mattermost server vulnerabilities and fixes

Recent CVEs affecting mattermost server, with upgrade or downgrade steps. 44 tracked.

Also searched as: mattermostserver.

mattermost server has 44 tracked vulnerabilities, 0 critical. A fixed release or vendor patch exists for 44. Most recent: 2026-09-22. Highest priority: CVE-2026-9816 (score 36/100).

• CVE-2026-86348 MEDIUM 4.3 UPGRADE Mattermost versions <=11.9 11.0.9 11.4.8 11.7.7 10.22.11.0 fail to recover from handler panics, which allows a
• CVE-2026-82920 MEDIUM 5.5 UPGRADE Mattermost versions 11.9.x <= 11.9.0, 11.8.x <= 11.8.4, 11.7.x <= 11.7.7 fail to enforce authorization boundar
• CVE-2026-86349 MEDIUM 4.3 UPGRADE Mattermost versions 11.9.x <= 11.9.0, 11.8.x <= 11.8.4, 11.7.x <= 11.7.8, 10.11.x <= 10.11.22 fail to limit th
• CVE-2026-12985 MEDIUM 6.8 UPGRADE Mattermost versions 11.9.x <= 11.9.0, 11.8.x <= 11.8.4, 11.7.x <= 11.7.7 Mattermost failed to validate Dynamic
• CVE-2026-91181 MEDIUM 6.5 UPGRADE Mattermost versions 11.9.x <= 11.9.0, 11.8.x <= 11.8.4, 11.7.x <= 11.7.7, 10.11.x <= 10.11.22 Fail to sanitize
• CVE-2026-95666 MEDIUM 4.3 UPGRADE Mattermost versions 11.9.x <= 11.9.1, 11.8.x <= 11.8.5, 11.7.x <= 11.7.10, 11.10.x <= 11.10.1 fail to limit th
• CVE-2026-96259 MEDIUM 5.5 UPGRADE Mattermost versions 11.9.x <= 11.9.1, 11.8.x <= 11.8.5, 11.7.x <= 11.7.10, 11.10.x <= 11.10.1 fail to apply th
• CVE-2026-96260 MEDIUM 6.5 UPGRADE Mattermost versions 11.9.x <= 11.9.1, 11.8.x <= 11.8.5, 11.7.x <= 11.7.10, 11.10.x <= 11.10.1 fail to enforce
• CVE-2026-10542 MEDIUM 5.0 UPGRADE Mattermost versions 11.9.x <= 11.9.0, 11.8.x <= 11.8.4, 11.7.x <= 11.7.7, 10.11.x <= 10.11.22 fail to validate
• CVE-2026-10556 MEDIUM 5.3 UPGRADE Mattermost versions 11.9.x <= 11.9.0, 11.8.x <= 11.8.4, 11.7.x <= 11.7.7, 10.11.x <= 10.11.22 fail to validate
• CVE-2026-11993 MEDIUM 4.3 UPGRADE Mattermost versions 11.9.x <= 11.9.0, 11.8.x <= 11.8.4, 11.7.x <= 11.7.7, 10.11.x <= 10.11.22 fail to properly
• CVE-2026-12882 MEDIUM 4.3 UPGRADE Mattermost versions 11.9.x <= 11.9.0, 11.8.x <= 11.8.4, 11.7.x <= 11.7.7, 10.11.x <= 10.11.22 fail to parse Ma
• CVE-2026-13417 MEDIUM 4.3 UPGRADE Mattermost versions 11.9.x <= 11.9.0, 11.8.x <= 11.8.4, 11.7.x <= 11.7.7, 10.11.x <= 10.11.22 fail to validate
• CVE-2026-14259 MEDIUM 4.3 UPGRADE Mattermost versions 11.9.x <= 11.9.0, 11.8.x <= 11.8.4, 11.7.x <= 11.7.7, 10.11.x <= 10.11.22 fail to enforce
• CVE-2026-14344 MEDIUM 4.3 UPGRADE Mattermost versions 11.9.x <= 11.9.0, 11.8.x <= 11.8.4, 11.7.x <= 11.7.7, 10.11.x <= 10.11.22 fail to enforce
