InfraGuard
로그인 지금 사용해보기 바로구매

Mattermost 취약점 (CVE 목록)

480 CVE9.9 최고 CVSS

영향받는 버전 라인

알려진 취약점

CVE 제목 영향 버전 CVSS 악용 EPSS 공개일
CVE-2026-93851 Path traversal in Mattermost Agents plugin mention reminder allows plugin replacement via crafted post ≥ 11.9.0 ≤ 11.9.1 ≥ 11.8.0 ≤ 11.8.5 ≥ 11.7.0 ≤ 11.7.10 8.0 — 2026-10-29
CVE-2026-93846 Team admin can escalate a team member's permissions via the team member roles endpoint ≥ 11.7.0 ≤ 11.7.10 3.8 — 2026-10-27
CVE-2026-93848 Mattermost OpenID discovery endpoint request bypasses outbound connection filtering, allowing SSRF by a System... ≥ 11.7.0 ≤ 11.7.10 2.7 — 2026-10-26
CVE-2026-93850 Unbounded memory consumption during PDF text extraction ≥ 11.9.0 ≤ 11.9.1 ≥ 11.8.0 ≤ 11.8.5 ≥ 11.7.0 ≤ 11.7.10 6.5 — 2026-10-26
CVE-2026-93849 Mattermost allows authenticated users to trigger excessive memory allocation via crafted msgpack binary WebSoc... ≥ 11.9.0 ≤ 11.9.1 ≥ 11.8.0 ≤ 11.8.5 ≥ 11.7.0 ≤ 11.7.10 6.5 — 2026-10-26
CVE-2026-93847 Improper post type validation on scheduled post endpoints ≥ 11.7.0 ≤ 11.7.10 3.5 — 2026-10-26
CVE-2026-116516 Insufficient length validation when parsing Zoom chat transcriptions ≥ <=11.9 11.1.9 11.5.8 11.10.7.0 ≤ <=11.9 11.1.9 11.5.8 11.10.7.0 6.5 — 2026-10-26
CVE-2026-13411 Null condition in Playbooks import crashes the plugin ≥ 11.7.0 ≤ 11.7.11 4.3 — 2026-10-22
CVE-2026-18799 Mattermost Server fails to restrict Slack import account binding, allowing team admins to forge posts as exist... ≥ 11.10.0 ≤ 11.10.0 ≥ 11.7.0 ≤ 11.7.9 ≥ 11.9.0 ≤ 11.9.1 4.3 — 2026-10-16
CVE-2026-16251 Mattermost local image proxy allows server memory exhaustion via unbounded image response buffering ≥ 11.10.0 ≤ 11.10.0 ≥ 11.7.0 ≤ 11.7.9 ≥ 11.9.0 ≤ 11.9.1 6.5 — 2026-10-16
CVE-2026-18256 Private team metadata disclosure via the team search API ≥ 11.10.0 ≤ 11.10.0 ≥ 11.7.0 ≤ 11.7.9 ≥ 11.9.0 ≤ 11.9.1 4.3 — 2026-10-16
CVE-2026-18223 Mattermost invitation tokens not bound to invited email address allowing unauthorized team and private channel... ≥ 11.10.0 ≤ 11.10.0 ≥ 11.7.0 ≤ 11.7.9 ≥ 11.9.0 ≤ 11.9.1 5.0 — 2026-10-16
CVE-2026-19076 Mattermost fails to reject OAuth application sessions in account type switch, allowing account takeover via be... ≥ 11.10.0 ≤ 11.10.0 ≥ 11.7.0 ≤ 11.7.9 ≥ 11.9.0 ≤ 11.9.1 4.4 — 2026-10-16
CVE-2026-18560 Improper order of authorisations in Mattermost GetFile API leads to an authenticated user to determine a post’... ≥ 11.10.0 ≤ 11.10.0 ≥ 11.7.0 ≤ 11.7.9 ≥ 11.9.0 ≤ 11.9.1 4.3 — 2026-10-16
CVE-2026-16453 Mattermost SAML RelayState forgery allows unauthorized team membership ≥ 11.10.0 ≤ 11.10.0 ≥ 11.7.0 ≤ 11.7.9 ≥ 11.9.0 ≤ 11.9.1 7.1 — 2026-10-16
