| Mattermost has an Incorrect Authorization issueCVE-2026-8823 · GHSA-XMFH-3CCG-C9FXVersion ranges need review. |
github.com/mattermost/mattermost-server/v5github.com/mattermost/mattermost-server/v6 |
Go |
Low
|
Fix reported |
|
| Mattermost doesn't require system-level permission when patching protected default system rolesCVE-2026-6739 · GHSA-M2W9-H2MM-79QRVersion ranges need review. |
github.com/mattermost/mattermost-server/v5github.com/mattermost/mattermost-server/v6 |
Go |
Medium
|
Fix reported |
|
| Mattermost Playbooks fails to properly validate the props used by the RetrospectivePost custom post typeCVE-2025-41395 · GHSA-3G36-GF7C-75QWVersion ranges need review. |
github.com/mattermost/mattermost-plugin-playbooksgithub.com/mattermost/mattermost-server/v5 |
Go |
Medium
|
Fix reported |
|
| Mattermost Missing Authentication for Critical FunctionCVE-2025-27538 · GHSA-J5JW-M2PH-3JJFVersion ranges need review. |
github.com/mattermost/mattermost-server/v5github.com/mattermost/mattermost-server/v6 |
Go |
Low
|
Fix reported |
|
| Mattermost Incorrect Authorization vulnerabilityCVE-2025-24839 · GHSA-J639-M367-75CFVersion ranges need review. |
github.com/mattermost/mattermost-server/v5github.com/mattermost/mattermost-server/v6 |
Go |
Low
|
Fix reported |
|
| Mattermost vulnerable to Incorrect Implementation of Authentication AlgorithmCVE-2025-2475 · GHSA-6RQH-8465-2XCWVersion ranges need review. |
github.com/mattermost/mattermost-server/v5github.com/mattermost/mattermost-server/v6 |
Go |
Medium
|
Fix reported |
|
| Mattermost Incorrect Authorization vulnerabilityCVE-2025-2564 · GHSA-MJ2P-V2C2-VH4VVersion ranges need review. |
github.com/mattermost/mattermost-server/v5github.com/mattermost/mattermost-server/v6 |
Go |
Medium
|
Fix reported |
|
| Mattermost vulnerable to Observable Timing DiscrepancyCVE-2025-27936 · GHSA-2J87-P623-8CC2Version ranges need review. |
github.com/mattermost/mattermost-plugin-msteamsgithub.com/mattermost/mattermost-server/v5 |
Go |
Medium
|
Fix reported |
|
| Mattermost Fails to Restrict Certain Operations on System AdminsCVE-2025-32093 · GHSA-322V-VH2G-QVPVVersion ranges need review. |
github.com/mattermost/mattermost-server/v5github.com/mattermost/mattermost-server/v6 |
Go |
Medium
|
Fix reported |
|
| Mattermost has Improper Check for Unusual or Exceptional ConditionsCVE-2025-22445 · GHSA-7RGP-4J56-FM79Version ranges need review. |
github.com/mattermost/mattermost-server/v5github.com/mattermost/mattermost-server/v6 |
Go |
Low
|
Fix reported |
|
| Mattermost Improper Validation of Specified Type of Input vulnerabilityCVE-2025-20033 · GHSA-2549-XH72-QRPMVersion ranges need review. |
github.com/mattermost/mattermost-server/v5github.com/mattermost/mattermost-server/v6 |
Go |
Medium
|
Fix reported |
|
| Mattermost doesn't validate that a username returned during bot registration belongs to a bot accountCVE-2026-6046 · GHSA-3VMP-WHVV-5V9VVersion ranges need review. |
github.com/mattermost/mattermost-server/v5github.com/mattermost/mattermost-server/v6 |
Go |
Medium
|
Fix reported |
|
| Mattermost doesn't enforce PermissionInviteUser when setting AllowOpenInvite or AllowedDomains during team creationCVE-2026-6689 · GHSA-C28Q-M4GF-VG4QVersion ranges need review. |
github.com/mattermost/mattermost-server/v5github.com/mattermost/mattermost-server/v6 |
Go |
Medium
|
Fix reported |
|
| Mattermost doesn't restrict role_updated websocket event broadcasts to members of the affected team or channelCVE-2026-3433 · GHSA-RP4V-QC77-PHM4Version ranges need review. |
github.com/mattermost/mattermost-server/v5github.com/mattermost/mattermost-server/v6 |
Go |
Medium
|
Fix reported |
|
| Mattermost Playbooks fails to properly validate permissionsCVE-2025-41423 · GHSA-FR22-5377-F3P7Version ranges need review. |
github.com/mattermost/mattermost-plugin-playbooksgithub.com/mattermost/mattermost-server/v5 |
Go |
Low
|
Fix reported |
|
| Mattermost Playbooks fails to validate the uniqueness and quantity of task actionsCVE-2025-35965 · GHSA-689C-XQ7X-XJWFVersion ranges need review. |
github.com/mattermost/mattermost-plugin-playbooksgithub.com/mattermost/mattermost-server/v5 |
Go |
Medium
|
Fix reported |
|
| Mattermost doesn't restrict domains LLM can request to contact upstreamCVE-2025-31363 · GHSA-9H6J-4FFX-CM84Version ranges need review. |
github.com/mattermost/mattermost-server/v5github.com/mattermost/mattermost-server/v6 |
Go |
Low
|
Fix reported |
|
| Mattermost Incorrect Authorization vulnerabilityCVE-2025-27571 · GHSA-H4RR-F37J-4HH7Version ranges need review. |
github.com/mattermost/mattermost-server/v5github.com/mattermost/mattermost-server/v6 |
Go |
Medium
|
Fix reported |
|
| Mattermost allows reading arbitrary files related to importing boardsCVE-2025-25279 · GHSA-5FWX-P6XH-VJRHVersion ranges need review. |
github.com/mattermost/mattermost-server/v5github.com/mattermost/mattermost-server/v6 |
Go |
Critical
|
Fix reported |
|
| Mattermost webapp crash via a crafted postCVE-2025-20621 · GHSA-W6XH-C82W-H997Version ranges need review. |
github.com/mattermost/mattermost-server/v5github.com/mattermost/mattermost-server/v6 |
Go |
Medium
|
Fix reported |
|
