Mattermost

Mattermost

265 Schwachstellen gefunden.

Hinweis: Diese Liste kann unvollständig sein. Daten werden ohne Gewähr im Ursprungsformat bereitgestellt.
3.1

CVE-2026-4053

  • EPSS 0.04%
  • Veröffentlicht 15.05.2026 18:42:47
  • Zuletzt bearbeitet 15.05.2026 19:17:04

Mattermost versions 11.5.x <= 11.5.1, 10.11.x <= 10.11.13 fail to enforce the PostEditTimeLimit on non-message post fields which allows an authenticated user to modify post file attachments, props, and pin status after the edit window has expired via...

4.3

CVE-2026-4054

  • EPSS 0.09%
  • Veröffentlicht 15.05.2026 18:32:44
  • Zuletzt bearbeitet 15.05.2026 19:17:04

Mattermost versions 11.5.x <= 11.5.1, 10.11.x <= 10.11.13, 11.4.x <= 11.4.3 Fail to validate the response body of proxied images, which allows a remote attacker to enact client-side DoS via an SVG file served from an attacker-controlled origin under ...

6.5

CVE-2026-3590

  • EPSS 0.03%
  • Veröffentlicht 15.04.2026 11:00:14
  • Zuletzt bearbeitet 22.04.2026 19:41:52

Mattermost versions 10.11.x <= 10.11.12, 11.5.x <= 11.5.0, 11.4.x <= 11.4.2, 11.3.x <= 11.3.2 fail to enforce atomic single-use consumption of guest magic link tokens, which allows an attacker with access to a valid magic link to establish multiple i...

8.1

CVE-2026-28741

  • EPSS 0.02%
  • Veröffentlicht 15.04.2026 10:13:33
  • Zuletzt bearbeitet 22.04.2026 19:42:25

Mattermost versions 10.11.x <= 10.11.12, 11.5.x <= 11.5.0, 11.4.x <= 11.4.2, 11.3.x <= 11.3.2 fail to validate CSRF tokens on an authentication endpoint which allows an attacker to update a user's authentication method via a CSRF attack by tricking a...

2.7

CVE-2026-27769

  • EPSS 0.03%
  • Veröffentlicht 15.04.2026 10:11:07
  • Zuletzt bearbeitet 22.04.2026 19:43:52

Mattermost versions 10.11.x <= 10.11.12 fail to validate whether users were correctly owned by the correct Connected Workspace which allows a malicious remote server connected using the Conntexted Workspaces feature to change the displayed status of ...

6.5

CVE-2026-24661

  • EPSS 0.05%
  • Veröffentlicht 09.04.2026 10:12:45
  • Zuletzt bearbeitet 17.04.2026 20:31:03

Mattermost Plugins versions <=2.1.3.0 fail to limit the request body size on the {{/changes}} webhook endpoint which allows an authenticated attacker to cause memory exhaustion and denial of service via sending an oversized JSON payload. Mattermost A...

6.5

CVE-2026-21388

  • EPSS 0.05%
  • Veröffentlicht 09.04.2026 10:09:23
  • Zuletzt bearbeitet 25.04.2026 18:02:06

Mattermost Plugins versions <=2.3.1 fail to limit the request body size on the {{/lifecycle}} webhook endpoint which allows an authenticated attacker to cause memory exhaustion and denial of service via sending an oversized JSON payload. Mattermost A...

8.8

CVE-2026-3524

  • EPSS 0.02%
  • Veröffentlicht 06.04.2026 12:06:22
  • Zuletzt bearbeitet 07.04.2026 13:20:35

Mattermost Plugin Legal Hold versions <=1.1.4 fail to halt request processing after a failed authorization check in ServeHTTP which allows an authenticated attacker to access, create, download, and delete legal hold data via crafted API requests to t...

4.9

CVE-2026-3112

  • EPSS 0.02%
  • Veröffentlicht 26.03.2026 16:29:54
  • Zuletzt bearbeitet 30.03.2026 19:42:39

Mattermost versions 11.4.x <= 11.4.0, 11.3.x <= 11.3.1, 11.2.x <= 11.2.3, 10.11.x <= 10.11.11 fail to validate Advanced Logging file target paths which allows system administrators to read arbitrary host files via malicious AdvancedLoggingJSON config...

2.2

CVE-2026-3109

  • EPSS 0.05%
  • Veröffentlicht 26.03.2026 16:28:07
  • Zuletzt bearbeitet 30.03.2026 13:26:50

Mattermost Plugins versions <=11.4 10.11.11.0 fail to validate webhook request timestamps which allows an attacker to corrupt Zoom meeting state in Mattermost via replayed webhook requests. Mattermost Advisory ID: MMSA-2026-00584