# Mattermost. Every CVE that names Mattermost among its affected products, newest first. Vendors and products are as the CNA wrote them. ## Records, newest first - [Path traversal in Mattermost Agents plugin mention reminder allows plugin replacement via crafted post](https://agentprime.io/advisories/CVE-2026-93851.md) `CVE-2026-93851` · CVE record: Mattermost Mattermost · CVSS 8.0 High · Not analysed yet · Published 28 Oct 2026 · Tags: Path traversal - [Team admin can escalate a team member's permissions via the team member roles endpoint](https://agentprime.io/advisories/CVE-2026-93846.md) `CVE-2026-93846` · CVE record: Mattermost Mattermost · CVSS 3.8 Low · Not analysed yet · Published 26 Oct 2026 · Tags: Broken access control - [Mattermost OpenID discovery endpoint request bypasses outbound connection filtering, allowing SSRF by a System Administrator](https://agentprime.io/advisories/CVE-2026-93848.md) `CVE-2026-93848` · CVE record: Mattermost Mattermost · CVSS 2.7 Low · Not analysed yet · Published 26 Oct 2026 · Tags: Server-side request forgery (SSRF) - [Unbounded memory consumption during PDF text extraction](https://agentprime.io/advisories/CVE-2026-93850.md) `CVE-2026-93850` · CVE record: Mattermost Mattermost · CVSS 6.5 Medium · Not analysed yet · Published 26 Oct 2026 · Tags: CWE-409 - [Mattermost allows authenticated users to trigger excessive memory allocation via crafted msgpack binary WebSocket frames](https://agentprime.io/advisories/CVE-2026-93849.md) `CVE-2026-93849` · CVE record: Mattermost Mattermost · CVSS 6.5 Medium · Not analysed yet · Published 26 Oct 2026 · Tags: Denial of service - [Improper post type validation on scheduled post endpoints](https://agentprime.io/advisories/CVE-2026-93847.md) `CVE-2026-93847` · CVE record: Mattermost Mattermost · CVSS 3.5 Low · Not analysed yet · Published 26 Oct 2026 · Tags: Broken access control - [Insufficient length validation when parsing Zoom chat transcriptions](https://agentprime.io/advisories/CVE-2026-116516.md) `CVE-2026-116516` · CVE record: Mattermost Mattermost · CVSS 6.5 Medium · Not analysed yet · Published 26 Oct 2026 · Tags: CWE-754 - [Null condition in Playbooks import crashes the plugin](https://agentprime.io/advisories/CVE-2026-13411.md) `CVE-2026-13411` · CVE record: Mattermost Mattermost · CVSS 4.3 Medium · Not analysed yet · Published 22 Oct 2026 · Tags: CWE-754 - [Mattermost Server fails to restrict Slack import account binding, allowing team admins to forge posts as existing users](https://agentprime.io/advisories/CVE-2026-18799.md) `CVE-2026-18799` · CVE record: Mattermost Mattermost · CVSS 4.3 Medium · Not analysed yet · Published 16 Oct 2026 · Tags: Broken access control - [Mattermost local image proxy allows server memory exhaustion via unbounded image response buffering](https://agentprime.io/advisories/CVE-2026-16251.md) `CVE-2026-16251` · CVE record: Mattermost Mattermost · CVSS 6.5 Medium · Not analysed yet · Published 16 Oct 2026 · Tags: Denial of service - [Private team metadata disclosure via the team search API](https://agentprime.io/advisories/CVE-2026-18256.md) `CVE-2026-18256` · CVE record: Mattermost Mattermost · CVSS 4.3 Medium · Not analysed yet · Published 16 Oct 2026 · Tags: Broken access control - [Mattermost invitation tokens not bound to invited email address allowing unauthorized team and private channel access](https://agentprime.io/advisories/CVE-2026-18223.md) `CVE-2026-18223` · CVE record: Mattermost Mattermost · CVSS 5.0 Medium · Not analysed yet · Published 16 Oct 2026 · Tags: Broken access control - [Mattermost fails to reject OAuth application sessions in account type switch, allowing account takeover via bearer token](https://agentprime.io/advisories/CVE-2026-19076.md) `CVE-2026-19076` · CVE record: Mattermost Mattermost · CVSS 4.4 Medium · Not analysed yet · Published 16 Oct 2026 · Tags: Broken access control - [Improper order of authorisations in Mattermost GetFile API leads to an authenticated user to determine a post’s quarantined status](https://agentprime.io/advisories/CVE-2026-18560.md) `CVE-2026-18560` · CVE record: Mattermost Mattermost · CVSS 4.3 Medium · Not analysed yet · Published 16 Oct 2026 · Tags: Information disclosure - [Mattermost SAML RelayState forgery allows unauthorized team membership](https://agentprime.io/advisories/CVE-2026-16453.md) `CVE-2026-16453` · CVE record: Mattermost Mattermost · CVSS 7.1 High · Not analysed yet · Published 16 Oct 2026 · Tags: CWE-472 - [Mattermost logs plaintext authentication tokens in debug-level server logs on failed auth attempts](https://agentprime.io/advisories/CVE-2026-19600.md) `CVE-2026-19600` · CVE record: Mattermost Mattermost · CVSS 4.5 Medium · Not analysed yet · Published 16 Oct 2026 · Tags: Information disclosure - [Mattermost leaks interactive-message integration secrets to non-admin users via post-deletion events and thread reads](https://agentprime.io/advisories/CVE-2026-19621.md) `CVE-2026-19621` · CVE record: Mattermost Mattermost · CVSS 6.5 Medium · Not analysed yet · Published 16 Oct 2026 · Tags: Information disclosure - [Private channel ID disclosure via user status endpoints](https://agentprime.io/advisories/CVE-2026-19603.md) `CVE-2026-19603` · CVE record: Mattermost Mattermost · CVSS 4.3 Medium · Not analysed yet · Published 16 Oct 2026 · Tags: Information disclosure - [Missing server side validation allowed user to quarantine a DM and GM post](https://agentprime.io/advisories/CVE-2026-18795.md) `CVE-2026-18795` · CVE record: Mattermost Mattermost · CVSS 6.4 Medium · Not analysed yet · Published 16 Oct 2026 · Tags: Broken access control - [Uncapped mention keys in user notification properties allow CPU exhaustion during post processing](https://agentprime.io/advisories/CVE-2026-19867.md) `CVE-2026-19867` · CVE record: Mattermost Mattermost · CVSS 4.3 Medium · Not analysed yet · Published 16 Oct 2026 · Tags: Denial of service - [Disclosure of AD/LDAP bind password via Test Connection](https://agentprime.io/advisories/CVE-2026-19601.md) `CVE-2026-19601` · CVE record: Mattermost Mattermost · CVSS 4.9 Medium · Not analysed yet · Published 16 Oct 2026 · Tags: Information disclosure - [Mattermost guest account privilege escalation via member roles API](https://agentprime.io/advisories/CVE-2026-18551.md) `CVE-2026-18551` · CVE record: Mattermost Mattermost · CVSS 6.5 Medium · Not analysed yet · Published 16 Oct 2026 · Tags: Broken access control - [Outgoing OAuth connection client secret exposure during connection validation](https://agentprime.io/advisories/CVE-2026-19541.md) `CVE-2026-19541` · CVE record: Mattermost Mattermost · CVSS 6.5 Medium · Not analysed yet · Published 16 Oct 2026 · Tags: Information disclosure - [Mattermost server missing request body size limit on plugin routes allows denial of service by an authenticated user](https://agentprime.io/advisories/CVE-2026-96260.md) `CVE-2026-96260` · CVE record: Mattermost Mattermost · CVSS 6.5 Medium · Not analysed yet · Published 22 Sept 2026 · Tags: Denial of service - [Mattermost server-side request forgery via OAuth endpoints configurable by a System Administrator](https://agentprime.io/advisories/CVE-2026-96259.md) `CVE-2026-96259` · CVE record: Mattermost Mattermost · CVSS 5.5 Medium · Not analysed yet · Published 22 Sept 2026 · Tags: Server-side request forgery (SSRF) - [Unbounded post ID array in the bulk reactions endpoint allows denial of service](https://agentprime.io/advisories/CVE-2026-95666.md) `CVE-2026-95666` · CVE record: Mattermost Mattermost · CVSS 4.3 Medium · Not analysed yet · Published 22 Sept 2026 · Tags: Denial of service - [Mattermost Desktop App Missing IPC Sender Validation in Calls Leave Handler](https://agentprime.io/advisories/CVE-2026-12284.md) `CVE-2026-12284` · CVE record: Mattermost Mattermost · CVSS 3.8 Low · Not analysed yet · Published 17 Sept 2026 · Tags: CWE-346 - [Mattermost Desktop App plugin popout scheme validation bypass](https://agentprime.io/advisories/CVE-2026-75588.md) `CVE-2026-75588` · CVE record: Mattermost Mattermost · CVSS 2.6 Low · Not analysed yet · Published 17 Sept 2026 · Tags: CWE-1287 - [Mattermost Desktop local network access from server-rendered content](https://agentprime.io/advisories/CVE-2026-75025.md) `CVE-2026-75025` · CVE record: Mattermost Mattermost · CVSS 4.7 Medium · Not analysed yet · Published 16 Sept 2026 · Tags: CWE-346 - [Data Retention Teams Endpoint Leaks Private Team Invite ID](https://agentprime.io/advisories/CVE-2026-91181.md) `CVE-2026-91181` · CVE record: Mattermost Mattermost · CVSS 6.5 Medium · Not analysed yet · Published 14 Sept 2026 · Tags: Broken access control - [Mattermost DCR redirect URI allowlist bypass via improper URL component validation](https://agentprime.io/advisories/CVE-2026-12985.md) `CVE-2026-12985` · CVE record: Mattermost Mattermost · CVSS 6.8 Medium · Not analysed yet · Published 14 Sept 2026 · Tags: Open redirect - [Mattermost ABAC parent policy bypass via policy update endpoint](https://agentprime.io/advisories/CVE-2026-82920.md) `CVE-2026-82920` · CVE record: Mattermost Mattermost · CVSS 5.5 Medium · Not analysed yet · Published 14 Sept 2026 · Tags: Broken access control - [MS Calendar plugin: unrecovered handler panics from malformed post-action requests could crash the plugin process](https://agentprime.io/advisories/CVE-2026-86348.md) `CVE-2026-86348` · CVE record: Mattermost Mattermost · CVSS 4.3 Medium · Not analysed yet · Published 14 Sept 2026 · Tags: CWE-704 - [Mattermost Server Algorithmic DoS via Unbounded Markdown Block Nesting](https://agentprime.io/advisories/CVE-2026-86349.md) `CVE-2026-86349` · CVE record: Mattermost Mattermost · CVSS 4.3 Medium · Not analysed yet · Published 14 Sept 2026 · Tags: Denial of service - [Unauthenticated webhook request with null notification entry could crash the Microsoft Calendar plugin.](https://agentprime.io/advisories/CVE-2026-10556.md) `CVE-2026-10556` · CVE record: Mattermost Mattermost · CVSS 5.3 Medium · Not analysed yet · Published 14 Sept 2026 · Tags: CWE-754 - [Boards plugin denial of service via unvalidated block fields.properties](https://agentprime.io/advisories/CVE-2026-13417.md) `CVE-2026-13417` · CVE record: Mattermost Mattermost · CVSS 4.3 Medium · Not analysed yet · Published 14 Sept 2026 · Tags: CWE-754 - [Missing property field ownership validation in Playbooks run property update endpoint](https://agentprime.io/advisories/CVE-2026-9812.md) `CVE-2026-9812` · CVE record: Mattermost Mattermost · CVSS 6.5 Medium · Not analysed yet · Published 14 Sept 