影響を受けるバージョン系列
- 11.10 CVE 20 件
- 11.9 CVE 37 件
- 11.8 CVE 47 件
- 11.7 CVE 71 件
- 11.6 CVE 36 件
- 11.5 CVE 46 件
- 11.4 CVE 35 件
- 11.3 CVE 35 件
- 11.2 CVE 39 件
- 11.1 CVE 18 件
- 11.0 CVE 19 件
- 10.20 CVE 8 件
- 10.18 CVE 8 件
- 10.13 CVE 8 件
- 10.12 CVE 20 件
- 10.11 CVE 149 件
- 10.10 CVE 19 件
- 10.9 CVE 18 件
- 10.8 CVE 24 件
- 10.7 CVE 21 件
- 10.6 CVE 20 件
- 10.5 CVE 71 件
- 10.4 CVE 30 件
- 10.3 CVE 18 件
- 10.2 CVE 18 件
- 10.1 CVE 20 件
- 10.0 CVE 21 件
- 9.11 CVE 81 件
- 9.10 CVE 25 件
- 9.9 CVE 29 件
- 9.8 CVE 30 件
- 9.7 CVE 23 件
- 9.6 CVE 25 件
- 9.5 CVE 70 件
- 9.4 CVE 24 件
- 9.3 CVE 22 件
- 9.2 CVE 30 件
- 9.1 CVE 32 件
- 9.0 CVE 34 件
- 8.7 CVE 35 件
- 8.1 CVE 80 件
- 8.0 CVE 54 件
- 7.10 CVE 77 件
- 7.9 CVE 82 件
- 7.8 CVE 84 件
- 7.7 CVE 87 件
- 7.5 CVE 92 件
- 7.4 CVE 93 件
- 7.3 CVE 93 件
- 7.2 CVE 94 件
- 7.1 CVE 94 件
- 7.0 CVE 95 件
- 6.7 CVE 100 件
- 6.6 CVE 101 件
- 6.5 CVE 101 件
- 6.4 CVE 104 件
- 6.3 CVE 108 件
- 6.2 CVE 114 件
- 6.1 CVE 116 件
- 6.0 CVE 121 件
- 5.39 CVE 118 件
- 5.38 CVE 119 件
- 5.37 CVE 124 件
- 5.36 CVE 125 件
- 5.32 CVE 121 件
- 5.13 CVE 121 件
- 5.12 CVE 121 件
- 5.10 CVE 120 件
- 5.8 CVE 123 件
- 5.7 CVE 125 件
- 5.6 CVE 125 件
- 5.5 CVE 127 件
- 5.4 CVE 128 件
- 5.2 CVE 129 件
- 5.0 CVE 130 件
- 3.3 CVE 129 件
- 2.32 CVE 128 件
- 2.25 CVE 130 件
- 2.22 CVE 134 件
- 2.21 CVE 135 件
- 2.18 CVE 136 件
- 2.16 CVE 138 件
- 2.13 CVE 139 件
- 2.10 CVE 140 件
- 2.8 CVE 140 件
- 2.3 CVE 142 件
- 2.1 CVE 143 件
- 2.0 CVE 144 件
- 1.1 CVE 146 件
- 1.0 CVE 147 件
既知の脆弱性
| CVE | タイトル | 影響を受けるバージョン | CVSS | 悪用 | EPSS | 公開日 |
|---|---|---|---|---|---|---|
| CVE-2026-93851 | Path traversal in Mattermost Agents plugin mention reminder allows plugin replacement via crafted post | ≥ 11.9.0 ≤ 11.9.1 ≥ 11.8.0 ≤ 11.8.5 ≥ 11.7.0 ≤ 11.7.10 | 8.0 | — | 2026-10-29 | |
| CVE-2026-93846 | Team admin can escalate a team member's permissions via the team member roles endpoint | ≥ 11.7.0 ≤ 11.7.10 | 3.8 | — | 2026-10-27 | |
| CVE-2026-93848 | Mattermost OpenID discovery endpoint request bypasses outbound connection filtering, allowing SSRF by a System... | ≥ 11.7.0 ≤ 11.7.10 | 2.7 | — | 2026-10-26 | |
| CVE-2026-93850 | Unbounded memory consumption during PDF text extraction | ≥ 11.9.0 ≤ 11.9.1 ≥ 11.8.0 ≤ 11.8.5 ≥ 11.7.0 ≤ 11.7.10 | 6.5 | — | 2026-10-26 | |
| CVE-2026-93849 | Mattermost allows authenticated users to trigger excessive memory allocation via crafted msgpack binary WebSoc... | ≥ 11.9.0 ≤ 11.9.1 ≥ 11.8.0 ≤ 11.8.5 ≥ 11.7.0 ≤ 11.7.10 | 6.5 | — | 2026-10-26 | |
