| Mattermost has an Incorrect Authorization issueCVE-2026-8823 · GHSA-XMFH-3CCG-C9FXVersion ranges need review. |
github.com/mattermost/mattermost-server/v5github.com/mattermost/mattermost-server/v6 |
Go |
Low
|
Fix reported |
|
| Mattermost doesn't invalidate cached authentication state for active WebSocket connections during global session revocationCVE-2026-9162 · GHSA-H998-HXXJ-8Q83Version ranges need review. |
github.com/mattermost/mattermost-server |
Go |
Medium
|
Fix reported |
|
| Mattermost doesn't authenticate Atlassian Connect installed callbacks, allowing a remote unauthenticated attacker to inject a rogue sharedSecretCVE-2026-6673 · GHSA-JQGV-39MG-7C2RVersion ranges need review. |
github.com/mattermost/mattermost-server |
Go |
Medium
|
Fix reported |
|
| Mattermost doesn't enforce administrator authorization on the {{setDefaultInstance}} call within the {{/gitlab connect}} command handlerCVE-2026-5139 · GHSA-2G8V-GRQ3-HQ2GVersion ranges need review. |
github.com/mattermost/mattermost-server |
Go |
Medium
|
Fix reported |
|
| Mattermost doesn't validate channel ownership of an existing subscription before applying editsCVE-2026-6062 · GHSA-MXQ2-5JPG-7474Version ranges need review. |
github.com/mattermost/mattermost-server |
Go |
Medium
|
Fix reported |
|
| Mattermost doesn't enforce bot-specific permission checks on the user active status endpointCVE-2026-8074 · GHSA-G5VR-6PGG-74QVVersion ranges need review. |
github.com/mattermost/mattermost-server |
Go |
Low
|
Fix reported |
|
| Mattermost doesn't require system-level permission when patching protected default system rolesCVE-2026-6739 · GHSA-M2W9-H2MM-79QRVersion ranges need review. |
github.com/mattermost/mattermost-server/v5github.com/mattermost/mattermost-server/v6 |
Go |
Medium
|
Fix reported |
|
| Mattermost Playbooks fails to properly validate the props used by the RetrospectivePost custom post typeCVE-2025-41395 · GHSA-3G36-GF7C-75QWVersion ranges need review. |
github.com/mattermost/mattermost-plugin-playbooksgithub.com/mattermost/mattermost-server/v5 |
Go |
Medium
|
Fix reported |
|
| Mattermost Missing Authentication for Critical FunctionCVE-2025-27538 · GHSA-J5JW-M2PH-3JJFVersion ranges need review. |
github.com/mattermost/mattermost-server/v5github.com/mattermost/mattermost-server/v6 |
Go |
Low
|
Fix reported |
|
| Mattermost Incorrect Authorization vulnerabilityCVE-2025-24839 · GHSA-J639-M367-75CFVersion ranges need review. |
github.com/mattermost/mattermost-server/v5github.com/mattermost/mattermost-server/v6 |
Go |
Low
|
Fix reported |
|
| Mattermost vulnerable to Incorrect Implementation of Authentication AlgorithmCVE-2025-2475 · GHSA-6RQH-8465-2XCWVersion ranges need review. |
github.com/mattermost/mattermost-server/v5github.com/mattermost/mattermost-server/v6 |
Go |
Medium
|
Fix reported |
|
| Mattermost Incorrect Authorization vulnerabilityCVE-2025-2564 · GHSA-MJ2P-V2C2-VH4VVersion ranges need review. |
github.com/mattermost/mattermost-server/v5github.com/mattermost/mattermost-server/v6 |
Go |
Medium
|
Fix reported |
|
| Mattermost vulnerable to Observable Timing DiscrepancyCVE-2025-27936 · GHSA-2J87-P623-8CC2Version ranges need review. |
github.com/mattermost/mattermost-plugin-msteamsgithub.com/mattermost/mattermost-server/v5 |
Go |
Medium
|
Fix reported |
|
| Mattermost Fails to Restrict Certain Operations on System AdminsCVE-2025-32093 · GHSA-322V-VH2G-QVPVVersion ranges need review. |
github.com/mattermost/mattermost-server/v5github.com/mattermost/mattermost-server/v6 |
Go |
Medium
|
Fix reported |
|
| Mattermost has Improper Check for Unusual or Exceptional ConditionsCVE-2025-22445 · GHSA-7RGP-4J56-FM79Version ranges need review. |
github.com/mattermost/mattermost-server/v5github.com/mattermost/mattermost-server/v6 |
Go |
Low
|
Fix reported |
|
| Mattermost Improper Validation of Specified Type of Input vulnerabilityCVE-2025-20033 · GHSA-2549-XH72-QRPMVersion ranges need review. |
github.com/mattermost/mattermost-server/v5github.com/mattermost/mattermost-server/v6 |
Go |
Medium
|
Fix reported |
|
| Mattermost doesn't validate that a username returned during bot registration belongs to a bot accountCVE-2026-6046 · GHSA-3VMP-WHVV-5V9VVersion ranges need review. |
github.com/mattermost/mattermost-server/v5github.com/mattermost/mattermost-server/v6 |
Go |
Medium
|
Fix reported |
|
| Mattermost doesn't enforce PermissionInviteUser when setting AllowOpenInvite or AllowedDomains during team creationCVE-2026-6689 · GHSA-C28Q-M4GF-VG4QVersion ranges need review. |
github.com/mattermost/mattermost-server/v5github.com/mattermost/mattermost-server/v6 |
Go |
Medium
|
Fix reported |
|
| Mattermost doesn't restrict role_updated websocket event broadcasts to members of the affected team or channelCVE-2026-3433 · GHSA-RP4V-QC77-PHM4Version ranges need review. |
github.com/mattermost/mattermost-server/v5github.com/mattermost/mattermost-server/v6 |
Go |
Medium
|
Fix reported |
|
| Mattermost Playbooks fails to properly validate permissionsCVE-2025-41423 · GHSA-FR22-5377-F3P7Version ranges need review. |
github.com/mattermost/mattermost-plugin-playbooksgithub.com/mattermost/mattermost-server/v5 |
Go |
Low
|
Fix reported |
|
