Mattermost Mattermost Server vulnerabilities
501 published vulnerabilities in Mattermost Mattermost Server. The most were published in 2026 (147), and 147 so far in 2026.
Mattermost Mattermost Server vulnerabilities by year
2015
2016
2017
2018
2019
2020
2021
2022
2023
2024
2025
2026
Most exploited Mattermost Mattermost Server vulnerabilities
- CVE-2025-12419 Account takeover on OAuth/OpenID-enabled servers
- CVE-2025-12421 Account Takeover via Code Exchange Endpoint
- CVE-2025-4981 Path Traversal Leading to RCE by Any Authenticated Mattermost User
- CVE-2025-20051 Arbitrary file read via block duplication in Mattermost Boards
- CVE-2025-25279 Arbitrary file read in Mattermost Boards via import & export board archive
- CVE-2016-11074 Mattermost Server: Insufficient Password-Reset Link Invalidation
- CVE-2017-18885 Mattermost Server allows attackers to gain privileges by accessing unintended API endpoints with users' credentials
- CVE-2017-18888 Mattermost Server is vulnerable to SQL Injection when executing multiple POST requests
- CVE-2017-18900 Mattermost Server is vulnerable CSV Injection
- CVE-2017-18908 Mattermost Server password reset email requests can be sent to attacker-provided email addresses
- CVE-2017-18912 Mattermost Server allows an attacker to specify a full pathname of a log file
- CVE-2017-18915 Mattermost Server server restarts may provide attackers with API access
Find these in your own software.
Upload an SBOM and sbomify checks it against every vulnerability here, every day.