Mattermost

Records671All Threatist records

Exploited (KEV)0None in CISA KEV

CVSS critical26CVSS 9.0–10.0

CVSS high130CVSS 7.0–8.9

Exploited now

Mattermost records in CISA KEV

No Mattermost vulnerabilities are listed in CISA KEV.

Components

Products in the NVD configurations · select one to filter the records

Mattermost Server 506 records MEDIUM Mattermost 77 records MEDIUM Mattermost Desktop 34 records MEDIUM Mattermost Mobile 21 records LOW Confluence 14 records LOW Focalboard 2 records LOW Legal Hold 2 records LOW Mattermost Boards 2 records LOW

Records

2 records in Focalboard · all components

TI-2026-20840 CVE-2026-25773 · GHSA-p32q-v29x-wq9r

SQL injection in Mattermost Focalboard

LOW 35

** UNSUPPORTED WHEN ASSIGNED ** Focalboard version 8.0 fails to sanitize category IDs before incorporating them into dynamic SQL statements when reordering categories.

CVSS 3.1HIGH 8.1 Network Low privileges No interaction EPSS 0.00314 Published 2026-04-03 No fix listed CWE-89

TI-2026-22944 CVE-2026-28736 · GHSA-vph7-r229-qxpf

Focalboard IDOR in file content endpoint allows cross-user file access (unsupported product, no fix)

LOW 20

** UNSUPPORTED WHEN ASSIGNED ** Focalboard version 8.0 fails to validate file ownership when serving uploaded files.

CVSS 3.1MEDIUM 4.3 Network Low privileges No interaction EPSS 0.0023 Published 2026-04-03 No fix listed CWE-639

Open these records in search →

Critical	26
High	130
Medium	455
Low	60
No CVSS	0