| CVE-2026-93847 | Improper post type validation on scheduled post endpoints | ≥ 11.7.0 ≤ 11.7.10 | 3.5 | — | 2026-10-26 | |
| CVE-2026-116516 | Insufficient length validation when parsing Zoom chat transcriptions | ≥ <=11.9 11.1.9 11.5.8 11.10.7.0 ≤ <=11.9 11.1.9 11.5.8 11.10.7.0 | 6.5 | — | 2026-10-26 | |
| CVE-2026-13411 | Null condition in Playbooks import crashes the plugin | ≥ 11.7.0 ≤ 11.7.11 | 4.3 | — | 2026-10-22 | |
| CVE-2026-18799 | Mattermost Server fails to restrict Slack import account binding, allowing team admins to forge posts as exist... | ≥ 11.10.0 ≤ 11.10.0 ≥ 11.7.0 ≤ 11.7.9 ≥ 11.9.0 ≤ 11.9.1 | 4.3 | — | 2026-10-16 | |
| CVE-2026-16251 | Mattermost local image proxy allows server memory exhaustion via unbounded image response buffering | ≥ 11.10.0 ≤ 11.10.0 ≥ 11.7.0 ≤ 11.7.9 ≥ 11.9.0 ≤ 11.9.1 | 6.5 | — | 2026-10-16 | |
| CVE-2026-18256 | Private team metadata disclosure via the team search API | ≥ 11.10.0 ≤ 11.10.0 ≥ 11.7.0 ≤ 11.7.9 ≥ 11.9.0 ≤ 11.9.1 | 4.3 | — | 2026-10-16 | |
| CVE-2026-18223 | Mattermost invitation tokens not bound to invited email address allowing unauthorized team and private channel... | ≥ 11.10.0 ≤ 11.10.0 ≥ 11.7.0 ≤ 11.7.9 ≥ 11.9.0 ≤ 11.9.1 | 5.0 | — | 2026-10-16 | |
| CVE-2026-19076 | Mattermost fails to reject OAuth application sessions in account type switch, allowing account takeover via be... | ≥ 11.10.0 ≤ 11.10.0 ≥ 11.7.0 ≤ 11.7.9 ≥ 11.9.0 ≤ 11.9.1 | 4.4 | — | 2026-10-16 | |
| CVE-2026-18560 | Improper order of authorisations in Mattermost GetFile API leads to an authenticated user to determine a post’... | ≥ 11.10.0 ≤ 11.10.0 ≥ 11.7.0 ≤ 11.7.9 ≥ 11.9.0 ≤ 11.9.1 | 4.3 | — | 2026-10-16 | |
| CVE-2026-16453 | Mattermost SAML RelayState forgery allows unauthorized team membership | ≥ 11.10.0 ≤ 11.10.0 ≥ 11.7.0 ≤ 11.7.9 ≥ 11.9.0 ≤ 11.9.1 | 7.1 | — | 2026-10-16 | |
| CVE-2026-19600 | Mattermost logs plaintext authentication tokens in debug-level server logs on failed auth attempts | ≥ 11.9.0 ≤ 11.9.1 ≥ 11.8.0 ≤ 11.8.5 ≥ 11.7.0 ≤ 11.7.10 | 4.5 | — | 2026-10-16 | |
| CVE-2026-19621 | Mattermost leaks interactive-message integration secrets to non-admin users via post-deletion events and threa... | ≥ 11.10.0 ≤ 11.10.0 ≥ 11.7.0 ≤ 11.7.9 ≥ 11.9.0 ≤ 11.9.1 | 6.5 | — | 2026-10-16 | |
| CVE-2026-19603 | Private channel ID disclosure via user status endpoints | ≥ 11.9.0 ≤ 11.9.1 ≥ 11.8.0 ≤ 11.8.5 ≥ 11.7.0 ≤ 11.7.10 | 4.3 | — | 2026-10-16 | |
