Filtered by vendor Mattermost Subscriptions
Total 462 CVE
CVE Vendors Products Updated CVSS v3.1
CVE-2025-20033 1 Mattermost 2 Mattermost, Mattermost Server 2025-10-02 4.3 Medium
Mattermost versions 10.2.0, 9.11.x <= 9.11.5, 10.0.x <= 10.0.3, 10.1.x <= 10.1.3 fail to properly validate post types, which allows attackers to deny service to users with the sysconsole_read_plugins permission via creating a post with the custom_pl_notification type and specific props.
CVE-2025-22445 1 Mattermost 2 Mattermost, Mattermost Server 2025-10-02 3.5 Low
Mattermost versions 10.x <= 10.2 fail to accurately reflect missing settings, which allows confusion for admins regarding a Calls security-sensitive configuration via incorrect UI reporting.
CVE-2025-32093 1 Mattermost 2 Mattermost, Mattermost Server 2025-10-02 4.7 Medium
Mattermost versions 10.5.x <= 10.5.1, 10.4.x <= 10.4.3, 9.11.x <= 9.11.9 fail to restrict certain operations on system admins to only other system admins, which allows delegated granular administration users with the "Edit Other Users" permission to perform unauthorized modifications to system administrators via improper permission validation.
CVE-2025-2475 1 Mattermost 2 Mattermost, Mattermost Server 2025-10-02 5.4 Medium
Mattermost versions 10.5.x <= 10.5.1, 10.4.x <= 10.4.3, 9.11.x <= 9.11.9 fail to invalidate the cache when a user account is converted to a bot which allows an attacker to login to the bot exactly one time via normal credentials.
CVE-2025-24839 1 Mattermost 2 Mattermost, Mattermost Server 2025-10-02 3.1 Low
Mattermost versions 10.5.x <= 10.5.1, 10.4.x <= 10.4.3, 9.11.x <= 9.11.9 fail to prevent Wrangler posts from triggering AI responses. This vulnerability allows users without access to the AI bot to activate it by attaching the activate_ai override property to a post via the Wrangler plugin, provided both the AI and Wrangler plugins are enabled.
CVE-2025-8402 1 Mattermost 2 Mattermost, Mattermost Server 2025-10-01 4.9 Medium
Mattermost versions 10.8.x <= 10.8.3, 10.5.x <= 10.5.8, 9.11.x <= 9.11.17, 10.10.x <= 10.10.0, 10.9.x <= 10.9.3 fail to validate import data which allows a system admin to crash the server via the bulk import feature.
CVE-2025-41395 1 Mattermost 2 Mattermost, Mattermost Server 2025-10-01 6.5 Medium
Mattermost versions 10.4.x <= 10.4.2, 10.5.x <= 10.5.0, 9.11.x <= 9.11.10 fail to properly validate the props used by the RetrospectivePost custom post type in the Playbooks plugin, which allows an attacker to create a specially crafted post with maliciously crafted props and cause a denial of service (DoS) of the web app for all users.
CVE-2024-11599 1 Mattermost 2 Mattermost, Mattermost Server 2025-10-01 8.2 High
Mattermost versions 10.0.x <= 10.0.1, 10.1.x <= 10.1.1, 9.11.x <= 9.11.3, 9.5.x <= 9.5.11 fail to properly validate email addresses which allows an unauthenticated user to bypass email domain restrictions via carefully crafted input on email registration.
CVE-2024-12247 1 Mattermost 2 Mattermost, Mattermost Server 2025-10-01 4.6 Medium
Mattermost versions 9.7.x <= 9.7.5, 9.8.x <= 9.8.2 and 9.9.x <= 9.9.2 fail to properly propagate permission scheme updates across cluster nodes which allows a user to keep old permissions, even if the permission scheme has been updated.
CVE-2025-20088 1 Mattermost 2 Mattermost, Mattermost Server 2025-10-01 6.5 Medium
Mattermost versions 10.2.x <= 10.2.0, 9.11.x <= 9.11.5, 10.0.x <= 10.0.3, 10.1.x <= 10.1.3 fail to properly validate post props which allows a malicious authenticated user to cause a crash via a malicious post.
