Affected version lines
- 11.10 20 CVEs
- 11.9 37 CVEs
- 11.8 47 CVEs
- 11.7 71 CVEs
- 11.6 36 CVEs
- 11.5 46 CVEs
- 11.4 35 CVEs
- 11.3 35 CVEs
- 11.2 39 CVEs
- 11.1 18 CVEs
- 11.0 19 CVEs
- 10.20 8 CVEs
- 10.18 8 CVEs
- 10.13 8 CVEs
- 10.12 20 CVEs
- 10.11 149 CVEs
- 10.10 19 CVEs
- 10.9 18 CVEs
- 10.8 24 CVEs
- 10.7 21 CVEs
- 10.6 20 CVEs
- 10.5 71 CVEs
- 10.4 30 CVEs
- 10.3 18 CVEs
- 10.2 18 CVEs
- 10.1 20 CVEs
- 10.0 21 CVEs
- 9.11 81 CVEs
- 9.10 25 CVEs
- 9.9 29 CVEs
- 9.8 30 CVEs
- 9.7 23 CVEs
- 9.6 25 CVEs
- 9.5 70 CVEs
- 9.4 24 CVEs
- 9.3 22 CVEs
- 9.2 30 CVEs
- 9.1 32 CVEs
- 9.0 34 CVEs
- 8.7 35 CVEs
- 8.1 80 CVEs
- 8.0 54 CVEs
- 7.10 77 CVEs
- 7.9 82 CVEs
- 7.8 84 CVEs
- 7.7 87 CVEs
- 7.5 92 CVEs
- 7.4 93 CVEs
- 7.3 93 CVEs
- 7.2 94 CVEs
- 7.1 94 CVEs
- 7.0 95 CVEs
- 6.7 100 CVEs
- 6.6 101 CVEs
- 6.5 101 CVEs
- 6.4 104 CVEs
- 6.3 108 CVEs
- 6.2 114 CVEs
- 6.1 116 CVEs
- 6.0 121 CVEs
- 5.39 118 CVEs
- 5.38 119 CVEs
- 5.37 124 CVEs
- 5.36 125 CVEs
- 5.32 121 CVEs
- 5.13 121 CVEs
- 5.12 121 CVEs
- 5.10 120 CVEs
- 5.8 123 CVEs
- 5.7 125 CVEs
- 5.6 125 CVEs
- 5.5 127 CVEs
- 5.4 128 CVEs
- 5.2 129 CVEs
- 5.0 130 CVEs
- 3.3 129 CVEs
- 2.32 128 CVEs
- 2.25 130 CVEs
- 2.22 134 CVEs
- 2.21 135 CVEs
- 2.18 136 CVEs
- 2.16 138 CVEs
- 2.13 139 CVEs
- 2.10 140 CVEs
- 2.8 140 CVEs
- 2.3 142 CVEs
- 2.1 143 CVEs
- 2.0 144 CVEs
- 1.1 146 CVEs
- 1.0 147 CVEs
Known vulnerabilities
| CVE | Title | Affected versions | CVSS | Exploited | EPSS | Published |
|---|---|---|---|---|---|---|
| CVE-2026-93851 | Path traversal in Mattermost Agents plugin mention reminder allows plugin replacement via crafted post | ≥ 11.9.0 ≤ 11.9.1 ≥ 11.8.0 ≤ 11.8.5 ≥ 11.7.0 ≤ 11.7.10 | 8.0 | — | 2026-10-29 | |
| CVE-2026-93846 | Team admin can escalate a team member's permissions via the team member roles endpoint | ≥ 11.7.0 ≤ 11.7.10 | 3.8 | — | 2026-10-27 | |
| CVE-2026-93848 | Mattermost OpenID discovery endpoint request bypasses outbound connection filtering, allowing SSRF by a System... | ≥ 11.7.0 ≤ 11.7.10 | 2.7 | — | 2026-10-26 | |
| CVE-2026-93850 | Unbounded memory consumption during PDF text extraction | ≥ 11.9.0 ≤ 11.9.1 ≥ 11.8.0 ≤ 11.8.5 ≥ 11.7.0 ≤ 11.7.10 | 6.5 | — | 2026-10-26 | |
| CVE-2026-93849 | Mattermost allows authenticated users to trigger excessive memory allocation via crafted msgpack binary WebSoc... | ≥ 11.9.0 ≤ 11.9.1 ≥ 11.8.0 ≤ 11.8.5 ≥ 11.7.0 ≤ 11.7.10 | 6.5 | — | 2026-10-26 | |
| CVE-2026-93847 | Improper post type validation on scheduled post endpoints | ≥ 11.7.0 ≤ 11.7.10 | 3.5 | — | 2026-10-26 | |
