Read the docs

Mattermost

Records671All Threatist records
Exploited (KEV)0None in CISA KEV
CVSS critical26CVSS 9.0–10.0
CVSS high130CVSS 7.0–8.9

Exploited now

Mattermost records in CISA KEV

No Mattermost vulnerabilities are listed in CISA KEV.

Components

Products in the NVD configurations · select one to filter the records
Mattermost Server 506 records MEDIUM Mattermost 77 records MEDIUM Mattermost Desktop 34 records MEDIUM Mattermost Mobile 21 records LOW Confluence 14 records LOW Focalboard 2 records LOW Legal Hold 2 records LOW Mattermost Boards 2 records LOW

Records

2 records in Legal Hold · all components

TI-2026-03035 CVE-2026-3524 · GHSA-h7g6-pq3g-f7cw

Authorization Bypass in Mattermost Legal Hold Plugin Due to Missing Return After Permission Check

Priority LOW 38

Mattermost Plugin Legal Hold versions <=1.1.4 fail to halt request processing after a failed authorization check in ServeHTTP which allows an authenticated attacker to access, create, download, and delete legal hold data…

CVSS 3.1HIGH 8.3 Network Low privileges No interaction EPSS 0.00385 Published 2026-04-06 Fixed in 1.1.5 CWE-862
TI-2026-06089 CVE-2026-6957 · GHSA-x7w4-j7hv-94wg

Path traversal in Mattermost

Priority LOW 37

Mattermost Plugins versions <=1.1.5 fail to sanitize filenames received from federated peers before using them to construct export destination paths, which allows an administrator of a remote federated Mattermost server…

CVSS 3.1HIGH 8.0 Network High privileges No interaction EPSS 0.00296 Published 2026-05-27 Fixed in .0 CWE-22
Open these records in search →