| CVE-2026-18795 | Missing server side validation allowed user to quarantine a DM and GM post | ≥ 11.10.0 ≤ 11.10.0 ≥ 11.7.0 ≤ 11.7.9 ≥ 11.9.0 ≤ 11.9.1 | 6.4 | — | 2026-10-16 | |
| CVE-2026-19867 | Uncapped mention keys in user notification properties allow CPU exhaustion during post processing | ≥ 11.10.0 ≤ 11.10.0 ≥ 11.9.0 ≤ 11.9.1 ≥ 11.8.0 ≤ 11.8.5 | 4.3 | — | 2026-10-16 | |
| CVE-2026-19601 | Disclosure of AD/LDAP bind password via Test Connection | ≥ 11.9.0 ≤ 11.9.1 ≥ 11.8.0 ≤ 11.8.5 ≥ 11.7.0 ≤ 11.7.10 | 4.9 | — | 2026-10-16 | |
| CVE-2026-18551 | Mattermost guest account privilege escalation via member roles API | ≥ 11.10.0 ≤ 11.10.0 ≥ 11.7.0 ≤ 11.7.9 ≥ 11.9.0 ≤ 11.9.1 | 6.5 | — | 2026-10-16 | |
| CVE-2026-19541 | Outgoing OAuth connection client secret exposure during connection validation | ≥ 11.9.0 ≤ 11.9.1 ≥ 11.8.0 ≤ 11.8.5 ≥ 11.7.0 ≤ 11.7.10 | 6.5 | — | 2026-10-16 | |
| CVE-2026-96260 | Mattermost server missing request body size limit on plugin routes allows denial of service by an authenticate... | ≥ 11.9.0 ≤ 11.9.1 ≥ 11.8.0 ≤ 11.8.5 ≥ 11.7.0 ≤ 11.7.10 | 6.5 | — | 2026-09-23 | |
| CVE-2026-96259 | Mattermost server-side request forgery via OAuth endpoints configurable by a System Administrator | ≥ 11.9.0 ≤ 11.9.1 ≥ 11.8.0 ≤ 11.8.5 ≥ 11.7.0 ≤ 11.7.10 | 5.5 | — | 2026-09-23 | |
| CVE-2026-95666 | Unbounded post ID array in the bulk reactions endpoint allows denial of service | ≥ 11.9.0 ≤ 11.9.1 ≥ 11.8.0 ≤ 11.8.5 ≥ 11.7.0 ≤ 11.7.10 | 4.3 | — | 2026-09-22 | |
| CVE-2026-12284 | Mattermost Desktop App Missing IPC Sender Validation in Calls Leave Handler | ≤ 6.2.2 | 3.8 | — | 2026-09-18 | |
| CVE-2026-75588 | Mattermost Desktop App plugin popout scheme validation bypass | ≤ 6.2.2 | 2.6 | — | 2026-09-18 | |
| CVE-2026-75025 | Mattermost Desktop local network access from server-rendered content | ≤ 6.2.2 | 4.7 | — | 2026-09-17 | |
| CVE-2026-91181 | Data Retention Teams Endpoint Leaks Private Team Invite ID | ≥ 11.9.0 ≤ 11.9.0 ≥ 11.8.0 ≤ 11.8.4 ≥ 11.7.0 ≤ 11.7.7 | 6.5 | — | 2026-09-15 | |
| CVE-2026-12985 | Mattermost DCR redirect URI allowlist bypass via improper URL component validation | ≥ 11.9.0 ≤ 11.9.0 ≥ 11.8.0 ≤ 11.8.4 ≥ 11.7.0 ≤ 11.7.7 | 6.8 | — | 2026-09-14 | |
| CVE-2026-82920 | Mattermost ABAC parent policy bypass via policy update endpoint | ≥ 11.9.0 ≤ 11.9.0 ≥ 11.8.0 ≤ 11.8.4 ≥ 11.7.0 ≤ 11.7.7 | 5.5 | — | 2026-09-14 | |
| CVE-2026-86348 | MS Calendar plugin: unrecovered handler panics from malformed post-action requests could crash the plugin proc... | ≥ <=11.9 11.0.9 11.4.8 11.7.7 10.22.11.0 ≤ <=11.9 11.0.9 11.4.8 11.7.7 10.22.11.0 | 4.3 | — | 2026-09-14 | |
