github.com/mattermost/mattermost/server/v8 vulnerabilities

Browse known CVEs and advisories by package and ecosystem. Severity tells you the worst case. What determines real risk is whether the vulnerable code actually runs in your applications.

Browse by ecosystem

npm PyPI Maven Go RubyGems Cargo NuGet Composer pub Swift GitHub Actions

CVE-IDSeverityPackage summary

CVE-2026-8823Lowgithub.com/mattermost/mattermost-server: Mattermost has an Incorrect Authorization issue CVE-2026-6739Mediumgithub.com/mattermost/mattermost-server: Mattermost doesn't require system-level permission when patching protected default system roles CVE-2026-3433Mediumgithub.com/mattermost/mattermost-server: Mattermost doesn't restrict role_updated websocket event broadcasts to members of the affected team or channel CVE-2026-7387Highgithub.com/mattermost/mattermost-server: Mattermost doesn't require role-management authorization when setting the scheme_admin flag on group syncable link and patch endpoints CVE-2026-6961Highgithub.com/mattermost/mattermost-server: Mattermost doesn't sanitize FileInfo.Name received from federated peers during shared channel file sync CVE-2026-7184Mediumgithub.com/mattermost/mattermost-server: Mattermost doesn't sanitize the Remote Cluster API response on PATCH operations CVE-2026-6046Mediumgithub.com/mattermost/mattermost-server: Mattermost doesn't validate that a username returned during bot registration belongs to a bot account CVE-2026-6689Mediumgithub.com/mattermost/mattermost-server: Mattermost doesn't enforce PermissionInviteUser when setting AllowOpenInvite or AllowedDomains during team creation CVE-2026-4915Mediumgithub.com/mattermost/mattermost-server: Mattermost doesn't filter nil elements from outgoing webhook attachment payloads before processing CVE-2026-5740Highgithub.com/mattermost/mattermost-server: Mattermost doesn't properly validate msgpack-encoded WebSocket frames before memory allocation CVE-2026-4055Mediumgithub.com/mattermost/mattermost/server/v8: Mattermost has an Incorrect Authorization issue CVE-2026-5163Mediumgithub.com/mattermost/mattermost/server/v8: Mattermost doesn't verify channel membership when processing AI-assisted message rewrites CVE-2026-6343Mediumgithub.com/mattermost/mattermost/server/v8: Mattermost doesn't check public/private permissions CVE-2026-6339Mediumgithub.com/mattermost/mattermost/server/v8: Mattermost doesn't validate the X-Requested-With header on the burn-on-read reveal endpoint CVE-2026-6333Lowgithub.com/mattermost/mattermost/server/v8: Mattermost doesn't validate the Host header when constructing response URLs for custom slash command CVE-2026-6345Mediumgithub.com/mattermost/mattermost/server/v8: Mattermost doesn't prevent disclosure of created user password CVE-2026-6346Highgithub.com/mattermost/mattermost/server/v8: Mattermost doesn't sanitize sensitive configuration fields before including them in support packet generation CVE-2026-28732Mediumgithub.com/mattermost/mattermost/server/v8: Mattermost doesn't enforce slash command trigger-word uniqueness during command updates CVE-2026-4286Lowgithub.com/mattermost/mattermost/server/v8: Mattermost doesn't check if {{team_id}} was being changed when updating playbooks CVE-2026-4273Lowgithub.com/mattermost/mattermost/server/v8: Mattermost doesn't validate that the RefreshedToken differs from the original invite token during remote cluster invite confirmation CVE-2026-6340Mediumgithub.com/mattermost/mattermost/server/v8: Mattermost doesn't validate 7zip archive structure before processing CVE-2026-6334Lowgithub.com/mattermost/mattermost/server/v8: Mattermost doesn't enforce client identity binding during the OAuth authorization code redemption flow CVE-2026-28759Mediumgithub.com/mattermost/mattermost/server/v8: Mattermost does not verify remote cluster channel access when processing shared channel membership removals CVE-2026-3495Lowgithub.com/mattermost/mattermost/server/v8: Mattermost doesn't escape some variables that could contain malicious content during error page composition CVE-2026-3637Mediumgithub.com/mattermost/mattermost/server/v8: Mattermost doesn't check the create_post channel permission during post edit operations

Stop the waste.
Protect your environment with Kodem.

Get a personalized demo

Get a personalized demo