Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1336 CNY

100%

Mattermost — Vulnerabilities & Security Advisories 435

All 435 CVE vulnerabilities found in Mattermost, with AI-generated Chinese analysis, references, and POCs.

This page is a vulnerability aggregation resource for Mattermost, focusing on Common Weakness Enumerations associated with the open-source team messaging platform. It collects a comprehensive range of security flaws, including authentication bypasses, injection vulnerabilities, and cross-site scripting issues, covering all recorded incidents from the product's inception through the current date. Visitors can utilize this resource to track vendor advisories as they are published, gain a deeper understanding of specific weakness classes and their implications for the software architecture, and examine the historical trend of security incidents affecting this particular product. The data is organized to facilitate security research, compliance auditing, and risk assessment for organizations deploying or evaluating Mattermost. By centralizing these records, the page aims to provide clarity on the security posture of the product over time, helping stakeholders identify recurring patterns in defect types and the effectiveness of mitigation strategies. The information presented here is derived from official vendor disclosures, third-party security reports, and publicly available vulnerability databases, ensuring a broad and accurate perspective on known security issues. This aggregation serves as a reference point for developers, security analysts, and system administrators who need to make informed decisions about patching, configuration hardening, and overall risk management for their Mattermost deployments.

Vendor: Mattermost

CVE ID Title CVSS Severity Published
CVE-2025-32093 Syatem admin profile modification by delegated granular administration role CWE-863 4.7 Medium 2025-04-14
CVE-2025-30516 Unauthorized Notification Exposure in Mobile App Under Specific Conditions CWE-613 2.0 Low 2025-04-14
CVE-2025-24866 Unauthorized Access to User Activity Logs API by delegated granular administration roles CWE-863 2.7 Low 2025-04-10
CVE-2025-1558 Denial of Service Via Malicious GIF CWE-1287 6.5 Medium 2025-03-24
CVE-2025-25068 Bypassing MFA Enforcement on Plugin Endpoints CWE-306 7.5 High 2025-03-21
CVE-2025-24920 Unauthorized Bookmark Creation and Modification in Archived Channels CWE-863 4.3 Medium 2025-03-21
CVE-2025-30179 MFA Enforcement Bypass in Search APIs CWE-863 4.3 Medium 2025-03-21
CVE-2025-25274 Unauthorized Command Execution in Archived Channels CWE-863 4.3 Medium 2025-03-21
CVE-2025-27933 Unauthorized Private-to-Public Channel Conversion CWE-863 5.4 Medium 2025-03-21
CVE-2025-27715 Auto-Enrollment of Team Admins into Private Channels without explicit consent CWE-863 3.3 Low 2025-03-21
CVE-2025-1472 Unauthorized View Access to Site Statistics and Team Statistics CWE-863 4.3 Medium 2025-03-19
CVE-2025-1398 macOS TCC Bypass via Code Injection CWE-426 3.3 Low 2025-03-17
CVE-2025-20051 Arbitrary file read via block duplication in Mattermost Boards CWE-22 9.9 Critical 2025-02-24
CVE-2025-24490 SQL Injection in Mattermost Boards via board category ID reordering CWE-89 9.6 Critical 2025-02-24
CVE-2025-25279 Arbitrary file read in Mattermost Boards via import & export board archive CWE-22 9.9 Critical 2025-02-24
CVE-2025-1412 Session Persistence After User-to-Bot Conversion CWE-384 3.1 Low 2025-02-24
CVE-2025-24526 Channel export permitted on archived channel when viewing archived channels is disabled CWE-863 4.3 Medium 2025-02-24
CVE-2025-0503 Leaked User IDs and Metadata of Deleted DMs CWE-754 3.1 Low 2025-02-14
CVE-2025-20630 Mobile crash via object that can't be cast to String in Attachment Field CWE-1287 6.5 Medium 2025-01-16
CVE-2025-20621 Webapp crash via object that can't be cast to String in Attachment Field CWE-1287 6.5 Medium 2025-01-16
CVE-2025-20072 Mobile crash via improper validation of proto style in attachments CWE-704 6.5 Medium 2025-01-16
CVE-2025-0476 Mobile crash via file with specially crafted filename CWE-1287 4.3 Medium 2025-01-15
CVE-2025-20088 Insufficient Input Validation on Post Props CWE-1287 6.5 Medium 2025-01-15
CVE-2025-20086 Insufficient Input Validation on Post Props CWE-1287 6.5 Medium 2025-01-15
CVE-2025-21083 Insufficient Input Validation on Post Props CWE-1287 6.5 Medium 2025-01-15
CVE-2025-20036 Insufficient Input Validation on Post Props CWE-1287 6.5 Medium 2025-01-15
CVE-2025-21088 WebApp crash via improper validation of proto style in attachments CWE-704 6.5 Medium 2025-01-15
CVE-2025-22445 Misleading UI for undefined admin console settings in Calls causes security confusion CWE-754 3.5 Low 2025-01-09
CVE-2025-20033 DoS via custom post type for sysconsole plugin readers CWE-1287 4.3 Medium 2025-01-09
CVE-2025-22449 Access control flaw for team admins allows unauthorized team additions CWE-863 3.8 Low 2025-01-09

All 435 known CVE vulnerabilities affecting Mattermost with full Chinese analysis, references, and POCs where available.