2026 · Tags: Broken access control - [Playbooks run owner channel membership permission bypass](https://agentprime.io/advisories/CVE-2026-8821.md) `CVE-2026-8821` · CVE record: Mattermost Mattermost · CVSS 7.1 High · Not analysed yet · Published 14 Sept 2026 · Tags: Broken access control - [Unbounded zlib decompression in Calls SDP WebSocket messages](https://agentprime.io/advisories/CVE-2026-5132.md) `CVE-2026-5132` · CVE record: Mattermost Mattermost · CVSS 6.5 Medium · Not analysed yet · Published 14 Sept 2026 · Tags: CWE-409 - [Uploading a crafted image causes excessive memory allocation in the Mattermost Server](https://agentprime.io/advisories/CVE-2026-15814.md) `CVE-2026-15814` · CVE record: Mattermost Mattermost · CVSS 6.5 Medium · Not analysed yet · Published 14 Sept 2026 · Tags: CWE-409 - [Playbooks channel action update validation issue](https://agentprime.io/advisories/CVE-2026-10542.md) `CVE-2026-10542` · CVE record: Mattermost Mattermost · CVSS 5.0 Medium · Not analysed yet · Published 14 Sept 2026 · Tags: Broken access control - [Inconsistent authorization checks in Mattermost Boards endpoints](https://agentprime.io/advisories/CVE-2026-14344.md) `CVE-2026-14344` · CVE record: Mattermost Mattermost · CVSS 4.3 Medium · Not analysed yet · Published 14 Sept 2026 · Tags: Broken access control - [Mattermost Markdown autolink parsing denial of service](https://agentprime.io/advisories/CVE-2026-12882.md) `CVE-2026-12882` · CVE record: Mattermost Mattermost · CVSS 4.3 Medium · Not analysed yet · Published 14 Sept 2026 · Tags: Denial of service - [Fix authenticated members disabling file content indexing server-wide via extraction pool exhaustion](https://agentprime.io/advisories/CVE-2026-11993.md) `CVE-2026-11993` · CVE record: Mattermost Mattermost · CVSS 4.3 Medium · Not analysed yet · Published 14 Sept 2026 · Tags: Denial of service - [Board archive import bypasses team board creation permissions](https://agentprime.io/advisories/CVE-2026-14259.md) `CVE-2026-14259` · CVE record: Mattermost Mattermost · CVSS 4.3 Medium · Not analysed yet · Published 14 Sept 2026 · Tags: Broken access control - [Plaintext pre-auth secret exposure via Desktop App diagnostics report](https://agentprime.io/advisories/CVE-2026-75587.md) `CVE-2026-75587` · CVE record: Mattermost Mattermost · CVSS 3.6 Low · Not analysed yet · Published 17 Aug 2026 · Tags: Information disclosure - [Mattermost thread memberships persist after team removal, exposing private channel thread metadata on re-invite](https://agentprime.io/advisories/CVE-2026-9693.md) `CVE-2026-9693` · CVE record: Mattermost Mattermost · CVSS 3.5 Low · Not analysed yet · Published 17 Aug 2026 · Tags: CWE-459 - [Mattermost Boards plugin didn’t enforce role-based authorization on board channel link allowing board editors to expose boards to arbitrary channels](https://agentprime.io/advisories/CVE-2026-9859.md) `CVE-2026-9859` · CVE record: Mattermost Mattermost · CVSS 6.5 Medium · Not analysed yet · Published 17 Aug 2026 · Tags: Broken access control - [Insufficient server-side validation of board member role fields permits privilege escalation](https://agentprime.io/advisories/CVE-2026-9816.md) `CVE-2026-9816` · CVE record: Mattermost Mattermost · CVSS 8.3 High · Not analysed yet · Published 17 Aug 2026 · Tags: Broken access control - [Boards plugin panics on WebSocket command with non-string field types](https://agentprime.io/advisories/CVE-2026-10080.md) `CVE-2026-10080` · CVE record: Mattermost Mattermost · CVSS 