github.com/mattermost/mattermost-server vulnerabilities

Browse known CVEs and advisories by package and ecosystem. Severity tells you the worst case. What determines real risk is whether the vulnerable code actually runs in your applications.

Get a demo

Browse by ecosystem

npmPyPIMavenGoRubyGemsCargoNuGetComposerpubSwiftGitHub Actions
CVE-IDSeverityPackage summary
CVE-2026-6339Mediumgithub.com/mattermost/mattermost/server/v8: Mattermost doesn't validate the X-Requested-With header on the burn-on-read reveal endpointCVE-2026-6333Lowgithub.com/mattermost/mattermost/server/v8: Mattermost doesn't validate the Host header when constructing response URLs for custom slash commandCVE-2026-6345Mediumgithub.com/mattermost/mattermost/server/v8: Mattermost doesn't prevent disclosure of created user passwordCVE-2026-6346Highgithub.com/mattermost/mattermost/server/v8: Mattermost doesn't sanitize sensitive configuration fields before including them in support packet generationCVE-2026-28732Mediumgithub.com/mattermost/mattermost/server/v8: Mattermost doesn't enforce slash command trigger-word uniqueness during command updatesCVE-2026-4273Lowgithub.com/mattermost/mattermost/server/v8: Mattermost doesn't validate that the RefreshedToken differs from the original invite token during remote cluster invite confirmationCVE-2026-6340Mediumgithub.com/mattermost/mattermost/server/v8: Mattermost doesn't validate 7zip archive structure before processingCVE-2026-6334Lowgithub.com/mattermost/mattermost/server/v8: Mattermost doesn't enforce client identity binding during the OAuth authorization code redemption flowCVE-2026-28759Mediumgithub.com/mattermost/mattermost/server/v8: Mattermost does not verify remote cluster channel access when processing shared channel membership removalsCVE-2026-2325Mediumgithub.com/mattermost/mattermost-server: Mattermost doesn't limit the size of the request body on the start meeting API endpointCVE-2026-3495Lowgithub.com/mattermost/mattermost/server/v8: Mattermost doesn't escape some variables that could contain malicious content during error page compositionCVE-2026-3637Mediumgithub.com/mattermost/mattermost/server/v8: Mattermost doesn't check the create_post channel permission during post edit operationsCVE-2026-4053Lowgithub.com/mattermost/mattermost-server: Mattermost doesn't enforce the PostEditTimeLimit on non-message post fieldsCVE-2026-4054Mediumgithub.com/mattermost/mattermost-server: Mattermost doesn't validate the response body of proxied imagesCVE-2026-3590Mediumgithub.com/mattermost/mattermost/server/v8: Mattermost has session spoofing due to lack of single-use consumption of guest magic link tokens enforcementCVE-2026-27769Lowgithub.com/mattermost/mattermost-server: Mattermost doesn't validate whether users were correctly owned by the correct Connected WorkspaceCVE-2026-3113Mediumgithub.com/mattermost/mattermost-server: Mattermost doesn't set permissions on downloaded bulk exportCVE-2026-27656Mediumgithub.com/mattermost/mattermost-server: Mattermost allows attackers to take over arbitrary user accounts via overly permissive substring matching flawCVE-2026-26233Mediumgithub.com/mattermost/mattermost-server: Mattermost doesn't rate limit login requests, allowing DoSCVE-2026-22545Lowgithub.com/mattermost/mattermost/server/v8: Mattermost fails to validate user's authentication method when processing account auth type switchCVE-2026-2455Mediumgithub.com/mattermost/mattermost/server/v8: Mattermost fails to canonicalize IPv4-mapped IPv6 addresses before reserved IP validationCVE-2026-24692Mediumgithub.com/mattermost/mattermost/server/v8: Mattermost fails to properly enforce read permissions in search API endpointsCVE-2026-4265Mediumgithub.com/mattermost/mattermost/server/v8: Mattermost fails to validate team-specific upload_file permissionsCVE-2026-21386Mediumgithub.com/mattermost/mattermost/server/v8: Mattermost fails to use consistent error responses when handling the /mute commandCVE-2026-2456Mediumgithub.com/mattermost/mattermost/server/v8: Mattermost fails to limit the size of responses from integration action endpoints

Stop the waste.
Protect your environment with Kodem.