Read the docs

Mattermost

Records671All Threatist records
Exploited (KEV)0None in CISA KEV
CVSS critical26CVSS 9.0–10.0
CVSS high130CVSS 7.0–8.9

Exploited now

Mattermost records in CISA KEV

No Mattermost vulnerabilities are listed in CISA KEV.

Components

Products in the NVD configurations · select one to filter the records
Mattermost Server 506 records MEDIUM Mattermost 77 records MEDIUM Mattermost Desktop 34 records MEDIUM Mattermost Mobile 21 records LOW Confluence 14 records LOW Focalboard 2 records LOW Legal Hold 2 records LOW Mattermost Boards 2 records LOW

Records

21 records in Mattermost Mobile · all components

TI-2025-14702 CVE-2025-20630 · GHSA-93w4-x8jh-j7m2

Mobile crash via object that can't be cast to String in Attachment Field

Priority LOW 34

Mattermost Mobile versions <=2.22.0 fail to properly handle posts with attachments containing fields that cannot be cast to a String, which allows an attacker to cause the mobile to crash via creating and sending such a…

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00638 Published 2025-01-16 Fixed in 2.23.0 CWE-1287
TI-2025-14379 CVE-2025-20072 · GHSA-778q-j98c-h63p

Mobile crash via improper validation of proto style in attachments

Priority LOW 34

Mattermost Mobile versions <= 2.22.0 fail to properly validate the style of proto supplied to an action's style in post.props.attachments, which allows an attacker to crash the mobile via crafted malicious input.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00549 Published 2025-01-16 Fixed in 2.23.0 CWE-704
TI-2025-15079 CVE-2025-21083 · GHSA-h8hh-7xxw-q4pg

Insufficient Input Validation on Post Props

Priority LOW 30

Mattermost Mobile Apps versions <=2.22.0 fail to properly validate post props which allows a malicious authenticated user to cause a crash via a malicious post.

CVSS 3.1MEDIUM 6.5 Network Low privileges No interaction EPSS 0.00543 Published 2025-01-15 Fixed in 2.23.0 CWE-1287
TI-2025-14347 CVE-2025-20036 · GHSA-7w4f-5rcv-q8pc

Insufficient Input Validation on Post Props

Priority LOW 30

Mattermost Mobile Apps versions <=2.22.0 fail to properly validate post props which allows a malicious authenticated user to cause a crash via a malicious post.

CVSS 3.1MEDIUM 6.5 Network Low privileges No interaction EPSS 0.00543 Published 2025-01-15 Fixed in 2.23.0 CWE-1287
TI-2025-01342 CVE-2025-1558 · GHSA-5p3r-7jhw-3cm2

Denial of Service Via Malicious GIF

Priority LOW 29

Mattermost Mobile Apps versions <=2.25.0 fail to properly validate GIF images prior to rendering which allows a malicious user to cause the Android application to crash via message containing a maliciously crafted GIF.

CVSS 3.1MEDIUM 6.5 Network Low privileges No interaction EPSS 0.00384 Published 2025-03-24 Fixed in 2.26.0, 2.25.1 CWE-1287
TI-2024-30793 CVE-2024-45833 · GHSA-fq8w-cfr6-8fqg

Mobile password gets saved in dictionary under conditions

Priority LOW 29

Mattermost Mobile Apps versions <=2.18.0 fail to disable autocomplete during login while typing the password and visible password is selected, which allows the password to get saved in the dictionary when the user has Sw…

CVSS 3.1MEDIUM 6.5 Network Low privileges No interaction EPSS 0.00346 Published 2024-09-16 Fixed in 2.19.0 CWE-693
TI-2024-16469 CVE-2024-24975 · GHSA-8jjg-p984-x7q6

Denial of Service for mobile app users due to automatic code highlighting

Priority LOW 29

Uncontrolled Resource Consumption in Mattermost Mobile versions before 2.13.0 fails to limit the size of the code block that will be processed by the syntax highlighter, allowing an attacker to send a very large code blo…

CVSS 3.1MEDIUM 6.5 Network Low privileges No interaction EPSS 0.00406 Published 2024-03-15 Fixed in 2.13.0 CWE-400
TI-2024-03612 CVE-2024-3872 · GHSA-rc85-79f2-729p

Uncontrolled resource consumption in Mattermost

Priority LOW 29

Mattermost Mobile app versions 2.13.0 and earlier use a regular expression with polynomial complexity to parse certain deeplinks, which allows an unauthenticated remote attacker to freeze or crash the app via a long mali…

CVSS 3.1MEDIUM 6.5 Network No auth User interaction EPSS 0.00464 Published 2024-04-16 Fixed in 2.14.0 CWE-400
TI-2025-37024 CVE-2025-59480 · GHSA-h2fg-6x82-5f24

Inadequate validation of SSO redirect credentials permits credential theft

Priority LOW 28

Mattermost Mobile Apps versions <=2.32.0 fail to verify that SSO redirect tokens originate from the trusted server, which allows a malicious Mattermost instance or on-path attacker to obtain user session credentials via…

CVSS 3.1MEDIUM 6.5 Network No auth User interaction EPSS 0.00154 Published 2025-11-13 Fixed in 2.33.0 CWE-352
TI-2024-26685 CVE-2024-39767 · GHSA-x5q7-p9g5-58x7

Spoofed push notifications from malicious server

Priority LOW 28

Mattermost Mobile Apps versions <=2.16.0 fail to validate that the push notifications received for a server actually came from this serve that which allows a malicious server to send push notifications with another serve…

CVSS 3.1MEDIUM 6.5 Network No auth No interaction EPSS 0.00208 Published 2024-07-15 Fixed in 2.17.0 CWE-287
TI-2026-18371 CVE-2026-22880 · GHSA-j628-rc2h-qj7g

Mobile SSO authentication flow allows credential theft via malicious server

Priority LOW 26

Mattermost Mobile Apps versions <=2.37 11.4 2.0.37 11.0.4 11.1.3 11.3.2 10.11.11.0 fail to properly validate the SSO authentication callback origin which allows an attacker controlling a malicious Mattermost server to st…

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.00117 Published 2026-05-21 Fixed in 2.38.0, 11.5.0 +5 CWE-352
TI-2024-10523 CVE-2024-11358 · GHSA-pxf8-qv37-3xxp

Insecure Android File Provider Paths

Priority LOW 26

Mattermost Android Mobile Apps versions <=2.21.0 fail to properly configure file providers which allows an attacker with local access to access files via file provider.

CVSS 3.1MEDIUM 5.7 Local High privileges No interaction EPSS 0.00122 Published 2024-12-16 Fixed in 2.22.0 CWE-284
TI-2024-21812 CVE-2024-32945 · GHSA-xq9p-hq98-j4x4

LaTeX post content manipulation via renderer state leak across contexts

Priority LOW 24

Mattermost Mobile Apps versions <=2.16.0 fail to protect against abuse of a globally shared MathJax state which allows an attacker to change the contents of a LateX post, by creating another post with specific macro defi…

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.00238 Published 2024-07-15 Fixed in 2.17.0 CWE-909
TI-2025-00393 CVE-2025-0476 · GHSA-2rqq-v9v7-f3mq

Mobile crash via file with specially crafted filename

Priority LOW 20

Mattermost Mobile Apps versions <=2.22.0 fail to properly handle specially crafted attachment names, which allows an attacker to crash the mobile app for any user who opened a channel containing the specially crafted att…

CVSS 3.1MEDIUM 4.3 Network Low privileges No interaction EPSS 0.00381 Published 2025-01-15 Fixed in 2.23.0 CWE-1287
Open these records in search →