mattermost server vulnerabilities and fixes

Recent CVEs affecting mattermost server, with upgrade or downgrade steps. 31 tracked.

Also searched as: mattermostserver.

mattermost server has 31 tracked vulnerabilities, 0 critical. A fixed release or vendor patch exists for 31. Most recent: 2026-09-22. Highest priority: CVE-2026-9816 (score 36/100).

• CVE-2026-86348 MEDIUM 4.3 UPGRADE Mattermost versions <=11.9 11.0.9 11.4.8 11.7.7 10.22.11.0 fail to recover from handler panics, which allows a
• CVE-2026-82920 MEDIUM 5.5 UPGRADE Mattermost versions 11.9.x <= 11.9.0, 11.8.x <= 11.8.4, 11.7.x <= 11.7.7 fail to enforce authorization boundar
• CVE-2026-86349 MEDIUM 4.3 UPGRADE Mattermost versions 11.9.x <= 11.9.0, 11.8.x <= 11.8.4, 11.7.x <= 11.7.8, 10.11.x <= 10.11.22 fail to limit th
• CVE-2026-12985 MEDIUM 6.8 UPGRADE Mattermost versions 11.9.x <= 11.9.0, 11.8.x <= 11.8.4, 11.7.x <= 11.7.7 Mattermost failed to validate Dynamic
• CVE-2026-91181 MEDIUM 6.5 UPGRADE Mattermost versions 11.9.x <= 11.9.0, 11.8.x <= 11.8.4, 11.7.x <= 11.7.7, 10.11.x <= 10.11.22 Fail to sanitize
• CVE-2026-95666 MEDIUM 4.3 UPGRADE Mattermost versions 11.9.x <= 11.9.1, 11.8.x <= 11.8.5, 11.7.x <= 11.7.10, 11.10.x <= 11.10.1 fail to limit th
• CVE-2026-96259 MEDIUM 5.5 UPGRADE Mattermost versions 11.9.x <= 11.9.1, 11.8.x <= 11.8.5, 11.7.x <= 11.7.10, 11.10.x <= 11.10.1 fail to apply th
• CVE-2026-96260 MEDIUM 6.5 UPGRADE Mattermost versions 11.9.x <= 11.9.1, 11.8.x <= 11.8.5, 11.7.x <= 11.7.10, 11.10.x <= 11.10.1 fail to enforce
• CVE-2026-10542 MEDIUM 5.0 UPGRADE Mattermost versions 11.9.x <= 11.9.0, 11.8.x <= 11.8.4, 11.7.x <= 11.7.7, 10.11.x <= 10.11.22 fail to validate
• CVE-2026-10556 MEDIUM 5.3 UPGRADE Mattermost versions 11.9.x <= 11.9.0, 11.8.x <= 11.8.4, 11.7.x <= 11.7.7, 10.11.x <= 10.11.22 fail to validate
• CVE-2026-11993 MEDIUM 4.3 UPGRADE Mattermost versions 11.9.x <= 11.9.0, 11.8.x <= 11.8.4, 11.7.x <= 11.7.7, 10.11.x <= 10.11.22 fail to properly
• CVE-2026-12882 MEDIUM 4.3 UPGRADE Mattermost versions 11.9.x <= 11.9.0, 11.8.x <= 11.8.4, 11.7.x <= 11.7.7, 10.11.x <= 10.11.22 fail to parse Ma
• CVE-2026-13417 MEDIUM 4.3 UPGRADE Mattermost versions 11.9.x <= 11.9.0, 11.8.x <= 11.8.4, 11.7.x <= 11.7.7, 10.11.x <= 10.11.22 fail to validate
• CVE-2026-14259 MEDIUM 4.3 UPGRADE Mattermost versions 11.9.x <= 11.9.0, 11.8.x <= 11.8.4, 11.7.x <= 11.7.7, 10.11.x <= 10.11.22 fail to enforce
• CVE-2026-14344 MEDIUM 4.3 UPGRADE Mattermost versions 11.9.x <= 11.9.0, 11.8.x <= 11.8.4, 11.7.x <= 11.7.7, 10.11.x <= 10.11.22 fail to enforce
• CVE-2026-15814 MEDIUM 6.5 UPGRADE Mattermost versions 11.9.x <= 11.9.0, 11.8.x <= 11.8.4, 11.7.x <= 11.7.7, 10.11.x <= 10.11.22 fail to limit th
• CVE-2026-5132 MEDIUM 6.5 UPGRADE Mattermost versions 11.9.x <= 11.9.0, 11.8.x <= 11.8.4, 11.7.x <= 11.7.7, 10.11.x <= 10.11.22 fail to limit si