| CVE-2026-86349 | Mattermost Server Algorithmic DoS via Unbounded Markdown Block Nesting | ≥ 11.9.0 ≤ 11.9.0 ≥ 11.8.0 ≤ 11.8.4 ≥ 11.7.0 ≤ 11.7.8 | 4.3 | — | 2026-09-14 | |
| CVE-2026-10556 | Unauthenticated webhook request with null notification entry could crash the Microsoft Calendar plugin. | ≥ 11.9.0 ≤ 11.9.0 ≥ 11.8.0 ≤ 11.8.4 ≥ 11.7.0 ≤ 11.7.7 | 5.3 | — | 2026-09-14 | |
| CVE-2026-13417 | Boards plugin denial of service via unvalidated block fields.properties | ≥ 11.9.0 ≤ 11.9.0 ≥ 11.8.0 ≤ 11.8.4 ≥ 11.7.0 ≤ 11.7.7 | 4.3 | — | 2026-09-14 | |
| CVE-2026-9812 | Missing property field ownership validation in Playbooks run property update endpoint | ≥ 11.9.0 ≤ 11.9.0 ≥ 11.8.0 ≤ 11.8.4 ≥ 11.7.0 ≤ 11.7.7 | 6.5 | — | 2026-09-14 | |
| CVE-2026-8821 | Playbooks run owner channel membership permission bypass | ≥ 11.9.0 ≤ 11.9.0 ≥ 11.8.0 ≤ 11.8.4 ≥ 11.7.0 ≤ 11.7.7 | 7.1 | — | 2026-09-14 | |
| CVE-2026-5132 | Unbounded zlib decompression in Calls SDP WebSocket messages | ≥ 11.9.0 ≤ 11.9.0 ≥ 11.8.0 ≤ 11.8.4 ≥ 11.7.0 ≤ 11.7.7 | 6.5 | — | 2026-09-14 | |
| CVE-2026-15814 | Uploading a crafted image causes excessive memory allocation in the Mattermost Server | ≥ 11.9.0 ≤ 11.9.0 ≥ 11.8.0 ≤ 11.8.4 ≥ 11.7.0 ≤ 11.7.7 | 6.5 | — | 2026-09-14 | |
| CVE-2026-10542 | Playbooks channel action update validation issue | ≥ 11.9.0 ≤ 11.9.0 ≥ 11.8.0 ≤ 11.8.4 ≥ 11.7.0 ≤ 11.7.7 | 5.0 | — | 2026-09-14 | |
| CVE-2026-14344 | Inconsistent authorization checks in Mattermost Boards endpoints | ≥ 11.9.0 ≤ 11.9.0 ≥ 11.8.0 ≤ 11.8.4 ≥ 11.7.0 ≤ 11.7.7 | 4.3 | — | 2026-09-14 | |
| CVE-2026-12882 | Mattermost Markdown autolink parsing denial of service | ≥ 11.9.0 ≤ 11.9.0 ≥ 11.8.0 ≤ 11.8.4 ≥ 11.7.0 ≤ 11.7.7 | 4.3 | — | 2026-09-14 | |
| CVE-2026-11993 | Fix authenticated members disabling file content indexing server-wide via extraction pool exhaustion | ≥ 11.9.0 ≤ 11.9.0 ≥ 11.8.0 ≤ 11.8.4 ≥ 11.7.0 ≤ 11.7.7 | 4.3 | — | 2026-09-14 | |
| CVE-2026-14259 | Board archive import bypasses team board creation permissions | ≥ 11.9.0 ≤ 11.9.0 ≥ 11.8.0 ≤ 11.8.4 ≥ 11.7.0 ≤ 11.7.7 | 4.3 | — | 2026-09-14 | |
| CVE-2026-75587 | Plaintext pre-auth secret exposure via Desktop App diagnostics report | ≤ 6.2.2 | 3.6 | — | 2026-08-18 | |
| CVE-2026-9693 | Mattermost thread memberships persist after team removal, exposing private channel thread metadata on re-invit... | ≥ 10.11.0 ≤ 10.11.20 ≥ 11.7.0 ≤ 11.7.5 | 3.5 | — | 2026-08-18 | |
