Vendor
Mattermost vulnerabilities
Updated . Rebuilt every hour.
Junglewise Threat Intelligence has tracked 146 vulnerabilities in Mattermost: 0 in the last 7 days and 43 in the last 90 days, 2 of them critical and 0 exploited in the wild. The most recent, CVE-2026-93851, was published on 28 October 2026. 20 vulnerabilities in the last four weeks, down 5% on the four before (21). 5 technologies have a page of their own.
- Last 7 days
- 0
- Last 90 days
- 43
- Critical, all time
- 2
- Exploited in the wild
- 0
About Mattermost
Open-source team collaboration and messaging platform with self-hosting capabilities.
Mattermost technologies
Latest Mattermost vulnerabilities
- CVE-2026-93851: Mattermost CSRF via Agents plugin mention reminder validationhighCVSS 8
- CVE-2026-93850: Mattermost denial of service via PDF text extraction memory exhaustionmediumCVSS 6.5
- CVE-2026-93849: Mattermost denial of service in WebSocket msgpack decodermediumCVSS 6.5
- CVE-2026-116516: Mattermost Agents plugin denial of service via Zoom chat summarizationmediumCVSS 6.5
- CVE-2026-13411: Mattermost Playbooks plugin denial of service via null condition in importmediumCVSS 4.3
- CVE-2026-19621: Mattermost information disclosure in post deletion eventsmediumCVSS 6.5EPSS 0.3%
- CVE-2026-19600: Mattermost authentication token leak in server logsmediumCVSS 4.5EPSS 0.2%
- CVE-2026-19076: Mattermost authentication bypass in OAuth account takeovermediumCVSS 4.4EPSS 0.2%
- CVE-2026-18799: Mattermost Slack import account binding privilege escalationmediumCVSS 4.3EPSS 0.1%
- CVE-2026-18560: Mattermost authorization bypass in post flag statusmediumCVSS 4.3EPSS 0.2%
- CVE-2026-18256: Mattermost information disclosure in team searchmediumCVSS 4.3EPSS 0.2%
- CVE-2026-18223: Mattermost email validation bypass in invitation tokensmediumCVSS 5EPSS 0.2%
- CVE-2026-16453: Mattermost SAML RelayState integrity verification bypasshighCVSS 7.1EPSS 0.2%
- CVE-2026-16251: Mattermost Server memory exhaustion in remote image proxymediumCVSS 6.5EPSS 0.3%
- CVE-2026-19867: Mattermost Server denial of service via oversized mention keysmediumCVSS 4.3EPSS 0.2%
- CVE-2026-19603: Mattermost information disclosure in user status APImediumCVSS 4.3EPSS 0.2%
- CVE-2026-19601: Mattermost AD/LDAP bind password exposure in system configurationmediumCVSS 4.9EPSS 0.2%
- CVE-2026-19541: Mattermost OAuth connection secret exposure via validation bypassmediumCVSS 6.5EPSS 0.2%
- CVE-2026-18795: Mattermost authorization bypass in DM/GM post quarantinemediumCVSS 6.4EPSS 0.1%
- CVE-2026-18551: Mattermost privilege escalation in guest and admin role validationmediumCVSS 6.5EPSS 0.2%
- CVE-2026-96260: Mattermost memory exhaustion in CSRF validation for plugin endpointsmediumCVSS 6.5EPSS 0.4%
- CVE-2026-96259: Mattermost internal-connection filter bypass in OAuth endpointsmediumCVSS 5.5EPSS 0.3%
- CVE-2026-95666: Mattermost denial of service via unbounded post ID arraymediumCVSS 4.3EPSS 0.4%
- CVE-2026-75588: Mattermost Desktop App URL scheme validation bypasslowCVSS 2.6EPSS 0.2%
- CVE-2026-12284: Mattermost Desktop App IPC validation bypass in leaveCall handlerlowCVSS 3.7EPSS 0.1%
Most severe Mattermost vulnerabilities
Exploited in the wild first, then by severity and CVSS score.
- CVE-2025-12421: GO-2025-4170 - Mattermost fails to to verify the token used during code exchange in github.com/mattermost/mattermost-servercriticalCVSS 9.9EPSS 0.4%
- CVE-2025-12419: Mattermost fails to properly validate OAuth state tokens during OpenID Connect authenticationcriticalCVSS 9.9EPSS 0.4%
- CVE-2026-7387: Mattermost privilege escalation in group syncable link and patch endpointshighCVSS 8.8EPSS 0.4%
- CVE-2026-6346: Mattermost sensitive information disclosure in support packet generationhighCVSS 8.7EPSS 0.4%
- CVE-2026-9816: Mattermost privilege escalation via BoardMember.Scheme validation bypasshighCVSS 8.3EPSS 0.4%
- CVE-2026-25773: Mattermost Focalboard SQL injection in category reorder APIhighCVSS 8.1EPSS 0.4%
- CVE-2026-4858: Mattermost path traversal in integration action URLhighCVSS 8EPSS 0.4%
- CVE-2026-93851: Mattermost CSRF via Agents plugin mention reminder validationhighCVSS 8
- CVE-2026-6957: Mattermost Plugins path traversal in shared-channel attachment synchighCVSS 8
- CVE-2026-6961: Mattermost path traversal in shared channel file synchighCVSS 7.6EPSS 0.4%
Vulnerabilities per week
20 vulnerabilities in the last four weeks, down 5% on the four before (21). The last 13 weeks, by the week each vulnerability was published.
| Week of | Bar | Vulns | Critical |
|---|---|---|---|
| 17 Aug 2026 | 2 | 0 | |
| 24 Aug 2026 | 0 | 0 | |
| 31 Aug 2026 | 0 | 0 | |
| 7 Sep 2026 | 0 | 0 | |
| 14 Sep 2026 | 18 | 0 | |
| 21 Sep 2026 | 3 | 0 | |
| 28 Sep 2026 | 0 | 0 | |
| 5 Oct 2026 | 0 | 0 | |
| 12 Oct 2026 | 15 | 0 | |
| 19 Oct 2026 | 1 | 0 | |
| 26 Oct 2026 | 4 | 0 | |
| 2 Nov 2026 | 0 | 0 | |
| 9 Nov 2026 | 0 | 0 |
Embed a badge
A live badge for a README, a status page or an internal wiki: how many Mattermost vulnerabilities were published in the last 7 days and how many of them are critical, refreshed hourly.
[](https://junglewise.ai/threats/vendors/mattermost)<a href="https://junglewise.ai/threats/vendors/mattermost"><img src="https://junglewise.ai/threats/vendors/mattermost/badge.svg" alt="Mattermost vulnerabilities" /></a>How this is built
Junglewise Threat Intelligence collects vulnerabilities from NVD, GitHub Security Advisories, OSV, the CISA Known Exploited Vulnerabilities catalog, FIRST EPSS and vendor advisories, and matches each one to the technologies and vendors it affects. Dates are the date a vulnerability was published, in UTC.
The pages are rebuilt from the database every hour. Frozen weekly and monthly reports never change once published, so they can be cited.
Use this data
The same data is at https://junglewise.ai/threats/vendors/mattermost.json, and this page as text at https://junglewise.ai/threats/vendors/mattermost.md, for scripts and language models. It is free to reuse under CC BY 4.0 with a link back to this page.
Cite as: Junglewise Threat Intelligence, "Mattermost vulnerabilities", https://junglewise.ai/threats/vendors/mattermost, 12 November 2026.