github.com/mattermost/mattermost-server vulnerabilities

Browse known CVEs and advisories by package and ecosystem. Severity tells you the worst case. What determines real risk is whether the vulnerable code actually runs in your applications.

Browse by ecosystem

npm PyPI Maven Go RubyGems Cargo NuGet Composer pub Swift GitHub Actions

CVE-IDSeverityPackage summary

CVE-2026-8823Lowgithub.com/mattermost/mattermost-server: Mattermost has an Incorrect Authorization issue CVE-2026-8074Lowgithub.com/mattermost/mattermost-server: Mattermost doesn't enforce bot-specific permission checks on the user active status endpoint CVE-2026-9162Mediumgithub.com/mattermost/mattermost-server: Mattermost doesn't invalidate cached authentication state for active WebSocket connections during global session revocation CVE-2026-6062Mediumgithub.com/mattermost/mattermost-server: Mattermost doesn't validate channel ownership of an existing subscription before applying edits CVE-2026-6673Mediumgithub.com/mattermost/mattermost-server: Mattermost doesn't authenticate Atlassian Connect installed callbacks, allowing a remote unauthenticated attacker to inject a rogue…CVE-2026-5139Mediumgithub.com/mattermost/mattermost-server: Mattermost doesn't enforce administrator authorization on the {{setDefaultInstance}} call within the {{/gitlab connect}} command handler CVE-2026-6739Mediumgithub.com/mattermost/mattermost-server: Mattermost doesn't require system-level permission when patching protected default system roles CVE-2026-3433Mediumgithub.com/mattermost/mattermost-server: Mattermost doesn't restrict role_updated websocket event broadcasts to members of the affected team or channel CVE-2026-7387Highgithub.com/mattermost/mattermost-server: Mattermost doesn't require role-management authorization when setting the scheme_admin flag on group syncable link and patch endpoints CVE-2026-6961Highgithub.com/mattermost/mattermost-server: Mattermost doesn't sanitize FileInfo.Name received from federated peers during shared channel file sync CVE-2026-7184Mediumgithub.com/mattermost/mattermost-server: Mattermost doesn't sanitize the Remote Cluster API response on PATCH operations CVE-2026-6046Mediumgithub.com/mattermost/mattermost-server: Mattermost doesn't validate that a username returned during bot registration belongs to a bot account CVE-2026-6689Mediumgithub.com/mattermost/mattermost-server: Mattermost doesn't enforce PermissionInviteUser when setting AllowOpenInvite or AllowedDomains during team creation CVE-2026-4915Mediumgithub.com/mattermost/mattermost-server: Mattermost doesn't filter nil elements from outgoing webhook attachment payloads before processing CVE-2026-28735Mediumgithub.com/mattermost/mattermost-server: Mattermost allows authenticated users to gain access to private repositories CVE-2026-5308Highgithub.com/mattermost/mattermost-server: Mattermost doesn't enforce request body size limits on plugin HTTP endpoints CVE-2026-3473Highgithub.com/mattermost/mattermost-server: Mattermost doesn't validate file ownership and access control CVE-2026-5740Highgithub.com/mattermost/mattermost-server: Mattermost doesn't properly validate msgpack-encoded WebSocket frames before memory allocation CVE-2026-4646Mediumgithub.com/mattermost/mattermost-server: Mattermost doesn't validate user-supplied input in API request handlers CVE-2026-4635Mediumgithub.com/mattermost/mattermost-server: Mattermost doesn't archive the channel before removing persistent notifications CVE-2026-3636Mediumgithub.com/mattermost/mattermost-server: Mattermost doesn't sanitize team member data when returned via API to users without elevated permissions CVE-2026-5755Mediumgithub.com/mattermost/mattermost-server: Mattermost doesn't validate the TIFF IFD offset in the image header before allocating memory CVE-2026-4858Highgithub.com/mattermost/mattermost-server: Mattermost has a Path Traversal issue CVE-2026-6347Highgithub.com/mattermost/mattermost-server: Mattermost doesn't sanitize sensitive configuration fields in the Mattermost Calls plugin CVE-2026-5163Mediumgithub.com/mattermost/mattermost/server/v8: Mattermost doesn't verify channel membership when processing AI-assisted message rewrites

Stop the waste.
Protect your environment with Kodem.

Get a personalized demo

Get a personalized demo