[ Vendor · 19 CVEs ]
Mattermost
CVEs affecting Mattermost published in the last 30 days, plus any Mattermost CVE on CISA's exploited list.
| CVE | Published | Severity | Vulnerability | Signals |
|---|---|---|---|---|
| CVE-2026-13411 | 22 Oct 2026 | CVSS 4.3 | MattermostMattermost versions 11.7.x <= 11.7.11 fail to validate null elements when decoding playbook import conditions which allows an authenticated attacker… | |
| CVE-2026-18799 | 16 Oct 2026 | CVSS 4.3 | MattermostMattermost versions 11.10.x <= 11.10.0, 11.7.x <= 11.7.9, 11.9.x <= 11.9.1, 11.8.x <= 11.8.5 fail to restrict Slack import account binding to system… | |
| CVE-2026-19076 | 16 Oct 2026 | CVSS 4.4 | MattermostMattermost versions 11.10.x <= 11.10.0, 11.7.x <= 11.7.9, 11.9.x <= 11.9.1, 11.8.x <= 11.8.5 fail to reject OAuth application sessions in the account… | |
| CVE-2026-19600 | 16 Oct 2026 | CVSS 4.5 | MattermostMattermost versions 11.9.x <= 11.9.1, 11.8.x <= 11.8.5, 11.7.x <= 11.7.10, 11.10.x <= 11.10.1 fail to sanitize authentication tokens before writing… | |
| CVE-2026-19621 | 16 Oct 2026 | CVSS 6.5 | MattermostMattermost versions 11.10.x <= 11.10.0, 11.7.x <= 11.7.9, 11.9.x <= 11.9.1, 11.8.x <= 11.8.5 fail to strip action integration secrets from post… | |
| CVE-2026-16251 | 16 Oct 2026 | CVSS 6.5 | MattermostMattermost versions 11.10.x <= 11.10.0, 11.7.x <= 11.7.9, 11.9.x <= 11.9.1, 11.8.x <= 11.8.5 fail to limit the size of remote image responses… | |
| CVE-2026-16453 | 16 Oct 2026 | CVSS 7.1 | MattermostMattermost versions 11.10.x <= 11.10.0, 11.7.x <= 11.7.9, 11.9.x <= 11.9.1, 11.8.x <= 11.8.5 fail to verify the integrity of the SAML RelayState POST… | |
| CVE-2026-18223 | 16 Oct 2026 | CVSS 5.0 | MattermostMattermost versions 11.10.x <= 11.10.0, 11.7.x <= 11.7.9, 11.9.x <= 11.9.1, 11.8.x <= 11.8.5 fail to validate the invited recipient's email address… | |
| CVE-2026-18256 | 16 Oct 2026 | CVSS 4.3 | MattermostMattermost versions 11.10.x <= 11.10.0, 11.7.x <= 11.7.9, 11.9.x <= 11.9.1, 11.8.x <= 11.8.5 fail to properly restrict private teams from public team… | |
| CVE-2026-18560 | 16 Oct 2026 | CVSS 4.3 | MattermostMattermost versions 11.10.x <= 11.10.0, 11.7.x <= 11.7.9, 11.9.x <= 11.9.1, 11.8.x <= 11.8.5 fail to validate user’s permissions before other… | |
| CVE-2026-19867 | 16 Oct 2026 | CVSS 4.3 | MattermostMattermost versions 11.10.x <= 11.10.0, 11.9.x <= 11.9.1, 11.8.x <= 11.8.5, 11.7.x <= 11.7.10 fail to cap the number and size of mention keys stored… | |
| CVE-2026-18551 | 16 Oct 2026 | CVSS 6.5 | MattermostMattermost versions 11.10.x <= 11.10.0, 11.7.x <= 11.7.9, 11.9.x <= 11.9.1, 11.8.x <= 11.8.5 fail to validate the combination of guest and admin… | |
| CVE-2026-18795 | 16 Oct 2026 | CVSS 6.4 | MattermostMattermost versions 11.10.x <= 11.10.0, 11.7.x <= 11.7.9, 11.9.x <= 11.9.1, 11.8.x <= 11.8.5 fail to enforce DM/GM check on server side which allows… | |
| CVE-2026-19541 | 16 Oct 2026 | CVSS 6.5 | MattermostMattermost versions 11.9.x <= 11.9.1, 11.8.x <= 11.8.5, 11.7.x <= 11.7.10, 11.10.x <= 11.10.1 fail to require re-entry of the stored client secret… | |
| CVE-2026-19601 | 16 Oct 2026 | CVSS 4.9 | MattermostMattermost versions 11.9.x <= 11.9.1, 11.8.x <= 11.8.5, 11.7.x <= 11.7.10, 11.10.x <= 11.10.1 fail to invalidate the stored AD/LDAP bind password… | |
| CVE-2026-19603 | 16 Oct 2026 | CVSS 4.3 | MattermostMattermost versions 11.9.x <= 11.9.1, 11.8.x <= 11.8.5, 11.7.x <= 11.7.10, 11.10.x <= 11.10.1 fail to sanitize the active channel field returned by… | |
| CVE-2026-96260 | 22 Sep 2026 | CVSS 6.5 | MattermostMattermost versions 11.9.x <= 11.9.1, 11.8.x <= 11.8.5, 11.7.x <= 11.7.10, 11.10.x <= 11.10.1 fail to enforce a request body size limit during CSRF… | Fix |
| CVE-2026-96259 | 22 Sep 2026 | CVSS 5.5 | MattermostMattermost versions 11.9.x <= 11.9.1, 11.8.x <= 11.8.5, 11.7.x <= 11.7.10, 11.10.x <= 11.10.1 fail to apply the internal-connection filter to OAuth… | Fix |
| CVE-2026-95666 | 22 Sep 2026 | CVSS 4.3 | MattermostMattermost versions 11.9.x <= 11.9.1, 11.8.x <= 11.8.5, 11.7.x <= 11.7.10, 11.10.x <= 11.10.1 fail to limit the length of the post ID array accepted… | Fix |