| CVE-2026-9859 | Mattermost Boards plugin didn’t enforce role-based authorization on board channel link allowing board editors... | ≥ 11.7.0 ≤ 11.7.6 ≥ 10.11.0 ≤ 10.11.21 ≥ 11.8.0 ≤ 11.8.3 | 6.5 | — | 2026-08-18 | |
| CVE-2026-9816 | Insufficient server-side validation of board member role fields permits privilege escalation | ≥ 11.7.0 ≤ 11.7.6 ≥ 10.11.0 ≤ 10.11.21 ≥ 11.8.0 ≤ 11.8.3 | 8.3 | — | 2026-08-18 | |
| CVE-2026-10080 | Boards plugin panics on WebSocket command with non-string field types | ≥ 11.7.0 ≤ 11.7.6 ≥ 10.11.0 ≤ 10.11.21 ≥ 11.8.0 ≤ 11.8.3 | 6.5 | — | 2026-08-18 | |
| CVE-2026-10527 | Boards plugin retains Board Admin rights for users demoted to System Guest | ≥ 11.7.0 ≤ 11.7.6 ≥ 10.11.0 ≤ 10.11.21 ≥ 11.8.0 ≤ 11.8.3 | 6.3 | — | 2026-08-17 | |
| CVE-2026-15754 | Missing per-channel team-scope check in ABAC access control policy unassign allows cross-team policy removal | ≥ 11.7.0 ≤ 11.7.6 ≥ 11.8.0 ≤ 11.8.3 | 4.2 | — | 2026-08-17 | |
| CVE-2026-16044 | Insufficient validation of guest board admin privileges on archive import | ≥ 11.7.0 ≤ 11.7.6 ≥ 10.11.0 ≤ 10.11.21 | 3.9 | — | 2026-08-17 | |
| CVE-2026-16045 | Delegated OAuth tokens could revoke unrelated OAuth application authorizations | ≥ 11.7.0 ≤ 11.7.6 ≥ 10.11.0 ≤ 10.11.21 | 2.7 | — | 2026-08-17 | |
| CVE-2026-16049 | _GitLab Plugin allows cross-channel post injection and phishing via missing channel permission checks in issue... | ≤ 10.20.11 ≤ 11.5.7 | 3.9 | — | 2026-08-17 | |
| CVE-2026-16047 | Board channel linking without read channel permission validation | ≥ 11.7.0 ≤ 11.7.6 ≥ 10.11.0 ≤ 10.11.21 ≥ 11.8.0 ≤ 11.8.3 | 4.3 | — | 2026-08-17 | |
| CVE-2026-16046 | Missing run-state validation on finished playbook runs | ≥ 11.7.0 ≤ 11.7.6 ≥ 10.11.0 ≤ 10.11.21 | 3.5 | — | 2026-08-17 | |
| CVE-2026-16048 | Channel member roles accept out-of-scope roles | ≥ 11.8.0 ≤ 11.8.2 ≥ 11.7.0 ≤ 11.7.6 ≥ 10.11.0 ≤ 10.11.21 | 6.3 | — | 2026-08-17 | |
| CVE-2026-14298 | Boards archive import endpoint allows resource exhaustion via zip bomb and file size limit bypass in Mattermos... | ≥ 11.9.0 ≤ 11.9.0 ≥ 11.8.0 ≤ 11.8.4 ≥ 11.7.0 ≤ 11.7.7 | 6.5 | — | 2026-08-13 | |
| CVE-2026-7521 | SAML certificate deletion allows path traversal to delete arbitrary files outside the config directory | ≥ 11.8.0 ≤ 11.8.0 ≥ 11.7.0 ≤ 11.7.3 ≥ 11.6.0 ≤ 11.6.5 | 5.5 | — | 2026-07-28 |
データ：CVE List（CVE® Program）、NVD、CISA KEV、FIRST EPSS（EPSS については https://www.first.org/epss を参照）、endoflife.date。ソフトウェア一覧：awesome-selfhosted（CC BY-SA 3.0）。