| CVE-2026-116516 | Insufficient length validation when parsing Zoom chat transcriptions | ≥ <=11.9 11.1.9 11.5.8 11.10.7.0 ≤ <=11.9 11.1.9 11.5.8 11.10.7.0 | 6.5 | — | 2026-10-26 | |
| CVE-2026-13411 | Null condition in Playbooks import crashes the plugin | ≥ 11.7.0 ≤ 11.7.11 | 4.3 | — | 2026-10-22 | |
| CVE-2026-18799 | Mattermost Server fails to restrict Slack import account binding, allowing team admins to forge posts as exist... | ≥ 11.10.0 ≤ 11.10.0 ≥ 11.7.0 ≤ 11.7.9 ≥ 11.9.0 ≤ 11.9.1 | 4.3 | — | 2026-10-16 | |
| CVE-2026-16251 | Mattermost local image proxy allows server memory exhaustion via unbounded image response buffering | ≥ 11.10.0 ≤ 11.10.0 ≥ 11.7.0 ≤ 11.7.9 ≥ 11.9.0 ≤ 11.9.1 | 6.5 | — | 2026-10-16 | |
| CVE-2026-18256 | Private team metadata disclosure via the team search API | ≥ 11.10.0 ≤ 11.10.0 ≥ 11.7.0 ≤ 11.7.9 ≥ 11.9.0 ≤ 11.9.1 | 4.3 | — | 2026-10-16 | |
| CVE-2026-18223 | Mattermost invitation tokens not bound to invited email address allowing unauthorized team and private channel... | ≥ 11.10.0 ≤ 11.10.0 ≥ 11.7.0 ≤ 11.7.9 ≥ 11.9.0 ≤ 11.9.1 | 5.0 | — | 2026-10-16 | |
| CVE-2026-19076 | Mattermost fails to reject OAuth application sessions in account type switch, allowing account takeover via be... | ≥ 11.10.0 ≤ 11.10.0 ≥ 11.7.0 ≤ 11.7.9 ≥ 11.9.0 ≤ 11.9.1 | 4.4 | — | 2026-10-16 | |
| CVE-2026-18560 | Improper order of authorisations in Mattermost GetFile API leads to an authenticated user to determine a post’... | ≥ 11.10.0 ≤ 11.10.0 ≥ 11.7.0 ≤ 11.7.9 ≥ 11.9.0 ≤ 11.9.1 | 4.3 | — | 2026-10-16 | |
| CVE-2026-16453 | Mattermost SAML RelayState forgery allows unauthorized team membership | ≥ 11.10.0 ≤ 11.10.0 ≥ 11.7.0 ≤ 11.7.9 ≥ 11.9.0 ≤ 11.9.1 | 7.1 | — | 2026-10-16 | |
| CVE-2026-19600 | Mattermost logs plaintext authentication tokens in debug-level server logs on failed auth attempts | ≥ 11.9.0 ≤ 11.9.1 ≥ 11.8.0 ≤ 11.8.5 ≥ 11.7.0 ≤ 11.7.10 | 4.5 | — | 2026-10-16 | |
| CVE-2026-19621 | Mattermost leaks interactive-message integration secrets to non-admin users via post-deletion events and threa... | ≥ 11.10.0 ≤ 11.10.0 ≥ 11.7.0 ≤ 11.7.9 ≥ 11.9.0 ≤ 11.9.1 | 6.5 | — | 2026-10-16 | |
| CVE-2026-19603 | Private channel ID disclosure via user status endpoints | ≥ 11.9.0 ≤ 11.9.1 ≥ 11.8.0 ≤ 11.8.5 ≥ 11.7.0 ≤ 11.7.10 | 4.3 | — | 2026-10-16 | |
| CVE-2026-18795 | Missing server side validation allowed user to quarantine a DM and GM post | ≥ 11.10.0 ≤ 11.10.0 ≥ 11.7.0 ≤ 11.7.9 ≥ 11.9.0 ≤ 11.9.1 | 6.4 | — | 2026-10-16 | |