CVE-2025-27571 1 Mattermost 2 Mattermost, Mattermost Server 2025-10-01 4.3 Medium
Mattermost versions 10.5.x <= 10.5.1, 10.4.x <= 10.4.3, 9.11.x <= 9.11.9 fail to check the "Allow Users to View Archived Channels" configuration when fetching channel metadata of a post from archived channels, which allows authenticated users to access such information when a channel is archived.
CVE-2025-27538 1 Mattermost 1 Mattermost Server 2025-10-01 2.2 Low
Mattermost versions 10.5.x <= 10.5.1, 9.11.x <= 9.11.9 fail to enforce MFA checks in PUT /api/v4/users/user-id/mfa when the requesting user differs from the target user ID, which allows users with edit_other_users permission to activate or deactivate MFA for other users, even if those users have not set up MFA.
CVE-2025-2424 1 Mattermost 2 Mattermost, Mattermost Server 2025-10-01 3.1 Low
Mattermost versions 10.5.x <= 10.5.1, 9.11.x <= 9.11.9 fail to check if a file has been deleted when creating a bookmark which allows an attacker who knows the IDs of deleted files to obtain metadata of the files via bookmark creation.
CVE-2025-24866 1 Mattermost 2 Mattermost, Mattermost Server 2025-10-01 2.7 Low
Mattermost versions 9.11.x <= 9.11.8  fail to enforce proper access controls on the /api/v4/audits endpoint, allowing users with delegated granular administration roles who lack access to Compliance Monitoring to retrieve User Activity Logs.
CVE-2025-1472 1 Mattermost 2 Mattermost, Mattermost Server 2025-10-01 4.3 Medium
Mattermost versions 9.11.x <= 9.11.8 fail to properly perform authorization of the Viewer role which allows an attacker with the Viewer role configured with No Access to Reporting to still view team and site statistics.
CVE-2025-24526 1 Mattermost 2 Mattermost, Mattermost Server 2025-10-01 4.3 Medium
Mattermost versions 10.1.x <= 10.1.3, 10.4.x <= 10.4.1, 9.11.x <= 9.11.7, 10.3.x <= 10.3.2, 10.2.x <= 10.2.2 fail to restrict channel export of archived channels when the "Allow users to view archived channels" is disabled which allows a user to export channel contents when they shouldn't have access to it
CVE-2025-24490 1 Mattermost 2 Mattermost, Mattermost Server 2025-10-01 9.6 Critical
Mattermost versions 10.4.x <= 10.4.1, 9.11.x <= 9.11.7, 10.3.x <= 10.3.2, 10.2.x <= 10.2.2 fail to use prepared statements in the SQL query of boards reordering which allows an attacker to retrieve data from the database, via a SQL injection when reordering specially crafted boards categories.
CVE-2025-1412 1 Mattermost 2 Mattermost, Mattermost Server 2025-10-01 3.1 Low
Mattermost versions 9.11.x <= 9.11.6, 10.4.x <= 10.4.1 fail to invalidate all active sessions when converting a user to a bot, with allows the converted user to escalate their privileges depending on the permissions granted to the bot.
CVE-2025-20621 1 Mattermost 2 Mattermost, Mattermost Server 2025-10-01 6.5 Medium
Mattermost versions 10.2.x <= 10.2.0, 9.11.x <= 9.11.5, 10.0.x <= 10.0.3, 10.1.x <= 10.1.3 fail to properly handle posts with attachments containing fields that cannot be cast to a String, which allows an attacker to cause the webapp to crash via creating and sending such a post to a channel.
CVE-2024-10241 1 Mattermost 2 Mattermost, Mattermost Server 2025-09-30 4.3 Medium
Mattermost versions 9.5.x <= 9.5.9 fail to properly filter the channel data when ElasticSearch is enabled which allows a user to get private channel names by using cmd+K/ctrl+K.