• CVE-2026-15814 MEDIUM 6.5 UPGRADE Mattermost versions 11.9.x <= 11.9.0, 11.8.x <= 11.8.4, 11.7.x <= 11.7.7, 10.11.x <= 10.11.22 fail to limit th
• CVE-2026-5132 MEDIUM 6.5 UPGRADE Mattermost versions 11.9.x <= 11.9.0, 11.8.x <= 11.8.4, 11.7.x <= 11.7.7, 10.11.x <= 10.11.22 fail to limit si
• CVE-2026-8821 HIGH 7.1 UPGRADE Mattermost versions 11.9.x <= 11.9.0, 11.8.x <= 11.8.4, 11.7.x <= 11.7.7, 10.11.x <= 10.11.22 fail to validate
• CVE-2026-9812 MEDIUM 6.5 UPGRADE Mattermost versions 11.9.x <= 11.9.0, 11.8.x <= 11.8.4, 11.7.x <= 11.7.7, 10.11.x <= 10.11.22 fail to validate
• CVE-2026-14298 MEDIUM 6.5 UPGRADE Mattermost versions 11.9.x <= 11.9.0, 11.8.x <= 11.8.4, 11.7.x <= 11.7.7, 10.11.x <= 10.11.22 fail to limit de
• CVE-2026-9816 HIGH 8.3 UPGRADE Mattermost versions 11.7.x <= 11.7.6, 10.11.x <= 10.11.21, 11.8.x <= 11.8.3 fail to validate BoardMember.Schem
• CVE-2026-9859 MEDIUM 6.5 UPGRADE Mattermost versions 11.7.x <= 11.7.6, 10.11.x <= 10.11.21, 11.8.x <= 11.8.3 fail to enforce PermissionManageBo
• CVE-2026-9693 LOW 3.5 UPGRADE Mattermost versions 10.11.x <= 10.11.20, 11.7.x <= 11.7.5 Mattermost fails to remove thread membership records
• CVE-2026-16048 MEDIUM 6.3 UPGRADE Mattermost versions 11.8.x <= 11.8.2, 11.7.x <= 11.7.6, 10.11.x <= 10.11.21 fail to restrict channel member ro
• CVE-2026-16047 MEDIUM 4.3 UPGRADE Mattermost versions 11.7.x <= 11.7.6, 10.11.x <= 10.11.21, 11.8.x <= 11.8.3 fail to validate that users have r
• CVE-2026-16046 MEDIUM 4.3 UPGRADE Mattermost versions 11.7.x <= 11.7.6, 10.11.x <= 10.11.21 fail to enforce run-state validation on write operat
• CVE-2026-16045 MEDIUM 4.3 UPGRADE Mattermost versions 11.7.x <= 11.7.6, 10.11.x <= 10.11.21 Mattermost failed to restrict OAuth deauthorization
• CVE-2026-16044 MEDIUM 5.4 UPGRADE Mattermost versions 11.7.x <= 11.7.6, 10.11.x <= 10.11.21 fail to prevent guest users from receiving Board Adm
• CVE-2026-15754 MEDIUM 4.2 UPGRADE Mattermost versions 11.7.x <= 11.7.6, 11.8.x <= 11.8.3 The access control policy unassign endpoint fails to re
• CVE-2026-10527 MEDIUM 6.3 UPGRADE Mattermost versions 11.7.x <= 11.7.6, 10.11.x <= 10.11.21, 11.8.x <= 11.8.3 fails to reconcile SchemeAdmin fla
• CVE-2026-10080 MEDIUM 6.5 UPGRADE Mattermost versions 11.7.x <= 11.7.6, 10.11.x <= 10.11.21, 11.8.x <= 11.8.3 fails to validate WebSocket comman
• CVE-2026-10600 MEDIUM 4.3 UPGRADE Mattermost versions 11.8.x <= 11.8.0, 11.7.x <= 11.7.3, 11.6.x <= 11.6.5, 10.11.x <= 10.11.20 fail to bound th
