github.com/mattermost/mattermost-server vulnerabilities

Browse known CVEs and advisories by package and ecosystem. Severity tells you the worst case. What determines real risk is whether the vulnerable code actually runs in your applications.

Get a demo

Browse by ecosystem

npmPyPIMavenGoRubyGemsCargoNuGetComposerpubSwiftGitHub Actions
CVE-IDSeverityPackage summary
CVE-2026-2458Mediumgithub.com/mattermost/mattermost/server/v8: Mattermost allows a removed team member to enumerate all public channels within a private teamCVE-2026-2463Mediumgithub.com/mattermost/mattermost/server/v8: Mattermost fails to filter invite IDs based on user permissionsCVE-2026-2578Mediumgithub.com/mattermost/mattermost/server/v8: Mattermost fails to preserve the redacted state of burn-on-read posts during deletionCVE-2026-2457Mediumgithub.com/mattermost/mattermost/server/v8: Mattermost allows attackers to spoof permalink embedsCVE-2026-26246Mediumgithub.com/mattermost/mattermost/server/v8: Mattermost fails to bound memory allocation when processing PSD image filesCVE-2026-25783Mediumgithub.com/mattermost/mattermost/server/v8: Mattermost fails to properly validate User-Agent header tokensCVE-2026-24458Highgithub.com/mattermost/mattermost/server/v8: Mattermost fails to properly handle very long passwordsCVE-2026-25780Mediumgithub.com/mattermost/mattermost/server/v8: Mattermost fails to bound memory allocation when processing DOC filesCVE-2025-14573Lowgithub.com/mattermost/mattermost/server/v8: Mattermost fails to enforce invite permissions when updating team settingsCVE-2025-14350Mediumgithub.com/mattermost/mattermost/server/v8: Mattermost fails to properly validate team membership when processing channel mentionsCVE-2025-13821Mediumgithub.com/mattermost/mattermost/server/v8: Mattermost fails to sanitize sensitive data in WebSocket messagesCVE-2026-0999Mediumgithub.com/mattermost/mattermost/server/v8: Mattermost fails to properly validate login method restrictionsCVE-2026-20796Lowgithub.com/mattermost/mattermost-server: Mattermost doesn't properly validate channel membership at the time of data retrievalCVE-2026-22892Mediumgithub.com/mattermost/mattermost-server: Mattermost doesn't validate user permissions when creating Jira issues from Mattermost postsCVE-2025-14435Mediumgithub.com/mattermost/mattermost-server: Mattermost is vulnerable to DoS due to infinite re-renders on API errorsCVE-2025-14822Lowgithub.com/mattermost/mattermost-server: Mattermost is vulnerable to CPU exhaustion via crafted HTTP requestCVE-2025-13767Mediumgithub.com/mattermost/mattermost/server/v8: Mattermost doesn't validate user channel membership when attaching Mattermost posts as comments to Jira issuesCVE-2025-64641Mediumgithub.com/mattermost/mattermost/server/v8: Mattermost doesn't verify that post actions invoking `/share-issue-publicly` were created by the Jira pluginCVE-2025-13324Mediumgithub.com/mattermost/mattermost: Mattermost has an Invite Token Replay Vulnerability via Channel Membership ManipulationCVE-2025-12421Criticalgithub.com/mattermost/mattermost/server/v8: Mattermost fails to to verify the token used during code exchangeCVE-2025-12559Mediumgithub.com/mattermost/mattermost/server/v8: Mattermost fails to sanitize team email addressesCVE-2025-12419Criticalgithub.com/mattermost/mattermost/server/v8: Mattermost fails to properly validate OAuth state tokens during OpenID Connect authenticationCVE-2025-55074Lowgithub.com/mattermost/mattermost-server: Mattermost allows other users to determine when users had read channels via channel member objectsCVE-2025-11794Mediumgithub.com/mattermost/mattermost-server: Mattermost allows system administrators to access password hashes and MFA secretsCVE-2025-55070Mediumgithub.com/mattermost/mattermost-server: Mattermost does not enforce MFA on WebSocket connections

Stop the waste.
Protect your environment with Kodem.