Mattermost vulnerabilities

CVEs per yearBy the year they were published

1. 20215
2. 202225
3. 202384
4. 202495
5. 2025119
6. 2026184

Newest CVEs

• CVE-2026-93851

  Path traversal in Mattermost Agents plugin mention reminder allows plugin replacement via crafted post

  Mattermost · Mattermost

  High8.0
• CVE-2026-93846

  Team admin can escalate a team member's permissions via the team member roles endpoint

  Mattermost · Mattermost

  Low3.8
• CVE-2026-93848

  Mattermost OpenID discovery endpoint request bypasses outbound connection filtering, allowing SSRF by a System Administrator

  Mattermost · Mattermost

  Low2.7
• CVE-2026-93850

  Unbounded memory consumption during PDF text extraction

  Mattermost · Mattermost

  Medium6.5
• CVE-2026-93849

  Mattermost allows authenticated users to trigger excessive memory allocation via crafted msgpack binary WebSocket frames

  Mattermost · Mattermost

  Medium6.5
• CVE-2026-93847

  Improper post type validation on scheduled post endpoints

  Mattermost · Mattermost

  Low3.5
• CVE-2026-116516

  Insufficient length validation when parsing Zoom chat transcriptions

  Mattermost · Mattermost

  Medium6.5
• CVE-2026-13411

  Null condition in Playbooks import crashes the plugin

  Mattermost · Mattermost

  Medium4.3
• CVE-2026-18799

  Mattermost Server fails to restrict Slack import account binding, allowing team admins to forge posts as existing users

  Mattermost · Mattermost

  Medium4.3
• CVE-2026-16251

  Mattermost local image proxy allows server memory exhaustion via unbounded image response buffering

  Mattermost · Mattermost

  Medium6.5