CVE-2026-19600 Mattermost logs plaintext authentication tokens in debug-level server logs on failed auth attempts ≥ 11.9.0 ≤ 11.9.1 ≥ 11.8.0 ≤ 11.8.5 ≥ 11.7.0 ≤ 11.7.10 4.5 — 2026-10-16
CVE-2026-19621 Mattermost leaks interactive-message integration secrets to non-admin users via post-deletion events and threa... ≥ 11.10.0 ≤ 11.10.0 ≥ 11.7.0 ≤ 11.7.9 ≥ 11.9.0 ≤ 11.9.1 6.5 — 2026-10-16
CVE-2026-19603 Private channel ID disclosure via user status endpoints ≥ 11.9.0 ≤ 11.9.1 ≥ 11.8.0 ≤ 11.8.5 ≥ 11.7.0 ≤ 11.7.10 4.3 — 2026-10-16
CVE-2026-18795 Missing server side validation allowed user to quarantine a DM and GM post ≥ 11.10.0 ≤ 11.10.0 ≥ 11.7.0 ≤ 11.7.9 ≥ 11.9.0 ≤ 11.9.1 6.4 — 2026-10-16
CVE-2026-19867 Uncapped mention keys in user notification properties allow CPU exhaustion during post processing ≥ 11.10.0 ≤ 11.10.0 ≥ 11.9.0 ≤ 11.9.1 ≥ 11.8.0 ≤ 11.8.5 4.3 — 2026-10-16
CVE-2026-19601 Disclosure of AD/LDAP bind password via Test Connection ≥ 11.9.0 ≤ 11.9.1 ≥ 11.8.0 ≤ 11.8.5 ≥ 11.7.0 ≤ 11.7.10 4.9 — 2026-10-16
CVE-2026-18551 Mattermost guest account privilege escalation via member roles API ≥ 11.10.0 ≤ 11.10.0 ≥ 11.7.0 ≤ 11.7.9 ≥ 11.9.0 ≤ 11.9.1 6.5 — 2026-10-16
CVE-2026-19541 Outgoing OAuth connection client secret exposure during connection validation ≥ 11.9.0 ≤ 11.9.1 ≥ 11.8.0 ≤ 11.8.5 ≥ 11.7.0 ≤ 11.7.10 6.5 — 2026-10-16
CVE-2026-96260 Mattermost server missing request body size limit on plugin routes allows denial of service by an authenticate... ≥ 11.9.0 ≤ 11.9.1 ≥ 11.8.0 ≤ 11.8.5 ≥ 11.7.0 ≤ 11.7.10 6.5 — 2026-09-23
CVE-2026-96259 Mattermost server-side request forgery via OAuth endpoints configurable by a System Administrator ≥ 11.9.0 ≤ 11.9.1 ≥ 11.8.0 ≤ 11.8.5 ≥ 11.7.0 ≤ 11.7.10 5.5 — 2026-09-23
CVE-2026-95666 Unbounded post ID array in the bulk reactions endpoint allows denial of service ≥ 11.9.0 ≤ 11.9.1 ≥ 11.8.0 ≤ 11.8.5 ≥ 11.7.0 ≤ 11.7.10 4.3 — 2026-09-22
CVE-2026-12284 Mattermost Desktop App Missing IPC Sender Validation in Calls Leave Handler ≤ 6.2.2 3.8 — 2026-09-18
CVE-2026-75588 Mattermost Desktop App plugin popout scheme validation bypass ≤ 6.2.2 2.6 — 2026-09-18
CVE-2026-75025 Mattermost Desktop local network access from server-rendered content ≤ 6.2.2 4.7 — 2026-09-17
CVE-2026-91181 Data Retention Teams Endpoint Leaks Private Team Invite ID ≥ 11.9.0 ≤ 11.9.0 ≥ 11.8.0 ≤ 11.8.4 ≥ 11.7.0 ≤ 11.7.7 6.5 — 2026-09-15
CVE-2026-12985 Mattermost DCR redirect URI allowlist bypass via improper URL component validation ≥ 11.9.0 ≤ 11.9.0 ≥ 11.8.0 ≤ 11.8.4 ≥ 11.7.0 ≤ 11.7.7 6.8 — 2026-09-14