• CVE-2026-8821 HIGH 7.1 UPGRADE Mattermost versions 11.9.x <= 11.9.0, 11.8.x <= 11.8.4, 11.7.x <= 11.7.7, 10.11.x <= 10.11.22 fail to validate
• CVE-2026-9812 MEDIUM 6.5 UPGRADE Mattermost versions 11.9.x <= 11.9.0, 11.8.x <= 11.8.4, 11.7.x <= 11.7.7, 10.11.x <= 10.11.22 fail to validate
• CVE-2026-14298 MEDIUM 6.5 UPGRADE Mattermost versions 11.9.x <= 11.9.0, 11.8.x <= 11.8.4, 11.7.x <= 11.7.7, 10.11.x <= 10.11.22 fail to limit de
• CVE-2026-9816 HIGH 8.3 UPGRADE Mattermost versions 11.7.x <= 11.7.6, 10.11.x <= 10.11.21, 11.8.x <= 11.8.3 fail to validate BoardMember.Schem
• CVE-2026-9859 MEDIUM 6.5 UPGRADE Mattermost versions 11.7.x <= 11.7.6, 10.11.x <= 10.11.21, 11.8.x <= 11.8.3 fail to enforce PermissionManageBo
• CVE-2026-9693 LOW 3.5 UPGRADE Mattermost versions 10.11.x <= 10.11.20, 11.7.x <= 11.7.5 Mattermost fails to remove thread membership records
• CVE-2026-16048 MEDIUM 6.3 UPGRADE Mattermost versions 11.8.x <= 11.8.2, 11.7.x <= 11.7.6, 10.11.x <= 10.11.21 fail to restrict channel member ro
• CVE-2026-16047 MEDIUM 4.3 UPGRADE Mattermost versions 11.7.x <= 11.7.6, 10.11.x <= 10.11.21, 11.8.x <= 11.8.3 fail to validate that users have r
• CVE-2026-16046 MEDIUM 4.3 UPGRADE Mattermost versions 11.7.x <= 11.7.6, 10.11.x <= 10.11.21 fail to enforce run-state validation on write operat
• CVE-2026-16045 MEDIUM 4.3 UPGRADE Mattermost versions 11.7.x <= 11.7.6, 10.11.x <= 10.11.21 Mattermost failed to restrict OAuth deauthorization
• CVE-2026-16044 MEDIUM 5.4 UPGRADE Mattermost versions 11.7.x <= 11.7.6, 10.11.x <= 10.11.21 fail to prevent guest users from receiving Board Adm
• CVE-2026-15754 MEDIUM 4.2 UPGRADE Mattermost versions 11.7.x <= 11.7.6, 11.8.x <= 11.8.3 The access control policy unassign endpoint fails to re
• CVE-2026-10527 MEDIUM 6.3 UPGRADE Mattermost versions 11.7.x <= 11.7.6, 10.11.x <= 10.11.21, 11.8.x <= 11.8.3 fails to reconcile SchemeAdmin fla
• CVE-2026-10080 MEDIUM 6.5 UPGRADE Mattermost versions 11.7.x <= 11.7.6, 10.11.x <= 10.11.21, 11.8.x <= 11.8.3 fails to validate WebSocket comman

FAQ

How do I fix mattermost server vulnerabilities?

Open the CVE for your version, check the affected range, then follow the listed action: upgrade to the fixed release, or downgrade or mitigate if no fix exists yet. Commands for each OS are shown on every CVE page.

Is mattermost server being exploited right now?

None of the tracked mattermost server CVEs are on the CISA Known Exploited Vulnerabilities list at the moment. This is checked every 20 minutes.

Which mattermost server CVE should I patch first?

CVE-2026-9816 currently ranks highest (36/100): Mattermost versions 11.7.x <= 11.7.6, 10.11.x <= 10.11.21, 11.8.x <= 11.8.3 fail to validate BoardMember.Schem.

RSS feed for mattermost server · ← Back to latest CVEs