6.5 Medium · Not analysed yet · Published 17 Aug 2026 · Tags: CWE-704 - [Boards plugin retains Board Admin rights for users demoted to System Guest](https://agentprime.io/advisories/CVE-2026-10527.md) `CVE-2026-10527` · CVE record: Mattermost Mattermost · CVSS 6.3 Medium · Not analysed yet · Published 17 Aug 2026 · Tags: Broken access control - [Missing per-channel team-scope check in ABAC access control policy unassign allows cross-team policy removal](https://agentprime.io/advisories/CVE-2026-15754.md) `CVE-2026-15754` · CVE record: Mattermost Mattermost · CVSS 4.2 Medium · Not analysed yet · Published 17 Aug 2026 · Tags: Broken access control - [Insufficient validation of guest board admin privileges on archive import](https://agentprime.io/advisories/CVE-2026-16044.md) `CVE-2026-16044` · CVE record: Mattermost Mattermost · CVSS 3.9 Low · Not analysed yet · Published 17 Aug 2026 · Tags: Broken access control - [Delegated OAuth tokens could revoke unrelated OAuth application authorizations](https://agentprime.io/advisories/CVE-2026-16045.md) `CVE-2026-16045` · CVE record: Mattermost Mattermost · CVSS 2.7 Low · Not analysed yet · Published 17 Aug 2026 · Tags: Broken access control - [\_GitLab Plugin allows cross-channel post injection and phishing via missing channel permission checks in issue API endpoints\_](https://agentprime.io/advisories/CVE-2026-16049.md) `CVE-2026-16049` · CVE record: Mattermost Mattermost · CVSS 3.9 Low · Not analysed yet · Published 17 Aug 2026 · Tags: Broken access control - [Board channel linking without read channel permission validation](https://agentprime.io/advisories/CVE-2026-16047.md) `CVE-2026-16047` · CVE record: Mattermost Mattermost · CVSS 4.3 Medium · Not analysed yet · Published 17 Aug 2026 · Tags: Broken access control - [Missing run-state validation on finished playbook runs](https://agentprime.io/advisories/CVE-2026-16046.md) `CVE-2026-16046` · CVE record: Mattermost Mattermost · CVSS 3.5 Low · Not analysed yet · Published 17 Aug 2026 · Tags: Broken access control - [Channel member roles accept out-of-scope roles](https://agentprime.io/advisories/CVE-2026-16048.md) `CVE-2026-16048` · CVE record: Mattermost Mattermost · CVSS 6.3 Medium · Not analysed yet · Published 17 Aug 2026 · Tags: Broken access control - [Boards archive import endpoint allows resource exhaustion via zip bomb and file size limit bypass in Mattermost](https://agentprime.io/advisories/CVE-2026-14298.md) `CVE-2026-14298` · CVE record: Mattermost Mattermost · CVSS 6.5 Medium · Not analysed yet · Published 13 Aug 2026 · Tags: CWE-409 - [SAML certificate deletion allows path traversal to delete arbitrary files outside the config directory](https://agentprime.io/advisories/CVE-2026-7521.md) `CVE-2026-7521` · CVE record: Mattermost Mattermost · CVSS 5.5 Medium · Not analysed yet · Published 28 Jul 2026 · Tags: Path traversal Older: ## Filters and formats Filters are query parameters on this URL: `q` (words, as in a web search engine: `"a phrase"`, `OR`, `-word`; an id; a package or product name), `severity` (low, medium, high or critical), `critical=1`, `kev=1`, `ecosystem` (npm, pypi, packagist, go, maven, rubygems, crates, nuget, hex), `kind=package`, `assigner` (a CNA’s short name), `min_score` and `state`. Each record’s title links to its Markdown page. - The same list as JSON: - Every list: , critical: ; by weakness: and the other tags in ; by technology: `/advisories/technology/.md` (`fortinet-fortimail`) --- The web page: . Everything for agents: .