CVE-2026-82920 Mattermost ABAC parent policy bypass via policy update endpoint ≥ 11.9.0 ≤ 11.9.0 ≥ 11.8.0 ≤ 11.8.4 ≥ 11.7.0 ≤ 11.7.7 5.5 — 2026-09-14
CVE-2026-86348 MS Calendar plugin: unrecovered handler panics from malformed post-action requests could crash the plugin proc... ≥ <=11.9 11.0.9 11.4.8 11.7.7 10.22.11.0 ≤ <=11.9 11.0.9 11.4.8 11.7.7 10.22.11.0 4.3 — 2026-09-14
CVE-2026-86349 Mattermost Server Algorithmic DoS via Unbounded Markdown Block Nesting ≥ 11.9.0 ≤ 11.9.0 ≥ 11.8.0 ≤ 11.8.4 ≥ 11.7.0 ≤ 11.7.8 4.3 — 2026-09-14
CVE-2026-10556 Unauthenticated webhook request with null notification entry could crash the Microsoft Calendar plugin. ≥ 11.9.0 ≤ 11.9.0 ≥ 11.8.0 ≤ 11.8.4 ≥ 11.7.0 ≤ 11.7.7 5.3 — 2026-09-14
CVE-2026-13417 Boards plugin denial of service via unvalidated block fields.properties ≥ 11.9.0 ≤ 11.9.0 ≥ 11.8.0 ≤ 11.8.4 ≥ 11.7.0 ≤ 11.7.7 4.3 — 2026-09-14
CVE-2026-9812 Missing property field ownership validation in Playbooks run property update endpoint ≥ 11.9.0 ≤ 11.9.0 ≥ 11.8.0 ≤ 11.8.4 ≥ 11.7.0 ≤ 11.7.7 6.5 — 2026-09-14
CVE-2026-8821 Playbooks run owner channel membership permission bypass ≥ 11.9.0 ≤ 11.9.0 ≥ 11.8.0 ≤ 11.8.4 ≥ 11.7.0 ≤ 11.7.7 7.1 — 2026-09-14
CVE-2026-5132 Unbounded zlib decompression in Calls SDP WebSocket messages ≥ 11.9.0 ≤ 11.9.0 ≥ 11.8.0 ≤ 11.8.4 ≥ 11.7.0 ≤ 11.7.7 6.5 — 2026-09-14
CVE-2026-15814 Uploading a crafted image causes excessive memory allocation in the Mattermost Server ≥ 11.9.0 ≤ 11.9.0 ≥ 11.8.0 ≤ 11.8.4 ≥ 11.7.0 ≤ 11.7.7 6.5 — 2026-09-14
CVE-2026-10542 Playbooks channel action update validation issue ≥ 11.9.0 ≤ 11.9.0 ≥ 11.8.0 ≤ 11.8.4 ≥ 11.7.0 ≤ 11.7.7 5.0 — 2026-09-14
CVE-2026-14344 Inconsistent authorization checks in Mattermost Boards endpoints ≥ 11.9.0 ≤ 11.9.0 ≥ 11.8.0 ≤ 11.8.4 ≥ 11.7.0 ≤ 11.7.7 4.3 — 2026-09-14
CVE-2026-12882 Mattermost Markdown autolink parsing denial of service ≥ 11.9.0 ≤ 11.9.0 ≥ 11.8.0 ≤ 11.8.4 ≥ 11.7.0 ≤ 11.7.7 4.3 — 2026-09-14
CVE-2026-11993 Fix authenticated members disabling file content indexing server-wide via extraction pool exhaustion ≥ 11.9.0 ≤ 11.9.0 ≥ 11.8.0 ≤ 11.8.4 ≥ 11.7.0 ≤ 11.7.7 4.3 — 2026-09-14
CVE-2026-14259 Board archive import bypasses team board creation permissions ≥ 11.9.0 ≤ 11.9.0 ≥ 11.8.0 ≤ 11.8.4 ≥ 11.7.0 ≤ 11.7.7 4.3 — 2026-09-14
CVE-2026-75587 Plaintext pre-auth secret exposure via Desktop App diagnostics report ≤ 6.2.2 3.6 — 2026-08-18
CVE-2026-9693 Mattermost thread memberships persist after team removal, exposing private channel thread metadata on re-invit... ≥ 10.11.0 ≤ 10.11.20 ≥ 11.7.0 ≤ 11.7.5 3.5 — 2026-08-18