| CVE-2026-19867 | Uncapped mention keys in user notification properties allow CPU exhaustion during post processing | ≥ 11.10.0 ≤ 11.10.0 ≥ 11.9.0 ≤ 11.9.1 ≥ 11.8.0 ≤ 11.8.5 | 4.3 | — | 2026-10-16 | |
| CVE-2026-19601 | Disclosure of AD/LDAP bind password via Test Connection | ≥ 11.9.0 ≤ 11.9.1 ≥ 11.8.0 ≤ 11.8.5 ≥ 11.7.0 ≤ 11.7.10 | 4.9 | — | 2026-10-16 | |
| CVE-2026-18551 | Mattermost guest account privilege escalation via member roles API | ≥ 11.10.0 ≤ 11.10.0 ≥ 11.7.0 ≤ 11.7.9 ≥ 11.9.0 ≤ 11.9.1 | 6.5 | — | 2026-10-16 | |
| CVE-2026-19541 | Outgoing OAuth connection client secret exposure during connection validation | ≥ 11.9.0 ≤ 11.9.1 ≥ 11.8.0 ≤ 11.8.5 ≥ 11.7.0 ≤ 11.7.10 | 6.5 | — | 2026-10-16 | |
| CVE-2026-96260 | Mattermost server missing request body size limit on plugin routes allows denial of service by an authenticate... | ≥ 11.9.0 ≤ 11.9.1 ≥ 11.8.0 ≤ 11.8.5 ≥ 11.7.0 ≤ 11.7.10 | 6.5 | — | 2026-09-23 | |
| CVE-2026-96259 | Mattermost server-side request forgery via OAuth endpoints configurable by a System Administrator | ≥ 11.9.0 ≤ 11.9.1 ≥ 11.8.0 ≤ 11.8.5 ≥ 11.7.0 ≤ 11.7.10 | 5.5 | — | 2026-09-23 | |
| CVE-2026-95666 | Unbounded post ID array in the bulk reactions endpoint allows denial of service | ≥ 11.9.0 ≤ 11.9.1 ≥ 11.8.0 ≤ 11.8.5 ≥ 11.7.0 ≤ 11.7.10 | 4.3 | — | 2026-09-22 | |
| CVE-2026-12284 | Mattermost Desktop App Missing IPC Sender Validation in Calls Leave Handler | ≤ 6.2.2 | 3.8 | — | 2026-09-18 | |
| CVE-2026-75588 | Mattermost Desktop App plugin popout scheme validation bypass | ≤ 6.2.2 | 2.6 | — | 2026-09-18 | |
| CVE-2026-75025 | Mattermost Desktop local network access from server-rendered content | ≤ 6.2.2 | 4.7 | — | 2026-09-17 | |
| CVE-2026-91181 | Data Retention Teams Endpoint Leaks Private Team Invite ID | ≥ 11.9.0 ≤ 11.9.0 ≥ 11.8.0 ≤ 11.8.4 ≥ 11.7.0 ≤ 11.7.7 | 6.5 | — | 2026-09-15 | |
| CVE-2026-12985 | Mattermost DCR redirect URI allowlist bypass via improper URL component validation | ≥ 11.9.0 ≤ 11.9.0 ≥ 11.8.0 ≤ 11.8.4 ≥ 11.7.0 ≤ 11.7.7 | 6.8 | — | 2026-09-14 | |
| CVE-2026-82920 | Mattermost ABAC parent policy bypass via policy update endpoint | ≥ 11.9.0 ≤ 11.9.0 ≥ 11.8.0 ≤ 11.8.4 ≥ 11.7.0 ≤ 11.7.7 | 5.5 | — | 2026-09-14 | |
| CVE-2026-86348 | MS Calendar plugin: unrecovered handler panics from malformed post-action requests could crash the plugin proc... | ≥ <=11.9 11.0.9 11.4.8 11.7.7 10.22.11.0 ≤ <=11.9 11.0.9 11.4.8 11.7.7 10.22.11.0 | 4.3 | — | 2026-09-14 | |
| CVE-2026-86349 | Mattermost Server Algorithmic DoS via Unbounded Markdown Block Nesting | ≥ 11.9.0 ≤ 11.9.0 ≥ 11.8.0 ≤ 11.8.4 ≥ 11.7.0 ≤ 11.7.8 | 4.3 | — | 2026-09-14 | |