• CVE-2026-10819 MEDIUM 6.5 UPGRADE Mattermost versions 11.6.x <= 11.6.5, 10.11.x <= 10.11.20, 11.8.x <= 11.8.1, 11.7.x <= 11.7.4 fail to limit th
• CVE-2026-7521 MEDIUM 5.5 UPGRADE Mattermost versions 11.8.x <= 11.8.0, 11.7.x <= 11.7.3, 11.6.x <= 11.6.5, 10.11.x <= 10.11.20 fail to verify f
• CVE-2026-9571 MEDIUM 5.9 UPGRADE Mattermost versions 11.7.x <= 11.7.2, 11.6.x <= 11.6.4, 10.11.x <= 10.11.19 fail to invalidate OAuth refresh t
• CVE-2026-10103 MEDIUM 4.3 UPGRADE Mattermost versions 11.7.x <= 11.7.2, 11.6.x <= 11.6.4, 10.11.x <= 10.11.19 fail to verify post ownership in t
• CVE-2026-10085 MEDIUM 5.4 UPGRADE Mattermost versions 11.7.x <= 11.7.2, 11.6.x <= 11.6.4, 10.11.x <= 10.11.19 fail to restrict the group_constra
• CVE-2026-10106 MEDIUM 6.5 UPGRADE Mattermost versions 11.7.x <= 11.7.2, 11.6.x <= 11.6.4, 10.11.x <= 10.11.19 fail to verify that the channel re
• CVE-2026-6850 MEDIUM 6.5 UPGRADE Mattermost versions 11.7.x <= 11.7.2, 11.6.x <= 11.6.4, 10.11.x <= 10.11.19 fail to validate the length and co
• CVE-2026-9597 MEDIUM 5.4 UPGRADE Mattermost versions 11.7.x <= 11.7.2, 11.6.x <= 11.6.4 fail to verify whether a guest account is deactivated b
• CVE-2026-9708 MEDIUM 4.9 UPGRADE Mattermost versions 11.7.x <= 11.7.2, 11.6.x <= 11.6.4, 10.11.x <= 10.11.19 fail to validate that an assigned
• CVE-2026-6541 MEDIUM 4.3 UPGRADE Mattermost versions 11.7.x <= 11.7.1, 11.6.x <= 11.6.4, 10.11.x <= 10.11.19 fail to restrict metric configurat
• CVE-2026-9820 LOW 3.8 UPGRADE Mattermost versions 11.7.x <= 11.7.2, 10.11.x <= 10.11.19 fail to sanitize team objects returned by the scheme
• CVE-2026-9824 MEDIUM 4.3 UPGRADE Mattermost versions 11.7.x <= 11.7.2, 11.6.x <= 11.6.4, 10.11.x <= 10.11.19 fail to check the manage_shared_ch

FAQ

How do I fix mattermost server vulnerabilities?

Open the CVE for your version, check the affected range, then follow the listed action: upgrade to the fixed release, or downgrade or mitigate if no fix exists yet. Commands for each OS are shown on every CVE page.

Is mattermost server being exploited right now?

None of the tracked mattermost server CVEs are on the CISA Known Exploited Vulnerabilities list at the moment. This is checked every 20 minutes.

Which mattermost server CVE should I patch first?

CVE-2026-9816 currently ranks highest (36/100): Mattermost versions 11.7.x <= 11.7.6, 10.11.x <= 10.11.21, 11.8.x <= 11.8.3 fail to validate BoardMember.Schem.

RSS feed for mattermost server · ← Back to latest CVEs