Mattermost, Inc.
First CVE: Dec 14, 2020Active for: 6 years
454
CVEs Published
More CVEs Published than 86% of tracked CNAs
64.9
Avg CVEs / Year
More Avg CVEs / Year than 86% of tracked CNAs
5.5
Avg CVSS Score
Higher Avg CVSS Score than 4% of tracked CNAs
0.0%
In CISA KEV
Bottom 1%
Self-Reporting Analysis
Of all the CVEs published by Mattermost, Inc. as a CNA, 98.7% affect products that Mattermost, Inc. develops as a vendor.
98.7%
Self-reported: 448Third-party: 6
Of all the CVEs published that affect products developed by Mattermost, Inc., 73.8% are self-published by Mattermost, Inc. as a CNA.
73.8%
26.2%
Self-published: 448Published by other CNAs: 159
Trends Over Time
The number and severity of CVEs published by Mattermost, Inc. over time
Volume of CVEsAvg CVSS Base Score
First CVE
Dec 14, 2020
5 years ago
Most Recent CVE
Jul 17, 2026
7 days ago
Top CVEs
All CVEs published by Mattermost, Inc. as a CNA, regardless of affected vendor or product.
454 CVEs · Highest risk first
| CVE | Published | CVSS | Risk | KEV | Exploit |
|---|---|---|---|---|---|
CVE-2026-4858CRITICAL Mattermost versions 11.6.x <= 11.6.0, 11.5.x <= 11.5.3, 11.4.x <= 11.4.4, 10.11.x <= 10.11.14 fail to check integration URL for path traversal which allows an malicious authenticat | May 21, 2026 | 9.9 | 40 | NO | NO |
CVE-2025-25279HIGH Mattermost versions 10.4.x <= 10.4.1, 9.11.x <= 9.11.7, 10.3.x <= 10.3.2, 10.2.x <= 10.2.2 fail to properly validate board blocks when importing boards which allows an attacker cou | Feb 24, 2025 | 7.5 | 36 | NO | NO |
CVE-2026-6346HIGH Mattermost versions 11.5.x <= 11.5.1, 10.11.x <= 10.11.13, 11.4.x <= 11.4.3 fail to sanitize sensitive configuration fields before including them in support packet generation, whic | May 18, 2026 | 8.7 | 34 | NO | NO |
CVE-2025-12419CRITICAL Mattermost versions 10.12.x <= 10.12.1, 10.11.x <= 10.11.4, 10.5.x <= 10.5.12, 11.0.x <= 11.0.3 fail to properly validate OAuth state tokens during OpenID Connect authentication wh | Nov 27, 2025 | 9.9 | 34 | NO | NO |
CVE-2026-6850MEDIUM Mattermost versions 11.7.x <= 11.7.2, 11.6.x <= 11.6.4, 10.11.x <= 10.11.19 fail to validate the length and content of message attachment field values, which allows an authenticate | Jul 13, 2026 | 6.5 | 33 | NO | NO |
CVE-2026-7387HIGH Mattermost versions 11.6.x <= 11.6.1, 11.5.x <= 11.5.4, 10.11.x <= 10.11.15, 10.11.x <= 10.11.16 Mattermost fails to require role-management authorization when setting the scheme_a | Jun 12, 2026 | 8.8 | 33 | NO | NO |
CVE-2025-12421CRITICAL Mattermost versions 11.0.x <= 11.0.2, 10.12.x <= 10.12.1, 10.11.x <= 10.11.4, 10.5.x <= 10.5.12 fail to to verify that the token used during the code exchange originates from the s | Nov 27, 2025 | 9.9 | 33 | NO | NO |
CVE-2026-10106MEDIUM Mattermost versions 11.7.x <= 11.7.2, 11.6.x <= 11.6.4, 10.11.x <= 10.11.19 fail to verify that the channel referenced in an action cookie matches the channel of the target post, w | Jul 13, 2026 | 6.5 | 31 | NO | NO |
CVE-2026-9571MEDIUM Mattermost versions 11.7.x <= 11.7.2, 11.6.x <= 11.6.4, 10.11.x <= 10.11.19 fail to invalidate OAuth refresh tokens upon user account deactivation, which allows a deactivated user | Jul 13, 2026 | 6.5 | 31 | NO | NO |
CVE-2026-6347HIGH Mattermost versions 11.5.x <= 11.5.1, 10.11.x <= 10.11.13, 11.4.x <= 11.4.3 fail to sanitize sensitive configuration fields in the Mattermost Calls plugin which allows an attacker | May 18, 2026 | 7.6 | 31 | NO | NO |
CVE Severity & Scoring
Severity distribution of CVEs published by this CNA454 CVEs
11%
74%
14%
Severity distribution among all CVEs352,231 CVEs
45%
40%
11%
LowMediumHighCritical
Attack Vector
Local11 (2.4%)
Network443 (97.6%)
Unknown0 (0.0%)
Physical0 (0.0%)
Adjacent Network0 (0.0%)
Attack Complexity
Low419 (92.3%)
High35 (7.7%)
Unknown0 (0.0%)
User Interaction
None395 (87.0%)
Unknown0 (0.0%)
Required59 (13.0%)
Privileges Required
Low290 (63.9%)
High56 (12.3%)
None108 (23.8%)
Unknown0 (0.0%)
Exploit Exposure
Signals from CVEs in this cna scope (454 CVEs).
CISA KEV
0 CVEs
0.0% of CVEs· Bottom 1%
Metasploit
0 CVEs
0.0% of CVEs· Bottom 1%
Nuclei
0 CVEs
0.0% of CVEs· Bottom 1%
ExploitDB
0 CVEs
0.0% of CVEs· Bottom 1%
Social Chatter
An overview of all social media posts that mention a CVE ID published by Mattermost, Inc. as a CNA.
Media Mentions
Media articles that mention a CVE ID published by Mattermost, Inc. as a CNA — matched by CVE ID, not by organization name.