| CVE-2026-10556 | Unauthenticated webhook request with null notification entry could crash the Microsoft Calendar plugin. | ≥ 11.9.0 ≤ 11.9.0 ≥ 11.8.0 ≤ 11.8.4 ≥ 11.7.0 ≤ 11.7.7 | 5.3 | — | 2026-09-14 | |
| CVE-2026-13417 | Boards plugin denial of service via unvalidated block fields.properties | ≥ 11.9.0 ≤ 11.9.0 ≥ 11.8.0 ≤ 11.8.4 ≥ 11.7.0 ≤ 11.7.7 | 4.3 | — | 2026-09-14 | |
| CVE-2026-9812 | Missing property field ownership validation in Playbooks run property update endpoint | ≥ 11.9.0 ≤ 11.9.0 ≥ 11.8.0 ≤ 11.8.4 ≥ 11.7.0 ≤ 11.7.7 | 6.5 | — | 2026-09-14 | |
| CVE-2026-8821 | Playbooks run owner channel membership permission bypass | ≥ 11.9.0 ≤ 11.9.0 ≥ 11.8.0 ≤ 11.8.4 ≥ 11.7.0 ≤ 11.7.7 | 7.1 | — | 2026-09-14 | |
| CVE-2026-5132 | Unbounded zlib decompression in Calls SDP WebSocket messages | ≥ 11.9.0 ≤ 11.9.0 ≥ 11.8.0 ≤ 11.8.4 ≥ 11.7.0 ≤ 11.7.7 | 6.5 | — | 2026-09-14 | |
| CVE-2026-15814 | Uploading a crafted image causes excessive memory allocation in the Mattermost Server | ≥ 11.9.0 ≤ 11.9.0 ≥ 11.8.0 ≤ 11.8.4 ≥ 11.7.0 ≤ 11.7.7 | 6.5 | — | 2026-09-14 | |
| CVE-2026-10542 | Playbooks channel action update validation issue | ≥ 11.9.0 ≤ 11.9.0 ≥ 11.8.0 ≤ 11.8.4 ≥ 11.7.0 ≤ 11.7.7 | 5.0 | — | 2026-09-14 | |
| CVE-2026-14344 | Inconsistent authorization checks in Mattermost Boards endpoints | ≥ 11.9.0 ≤ 11.9.0 ≥ 11.8.0 ≤ 11.8.4 ≥ 11.7.0 ≤ 11.7.7 | 4.3 | — | 2026-09-14 | |
| CVE-2026-12882 | Mattermost Markdown autolink parsing denial of service | ≥ 11.9.0 ≤ 11.9.0 ≥ 11.8.0 ≤ 11.8.4 ≥ 11.7.0 ≤ 11.7.7 | 4.3 | — | 2026-09-14 | |
| CVE-2026-11993 | Fix authenticated members disabling file content indexing server-wide via extraction pool exhaustion | ≥ 11.9.0 ≤ 11.9.0 ≥ 11.8.0 ≤ 11.8.4 ≥ 11.7.0 ≤ 11.7.7 | 4.3 | — | 2026-09-14 | |
| CVE-2026-14259 | Board archive import bypasses team board creation permissions | ≥ 11.9.0 ≤ 11.9.0 ≥ 11.8.0 ≤ 11.8.4 ≥ 11.7.0 ≤ 11.7.7 | 4.3 | — | 2026-09-14 | |
| CVE-2026-75587 | Plaintext pre-auth secret exposure via Desktop App diagnostics report | ≤ 6.2.2 | 3.6 | — | 2026-08-18 | |
| CVE-2026-9693 | Mattermost thread memberships persist after team removal, exposing private channel thread metadata on re-invit... | ≥ 10.11.0 ≤ 10.11.20 ≥ 11.7.0 ≤ 11.7.5 | 3.5 | — | 2026-08-18 | |
| CVE-2026-9859 | Mattermost Boards plugin didn’t enforce role-based authorization on board channel link allowing board editors... | ≥ 11.7.0 ≤ 11.7.6 ≥ 10.11.0 ≤ 10.11.21 ≥ 11.8.0 ≤ 11.8.3 | 6.5 | — | 2026-08-18 | |
