junglewise.ai/threats/technologies/gogs-io-gogs): 81 vulnerabilities - [github.com/traefik/traefik/v2 (Go)](https://junglewise.ai/threats/technologies/github-com-traefik-traefik-v2): 78 vulnerabilities - [github.com/traefik/traefik (Go)](https://junglewise.ai/threats/technologies/github-com-traefik-traefik): 75 vulnerabilities - [github.com/usememos/memos (Go)](https://junglewise.ai/threats/technologies/github-com-usememos-memos): 75 vulnerabilities - [github.com/traefik/traefik/v3 (Go)](https://junglewise.ai/threats/technologies/github-com-traefik-traefik-v3): 70 vulnerabilities ## Sources NVD, GitHub Security Advisories, OSV, the CISA Known Exploited Vulnerabilities catalog, FIRST EPSS and vendor advisories. Rebuilt every hour. Cite as: Junglewise Threat Intelligence, "github.com/mattermost/mattermost-server/v6 (Go) vulnerabilities", https://junglewise.ai/threats/technologies/github-com-mattermost-mattermost-server-v6, 13 November 2026.