CVE Intelligence

Mattermost vulnerabilities

🔔 Create alert RSS

Published CVEs affecting Mattermost products: 207 record(s), with severity, exploitation and fixes.

Mattermost 202Mattermost Server 163Mattermost Desktop 16Zoom 2Focalboard 2Legal Hold 2Mattermost Mobile 2Ms Teams 1Google Drive 1Confluence 1Mattermost Google Drive Plugin 1Github.com/mattermost/mattermost/server/public 1Mattermost Confluence Plugin 1

Exploited only (KEV) →

CVE-2025-58075 High · 8.1 CWE-862 Oct 16, 2025
Arbitrary Mattermost Team can be joined by manipulating the SAML RelayState
Mattermost versions 10.11.x <= 10.11.1, 10.10.x <= 10.10.2, 10.5.x <= 10.5.10 fail to verify a user has permission to join a Mattermost team using the original invite token which allows any attacked to join any team on a Mattermost server regardless of restrictions via manipulating the RelayState
CVE-2025-58073 High · 8.1 CWE-862 Oct 16, 2025
Arbitrary Mattermost Team can be joined by manipulating the OAuth state
Mattermost versions 10.11.x <= 10.11.1, 10.10.x <= 10.10.2, 10.5.x <= 10.5.10 fail to verify a user has permission to join a Mattermost team using the original invite token which allows any attacked to join any team on a Mattermost server regardless of restrictions via manipulating the OAuth state.
CVE-2025-54499 Low · 3.7 CWE-208 Oct 16, 2025
Insecure string comparison enables timing attacks
Mattermost versions 10.5.x <= 10.5.10, 10.11.x <= 10.11.2 fail to use constant-time comparison for sensitive string comparisons which allows attackers to exploit timing oracles to perform byte-by-byte brute force attacks via response time analysis on Cloud API keys and OAuth client secrets
CVE-2025-41410 Medium · 5.4 CWE-862 Oct 16, 2025
Slack import bypasses email verification for team access controls
Mattermost versions 10.10.x <= 10.10.2, 10.5.x <= 10.5.10, 10.11.x <= 10.11.2 fail to validate email ownership during Slack import process which allows attackers to create verified user accounts with arbitrary email domains via malicious Slack import data to bypass email-based team access restrictions
CVE-2025-10545 Medium · 4.3 CWE-863 Oct 16, 2025
Guest user can add unauthorized team users to private channels
Mattermost versions 10.5.x <= 10.5.10, 10.11.x <= 10.11.2 fail to properly validate guest user permissions when adding channel members which allows guest users to add any team members to their private channels via the `/api/v4/channels/{channel_id}/members` endpoint
CVE-2025-41443 Medium · 4.3 CWE-862 Oct 16, 2025
Guest user can discover active public channels
Mattermost versions 10.5.x <= 10.5.12, 10.11.x <= 10.11.2 fail to properly validate guest user permissions when accessing channel information which allows guest users to discover active public channels and their metadata via the `/api/v4/teams/{team_id}/channels/ids` endpoint
CVE-2025-58084 Medium · 6.5 CWE-1287 Oct 13, 2025
Mattermost Desktop App crashes when clicking on malformed external URL
Mattermost Desktop App versions <= 5.13.0 fail to validate URLs external to the configured Mattermost servers, allowing an attacker on a server the user has configured to crash the user's application by sending the user a malformed URL.