| CVE-2026-9816 | Insufficient server-side validation of board member role fields permits privilege escalation | ≥ 11.7.0 ≤ 11.7.6 ≥ 10.11.0 ≤ 10.11.21 ≥ 11.8.0 ≤ 11.8.3 | 8.3 | — | 2026-08-18 | |
| CVE-2026-10080 | Boards plugin panics on WebSocket command with non-string field types | ≥ 11.7.0 ≤ 11.7.6 ≥ 10.11.0 ≤ 10.11.21 ≥ 11.8.0 ≤ 11.8.3 | 6.5 | — | 2026-08-18 | |
| CVE-2026-10527 | Boards plugin retains Board Admin rights for users demoted to System Guest | ≥ 11.7.0 ≤ 11.7.6 ≥ 10.11.0 ≤ 10.11.21 ≥ 11.8.0 ≤ 11.8.3 | 6.3 | — | 2026-08-17 | |
| CVE-2026-15754 | Missing per-channel team-scope check in ABAC access control policy unassign allows cross-team policy removal | ≥ 11.7.0 ≤ 11.7.6 ≥ 11.8.0 ≤ 11.8.3 | 4.2 | — | 2026-08-17 | |
| CVE-2026-16044 | Insufficient validation of guest board admin privileges on archive import | ≥ 11.7.0 ≤ 11.7.6 ≥ 10.11.0 ≤ 10.11.21 | 3.9 | — | 2026-08-17 | |
| CVE-2026-16045 | Delegated OAuth tokens could revoke unrelated OAuth application authorizations | ≥ 11.7.0 ≤ 11.7.6 ≥ 10.11.0 ≤ 10.11.21 | 2.7 | — | 2026-08-17 | |
| CVE-2026-16049 | _GitLab Plugin allows cross-channel post injection and phishing via missing channel permission checks in issue... | ≤ 10.20.11 ≤ 11.5.7 | 3.9 | — | 2026-08-17 | |
| CVE-2026-16047 | Board channel linking without read channel permission validation | ≥ 11.7.0 ≤ 11.7.6 ≥ 10.11.0 ≤ 10.11.21 ≥ 11.8.0 ≤ 11.8.3 | 4.3 | — | 2026-08-17 | |
| CVE-2026-16046 | Missing run-state validation on finished playbook runs | ≥ 11.7.0 ≤ 11.7.6 ≥ 10.11.0 ≤ 10.11.21 | 3.5 | — | 2026-08-17 | |
| CVE-2026-16048 | Channel member roles accept out-of-scope roles | ≥ 11.8.0 ≤ 11.8.2 ≥ 11.7.0 ≤ 11.7.6 ≥ 10.11.0 ≤ 10.11.21 | 6.3 | — | 2026-08-17 | |
| CVE-2026-14298 | Boards archive import endpoint allows resource exhaustion via zip bomb and file size limit bypass in Mattermos... | ≥ 11.9.0 ≤ 11.9.0 ≥ 11.8.0 ≤ 11.8.4 ≥ 11.7.0 ≤ 11.7.7 | 6.5 | — | 2026-08-13 | |
| CVE-2026-7521 | SAML certificate deletion allows path traversal to delete arbitrary files outside the config directory | ≥ 11.8.0 ≤ 11.8.0 ≥ 11.7.0 ≤ 11.7.3 ≥ 11.6.0 ≤ 11.6.5 | 5.5 | — | 2026-07-28 |
Track these versions on your own servers
InfraGuard collects installed software versions from every server and flags the ones with known vulnerabilities. Self-hosted — nothing leaves your network.
Data: CVE List (CVE® Program), NVD, CISA KEV, FIRST EPSS (see EPSS at https://www.first.org/epss), endoflife.date. Software list: awesome-selfhosted (CC BY-SA 3.0).