{"schema_version":1,"title":"Mattermost vulnerabilities","summary":"Junglewise Threat Intelligence has tracked 9 vulnerabilities in Mattermost: 0 in the last 7 days and 6 in the last 90 days, 0 of them critical and 0 exploited in the wild. The most recent, CVE-2026-14344, was published on 14 September 2026.","url":"https://junglewise.ai/threats/technologies/mattermost","json_url":"https://junglewise.ai/threats/technologies/mattermost.json","publisher":"Junglewise Threat Intelligence","license":"CC-BY-4.0","license_url":"https://creativecommons.org/licenses/by/4.0/","attribution":"Junglewise Threat Intelligence, https://junglewise.ai/threats/technologies/mattermost","sources":"NVD, GitHub Security Advisories, OSV, the CISA Known Exploited Vulnerabilities catalog, FIRST EPSS and vendor advisories","kind":"technology","counts":{"high":1,"all_time":9,"critical":0,"exploited":0,"last_7_days":0,"last_30_days":1,"last_90_days":6,"last_365_days":9},"latest":[{"cve":"CVE-2026-14344","cvss":4.3,"epss":0.0015,"slug":"cve-2026-14344-mattermost-permission-bypass-in-board-creation","title":"Mattermost permission bypass in board creation","severity":"medium","exploited":false,"published_at":"2026-09-14T11:17:03.573+00:00","url":"https://junglewise.ai/threats/cve-2026-14344-mattermost-permission-bypass-in-board-creation"},{"cve":"CVE-2026-9816","cvss":8.3,"epss":0.0035,"slug":"cve-2026-9816-mattermost-privilege-escalation-via-boardmember-scheme-validation","title":"Mattermost privilege escalation via BoardMember.Scheme validation bypass","severity":"high","exploited":false,"published_at":"2026-08-17T22:17:27.217+00:00","url":"https://junglewise.ai/threats/cve-2026-9816-mattermost-privilege-escalation-via-boardmember-scheme-validation"},{"cve":"CVE-2026-7521","cvss":5.5,"slug":"cve-2026-7521-mattermost-path-traversal-in-file-deletion-endpoint","title":"Mattermost path traversal in file deletion endpoint","severity":"medium","exploited":false,"published_at":"2026-07-28T15:17:51.51+00:00","url":"https://junglewise.ai/threats/cve-2026-7521-mattermost-path-traversal-in-file-deletion-endpoint"},{"cve":"CVE-2026-10600","cvss":4.3,"slug":"cve-2026-10600-mattermost-resource-exhaustion-in-document-content-extraction","title":"Mattermost resource exhaustion in document content extraction","severity":"medium","exploited":false,"published_at":"2026-07-27T15:16:46.623+00:00","url":"https://junglewise.ai/threats/cve-2026-10600-mattermost-resource-exhaustion-in-document-content-extraction"},{"cve":"CVE-2026-6541","cvss":4.3,"slug":"cve-2026-6541-mattermost-authorization-bypass-in-playbook-metric-configuration","title":"Mattermost authorization bypass in Playbook metric configuration","severity":"medium","exploited":false,"published_at":"2026-07-13T11:16:28.08+00:00","url":"https://junglewise.ai/threats/cve-2026-6541-mattermost-authorization-bypass-in-playbook-metric-configuration"},{"cve":"CVE-2026-6850","cvss":6.5,"slug":"cve-2026-6850-mattermost-redos-in-client-side-markdown-parser","title":"Mattermost ReDoS in client-side markdown parser","severity":"medium","exploited":false,"published_at":"2026-07-13T09:16:24.89+00:00","url":"https://junglewise.ai/threats/cve-2026-6850-mattermost-redos-in-client-side-markdown-parser"},{"cve":"CVE-2026-9162","cvss":4.3,"epss":0.0033,"slug":"cve-2026-9162-mattermost-insufficient-session-expiration-in-websocket","title":"Mattermost insufficient session expiration in WebSocket connections","severity":"medium","exploited":false,"published_at":"2026-06-22T14:17:55.91+00:00","url":"https://junglewise.ai/threats/cve-2026-9162-mattermost-insufficient-session-expiration-in-websocket"},{"cve":"CVE-2026-6673","cvss":6.4,"epss":0.003,"slug":"cve-2026-6673-mattermost-authentication-bypass-in-atlassian-connect-callback","title":"Mattermost authentication bypass in Atlassian Connect callback","severity":"medium","exploited":false,"published_at":"2026-06-22T14:17:51.26+00:00","url":"https://junglewise.ai/threats/cve-2026-6673-mattermost-authentication-bypass-in-atlassian-connect-callback"},{"cve":"CVE-2026-5139","cvss":5.4,"epss":0.0029,"slug":"cve-2026-5139-mattermost-missing-authorization-in-gitlab-connect-command","title":"Mattermost missing authorization in GitLab connect command","severity":"medium","exploited":false,"published_at":"2026-06-22T14:17:50.887+00:00","url":"https://junglewise.ai/threats/cve-2026-5139-mattermost-missing-authorization-in-gitlab-connect-command"}],"weekly":[{"week":"2026-06-29","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-07-06","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-07-13","critical":0,"exploited":0,"vulnerabilities":2},{"week":"2026-07-20","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-07-27","critical":0,"exploited":0,"vulnerabilities":2},{"week":"2026-08-03","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-08-10","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-08-17","critical":0,"exploited":0,"vulnerabilities":1},{"week":"2026-08-24","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-08-31","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-09-07","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-09-14","critical":0,"exploited":0,"vulnerabilities":1},{"week":"2026-09-21","critical":0,"exploited":0,"vulnerabilities":0}],"related":[{"name":"Mattermost