Skip to content

Product

Mattermost github.com/mattermost/mattermost/server/v8 vulnerabilities

207 published CVES affecting Mattermost github.com/mattermost/mattermost/server/v8, from public sources (CVE.org, NVD, CISA KEV, FIRST EPSS, OSV).

Total
207
Critical
5
High
28
Medium
148
Low
26
Unscored
0
CISA KEV
0

Latest Mattermost github.com/mattermost/mattermost/server/v8 CVEs

Newest publication first · page 1 of 9

  6. CVE-2026-7184 Mattermost Remote Cluster PATCH API Leaks Authentication Tokens

    Published
    MediumCVSS 6.5 EPSS 0.26%

    Mattermost versions 11.6.x <= 11.6.1, 11.5.x <= 11.5.4, 10.11.x <= 10.11.15 fail to sanitize the Remote Cluster API response on PATCH operations, which allows authenticated users with the {{manage_secure_connections}} permission to obtain remote cluster authentication tokens via...

  9. CVE-2026-4915 Server panic via outgoing webhook responses

    Published
    MediumCVSS 6.5 EPSS 0.28%

    Mattermost versions 11.6.x <= 11.6.0, 11.5.x <= 11.5.3, 11.4.x <= 11.4.4, 10.11.x <= 10.11.14 fail to filter nil elements from outgoing webhook attachment payloads before processing, which allows an authenticated user to cause a denial of service (server process termination) via...

  12. CVE-2026-6333 SSRF via Host Header Spoofing in Custom Slash Commands

    Published
    MediumCVSS 5.0 EPSS 0.14%

    Mattermost versions 11.5.x <= 11.5.1, 10.11.x <= 10.11.13 fail to validate the Host header when constructing response URLs for custom slash commands which allows an authenticated attacker to redirect slash command responses to an attacker-controlled server via a spoofed Host head...

  15. CVE-2026-28732 Slash command trigger-word update allowed command hijacking

    Published
    MediumCVSS 4.3 EPSS 0.15%

    Mattermost versions 11.5.x <= 11.5.1, 10.11.x <= 10.11.13, 11.4.x <= 11.4.3 Fail to enforce slash command trigger-word uniqueness during command updates which allows an authenticated team member with Manage Own Slash Commands permission to hijack and impersonate existing system o...

  19. CVE-2026-6339 Missing request origin validation on burn-on-read reveal endpoint

    Published
    MediumCVSS 4.3 EPSS 0.11%

    Mattermost versions 11.5.x <= 11.5.1, 11.4.x <= 11.4.3 fail to validate the X-Requested-With header on the burn-on-read reveal endpoint which allows an authenticated channel member to force the reveal of a burn-on-read message without recipient consent via a crafted Markdown imag...

  20. CVE-2026-6340 Memory Exhaustion via Malicious 7zip File Upload

    Published
    MediumCVSS 6.5 EPSS 0.24%

    Mattermost versions 11.5.x <= 11.5.1, 10.11.x <= 10.11.13, 11.4.x <= 11.4.3 fail to validate 7zip archive structure before processing which allows an authenticated attacker to cause server memory exhaustion and denial of service via uploading a specially crafted 7zip file with ex...

  21. CVE-2026-3495 Unescaped variables during error page composition

    Published
    MediumCVSS 4.8 EPSS 0.14%

    Mattermost versions 11.5.x <= 11.5.1, 10.11.x <= 10.11.13 fail to escape some variables that could contain malicious content during error page composition which allows an attacker with access to edit some site configuration to execute some malicious code via injecting some JS as...

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.