CVE-2026-9859 Mattermost Boards plugin didn’t enforce role-based authorization on board channel link allowing board editors... ≥ 11.7.0 ≤ 11.7.6 ≥ 10.11.0 ≤ 10.11.21 ≥ 11.8.0 ≤ 11.8.3 6.5 — 2026-08-18
CVE-2026-9816 Insufficient server-side validation of board member role fields permits privilege escalation ≥ 11.7.0 ≤ 11.7.6 ≥ 10.11.0 ≤ 10.11.21 ≥ 11.8.0 ≤ 11.8.3 8.3 — 2026-08-18
CVE-2026-10080 Boards plugin panics on WebSocket command with non-string field types ≥ 11.7.0 ≤ 11.7.6 ≥ 10.11.0 ≤ 10.11.21 ≥ 11.8.0 ≤ 11.8.3 6.5 — 2026-08-18
CVE-2026-10527 Boards plugin retains Board Admin rights for users demoted to System Guest ≥ 11.7.0 ≤ 11.7.6 ≥ 10.11.0 ≤ 10.11.21 ≥ 11.8.0 ≤ 11.8.3 6.3 — 2026-08-17
CVE-2026-15754 Missing per-channel team-scope check in ABAC access control policy unassign allows cross-team policy removal ≥ 11.7.0 ≤ 11.7.6 ≥ 11.8.0 ≤ 11.8.3 4.2 — 2026-08-17
CVE-2026-16044 Insufficient validation of guest board admin privileges on archive import ≥ 11.7.0 ≤ 11.7.6 ≥ 10.11.0 ≤ 10.11.21 3.9 — 2026-08-17
CVE-2026-16045 Delegated OAuth tokens could revoke unrelated OAuth application authorizations ≥ 11.7.0 ≤ 11.7.6 ≥ 10.11.0 ≤ 10.11.21 2.7 — 2026-08-17
CVE-2026-16049 _GitLab Plugin allows cross-channel post injection and phishing via missing channel permission checks in issue... ≤ 10.20.11 ≤ 11.5.7 3.9 — 2026-08-17
CVE-2026-16047 Board channel linking without read channel permission validation ≥ 11.7.0 ≤ 11.7.6 ≥ 10.11.0 ≤ 10.11.21 ≥ 11.8.0 ≤ 11.8.3 4.3 — 2026-08-17
CVE-2026-16046 Missing run-state validation on finished playbook runs ≥ 11.7.0 ≤ 11.7.6 ≥ 10.11.0 ≤ 10.11.21 3.5 — 2026-08-17
CVE-2026-16048 Channel member roles accept out-of-scope roles ≥ 11.8.0 ≤ 11.8.2 ≥ 11.7.0 ≤ 11.7.6 ≥ 10.11.0 ≤ 10.11.21 6.3 — 2026-08-17
CVE-2026-14298 Boards archive import endpoint allows resource exhaustion via zip bomb and file size limit bypass in Mattermos... ≥ 11.9.0 ≤ 11.9.0 ≥ 11.8.0 ≤ 11.8.4 ≥ 11.7.0 ≤ 11.7.7 6.5 — 2026-08-13
CVE-2026-7521 SAML certificate deletion allows path traversal to delete arbitrary files outside the config directory ≥ 11.8.0 ≤ 11.8.0 ≥ 11.7.0 ≤ 11.7.3 ≥ 11.6.0 ≤ 11.6.5 5.5 — 2026-07-28
공식 웹사이트 소스 코드 SolutionMarket 소개 페이지

내 서버의 버전을 직접 추적하세요

InfraGuard 는 모든 서버에 설치된 소프트웨어 버전을 수집하고, 알려진 취약점이 있는 버전을 알려 줍니다. 자체 호스팅이라 데이터가 내 네트워크를 벗어나지 않습니다.

라이브 데모 써 보기 바로구매

주간 악용 취약점 다이제스트

셀프호스팅 서버에 중요한 KEV 추가분을 일주일에 한 번 보내드립니다. 다른 메일은 보내지 않습니다.

데이터: CVE List(CVE® Program), NVD, CISA KEV, FIRST EPSS(EPSS 는 https://www.first.org/epss 참고), endoflife.date. 소프트웨어 목록: awesome-selfhosted(CC BY-SA 3.0).