Server","slug":"server-public","vulnerabilities":69,"url":"https://junglewise.ai/threats/technologies/server-public"},{"name":"Mattermost Desktop App","slug":"desktop-app","vulnerabilities":14,"url":"https://junglewise.ai/threats/technologies/desktop-app"},{"name":"Mattermost Plugins","slug":"mattermost-plugins","vulnerabilities":5,"url":"https://junglewise.ai/threats/technologies/mattermost-plugins"},{"name":"Mattermost GitHub Plugin for Mattermost","slug":"github-plugin","vulnerabilities":3,"url":"https://junglewise.ai/threats/technologies/github-plugin"}],"technology":{"hub":true,"name":"Mattermost","slug":"mattermost","vendor":{"name":"Mattermost","slug":"mattermost","url":"https://junglewise.ai/threats/vendors/mattermost"},"aliases":[],"category":"web-server","homepage":"https://mattermost.com/","repo_url":"https://github.com/mattermost/mattermost-server","description":"Mattermost is an open-source, self-hosted online chat service with file sharing, search, and integrations.","url":"https://junglewise.ai/threats/technologies/mattermost"},"most_severe":[{"cve":"CVE-2026-9816","cvss":8.3,"epss":0.0035,"slug":"cve-2026-9816-mattermost-privilege-escalation-via-boardmember-scheme-validation","title":"Mattermost privilege escalation via BoardMember.Scheme validation bypass","severity":"high","exploited":false,"published_at":"2026-08-17T22:17:27.217+00:00","url":"https://junglewise.ai/threats/cve-2026-9816-mattermost-privilege-escalation-via-boardmember-scheme-validation"},{"cve":"CVE-2026-6850","cvss":6.5,"slug":"cve-2026-6850-mattermost-redos-in-client-side-markdown-parser","title":"Mattermost ReDoS in client-side markdown parser","severity":"medium","exploited":false,"published_at":"2026-07-13T09:16:24.89+00:00","url":"https://junglewise.ai/threats/cve-2026-6850-mattermost-redos-in-client-side-markdown-parser"},{"cve":"CVE-2026-6673","cvss":6.4,"epss":0.003,"slug":"cve-2026-6673-mattermost-authentication-bypass-in-atlassian-connect-callback","title":"Mattermost authentication bypass in Atlassian Connect callback","severity":"medium","exploited":false,"published_at":"2026-06-22T14:17:51.26+00:00","url":"https://junglewise.ai/threats/cve-2026-6673-mattermost-authentication-bypass-in-atlassian-connect-callback"},{"cve":"CVE-2026-7521","cvss":5.5,"slug":"cve-2026-7521-mattermost-path-traversal-in-file-deletion-endpoint","title":"Mattermost path traversal in file deletion endpoint","severity":"medium","exploited":false,"published_at":"2026-07-28T15:17:51.51+00:00","url":"https://junglewise.ai/threats/cve-2026-7521-mattermost-path-traversal-in-file-deletion-endpoint"},{"cve":"CVE-2026-5139","cvss":5.4,"epss":0.0029,"slug":"cve-2026-5139-mattermost-missing-authorization-in-gitlab-connect-command","title":"Mattermost missing authorization in GitLab connect command","severity":"medium","exploited":false,"published_at":"2026-06-22T14:17:50.887+00:00","url":"https://junglewise.ai/threats/cve-2026-5139-mattermost-missing-authorization-in-gitlab-connect-command"},{"cve":"CVE-2026-9162","cvss":4.3,"epss":0.0033,"slug":"cve-2026-9162-mattermost-insufficient-session-expiration-in-websocket","title":"Mattermost insufficient session expiration in WebSocket connections","severity":"medium","exploited":false,"published_at":"2026-06-22T14:17:55.91+00:00","url":"https://junglewise.ai/threats/cve-2026-9162-mattermost-insufficient-session-expiration-in-websocket"},{"cve":"CVE-2026-14344","cvss":4.3,"epss":0.0015,"slug":"cve-2026-14344-mattermost-permission-bypass-in-board-creation","title":"Mattermost permission bypass in board creation","severity":"medium","exploited":false,"published_at":"2026-09-14T11:17:03.573+00:00","url":"https://junglewise.ai/threats/cve-2026-14344-mattermost-permission-bypass-in-board-creation"},{"cve":"CVE-2026-10600","cvss":4.3,"slug":"cve-2026-10600-mattermost-resource-exhaustion-in-document-content-extraction","title":"Mattermost resource exhaustion in document content extraction","severity":"medium","exploited":false,"published_at":"2026-07-27T15:16:46.623+00:00","url":"https://junglewise.ai/threats/cve-2026-10600-mattermost-resource-exhaustion-in-document-content-extraction"},{"cve":"CVE-2026-6541","cvss":4.3,"slug":"cve-2026-6541-mattermost-authorization-bypass-in-playbook-metric-configuration","title":"Mattermost authorization bypass in Playbook metric configuration","severity":"medium","exploited":false,"published_at":"2026-07-13T11:16:28.08+00:00","url":"https://junglewise.ai/threats/cve-2026-6541-mattermost-authorization-bypass-in-playbook-metric-configuration"}],"generated_at":"2026-09-26T09:11:00.170868+00:00"}