How many CVEs does Mattermost have?

Mattermost has 609 published CVE records since 2020, including 241 in the last two years.

How many Mattermost CVEs are in CISA KEV?

None of Mattermost's CVEs are currently listed in CISA's Known Exploited Vulnerabilities catalog.

Which Mattermost products have the most CVEs?

The Mattermost products with the most published CVEs are mattermost_server, mattermost-server, Mattermost, github.com/mattermost/mattermost-server, github.com/mattermost/mattermost-server/v6.

What are the most common weakness types in Mattermost CVEs?

Mattermost's CVEs most often map to these CWE weakness types: CWE-863 (Incorrect Authorization), CWE-284 (Improper Access Control), CWE-862 (Missing Authorization), CWE-200 (Exposure of Sensitive Information to an Unauthorized Actor).

Are there public exploits for Mattermost vulnerabilities?

No Mattermost CVEs currently have a tracked public exploit in this dataset.

How many critical Mattermost vulnerabilities are there?

Mattermost has 25 critical and 126 high-severity CVEs.

What is the average severity of Mattermost CVEs?

The average CVSS base score across Mattermost's scored CVEs is 5.8.

RadicalNotion.AI

Log in Start free

Log in

Log in Start free

609 CVEs

Mattermost Vulnerabilities

Name: Mattermost vulnerability dataset (CVEs)
Creator: RadicalNotion.AI
License: https://creativecommons.org/licenses/by-nc/4.0/

CVE security advisories and vulnerability history for Mattermost.

609

Total CVEs

Published

0

In CISA KEV

Exploited in the wild

0

Public exploits

PoC or exploit code

5.8

Avg CVSS

2020–2026

Overview

Mattermost has 609 published CVE records since 2020, of which 0 are in CISA's Known Exploited Vulnerabilities catalog and 0 have a known public exploit. The average CVSS base score across scored CVEs is 5.8.

This page aggregates every publicly disclosed vulnerability (CVE) affecting Mattermost products, with severity breakdowns, the most-affected products, the most common weakness types, and the latest disclosures.

Security scorecard

A quick read on Mattermost's vulnerability posture, as a share of its 609 published CVEs.

Average CVSS: 5.8
Critical / high: 25%
Actively exploited (KEV): 0%
Public exploit available: 0%
Patch available: 100%

Severity and exploitation

How the CVSS severity of Mattermost's CVEs breaks down, plus how many are exploited in the wild or have public exploit code.

Critical25

High126

Medium409

Low49

In CISA’s Known Exploited Vulnerabilities catalog

0

None of Mattermost's CVEs are currently listed in CISA's KEV catalog.

Public exploits

0

No Mattermost CVEs currently have a tracked public exploit.

Most affected products

The Mattermost products with the most published CVEs. Follow any product to browse its versions and vulnerabilities.

Common weakness types

The CWE weakness categories most often found in Mattermost CVEs. Follow any weakness for its full explanation.

CNAs that assign these CVEs

The CVE Numbering Authorities that publish Mattermost CVE records.

Disclosure activity by year

How many Mattermost CVEs were published each year.

2020

159

2021

5

2022

25

2023

84

2024

95

2025

119

2026

122

Latest Mattermost CVEs

The most recently disclosed vulnerabilities affecting Mattermost.

Posting a malicious markdown image crashes the Mattermost Desktop App
CWE-754
Medium · CVSS 6.5
EPSS 0.2%2026-07-17
Mattermost Desktop App crashes when malformed arguments are provided to some exposed IPC methods
CWE-400
Medium · CVSS 5.7
EPSS 0.2%2026-07-17
Unscoped updates to other playbooks' metric configuration
CWE-639
Medium · CVSS 4.3
EPSS 0.2%2026-07-13
Mattermost schemes teams endpoint exposes private team invite IDs
CWE-862
Low · CVSS 3.8
EPSS 0.2%2026-07-13
Remote cluster metadata enumeration via /share-channel autocomplete
CWE-862
Medium · CVSS 4.3
EPSS 0.2%2026-07-13
Deactivated guest accounts can authenticate via magic-link token in Mattermost REST API login endpoint
CWE-305
Medium · CVSS 5.4
EPSS 0.1%2026-07-13
Crafted message attachment causes client-side denial of service via markdown parser regex backtracking in Mattermost
CWE-1333
Medium · CVSS 6.5
EPSS 0.2%2026-07-13
Unauthorized users can trigger interactive post actions in private channels via action cookie channel mismatch in Mattermost
CWE-863
Medium · CVSS 6.5
EPSS 0.2%2026-07-13
Ordinary group/direct message member can enable group_constrained and remove all channel participants
CWE-862
Medium · CVSS 5.4
EPSS 0.2%2026-07-13
Incoming webhook user attribution via unvalidated webhook owner
CWE-639
Medium · CVSS 4.9
EPSS 0.2%2026-07-13
Authenticated remote cluster can modify or delete posts it does not own in Mattermost Connected Workspaces shared channels
CWE-639
Medium · CVSS 4.3
EPSS 0.1%2026-07-13
Deactivated user accounts can continue to obtain valid OAuth access tokens via refresh token grant in Mattermost
CWE-305
Medium · CVSS 6.5
EPSS 0.2%2026-07-13

Track new Mattermost CVEs as they are disclosed and get AI-written analysis and remediation guidance.

Monitor Mattermost CVEs

Other vendors

Browse vulnerabilities for other tracked vendors.

Moodle633 CVEs campcodes631 CVEs McAfee607 CVEs arubanetworks607 CVEs FreeBSD603 CVEs Symantec598 CVEs itsourcecode589 CVEs openclaw588 CVEs

Browse all vendors

Frequently asked questions

Common questions about Mattermost vulnerabilities.

How many CVEs does Mattermost have?: Mattermost has 609 published CVE records since 2020, including 241 in the last two years.
How many Mattermost CVEs are in CISA KEV?: None of Mattermost's CVEs are currently listed in CISA's Known Exploited Vulnerabilities catalog.
Which Mattermost products have the most CVEs?: The Mattermost products with the most published CVEs are mattermost_server, mattermost-server, Mattermost, github.com/mattermost/mattermost-server, github.com/mattermost/mattermost-server/v6.
What are the most common weakness types in Mattermost CVEs?: Mattermost's CVEs most often map to these CWE weakness types: CWE-863 (Incorrect Authorization), CWE-284 (Improper Access Control), CWE-862 (Missing Authorization), CWE-200 (Exposure of Sensitive Information to an Unauthorized Actor).
Are there public exploits for Mattermost vulnerabilities?: No Mattermost CVEs currently have a tracked public exploit in this dataset.
How many critical Mattermost vulnerabilities are there?: Mattermost has 25 critical and 126 high-severity CVEs.
What is the average severity of Mattermost CVEs?: The average CVSS base score across Mattermost's scored CVEs is 5.8.

References

Vulnerability data is sourced from the CVE Program; severity, KEV, and exploit signals are aggregated by RadicalNotion.AI.

Track Mattermost vulnerabilities

Monitor new Mattermost vulnerabilities as they are disclosed, with AI-written analysis and remediation guidance.

Start free See pricing