https://patchthecve.com/CVEs with upgrade or downgrade fix stepshttps://patchthecve.com/cve/CVE-2026-96260.htmlhttps://patchthecve.com/cve/CVE-2026-96260.htmlWed, 07 Oct 2026 16:37:42 +0000MEDIUM 6.5: Mattermost versions 11.9.x <= 11.9.1, 11.8.x <= 11.8.5, 11.7.x <= 11.7.10, 11.10.x <= 11.10.1 fail to enforce a request body size limit during CSRF validation of plugin requests which allows an authenticated user to exhaust server memory and cause a denial of service via a large request body sent tohttps://patchthecve.com/cve/CVE-2026-96259.htmlhttps://patchthecve.com/cve/CVE-2026-96259.htmlWed, 07 Oct 2026 16:41:14 +0000MEDIUM 5.5: Mattermost versions 11.9.x <= 11.9.1, 11.8.x <= 11.8.5, 11.7.x <= 11.7.10, 11.10.x <= 11.10.1 fail to apply the internal-connection filter to OAuth endpoint requests, which allows a System Administrator to make the server issue requests to internal network addresses and read the responses via the cohttps://patchthecve.com/cve/CVE-2026-95666.htmlhttps://patchthecve.com/cve/CVE-2026-95666.htmlWed, 07 Oct 2026 16:48:51 +0000MEDIUM 4.3: Mattermost versions 11.9.x <= 11.9.1, 11.8.x <= 11.8.5, 11.7.x <= 11.7.10, 11.10.x <= 11.10.1 fail to limit the length of the post ID array accepted by the bulk reactions endpoint which allows an authenticated user to cause excessive database load via a crafted request to {{POST /api/v4/posts/ids/rehttps://patchthecve.com/cve/CVE-2026-91181.htmlhttps://patchthecve.com/cve/CVE-2026-91181.htmlWed, 07 Oct 2026 16:49:26 +0000MEDIUM 6.5: Mattermost versions 11.9.x <= 11.9.0, 11.8.x <= 11.8.4, 11.7.x <= 11.7.7, 10.11.x <= 10.11.22 Fail to sanitize Team objects returned by the data retention teams endpoint which allows an authenticated user holding only the read-only Data Retention Policy permission to obtain a private team's secret ihttps://patchthecve.com/cve/CVE-2026-12985.htmlhttps://patchthecve.com/cve/CVE-2026-12985.htmlWed, 07 Oct 2026 17:58:56 +0000MEDIUM 6.8: Mattermost versions 11.9.x <= 11.9.0, 11.8.x <= 11.8.4, 11.7.x <= 11.7.7 Mattermost failed to validate Dynamic Client Registration redirect URIs by URL component (matching glob patterns against the raw URI string instead) which allows a remote unauthenticated attacker to register an OAuth client withttps://patchthecve.com/cve/CVE-2026-86349.htmlhttps://patchthecve.com/cve/CVE-2026-86349.htmlWed, 07 Oct 2026 17:59:29 +0000MEDIUM 4.3: Mattermost versions 11.9.x <= 11.9.0, 11.8.x <= 11.8.4, 11.7.x <= 11.7.8, 10.11.x <= 10.11.22 fail to limit the nesting depth in the server-side Markdown parser which allows an authenticated attacker to cause a denial of service (CPU resource exhaustion) via a crafted post containing deeply nested bhttps://patchthecve.com/cve/CVE-2026-86348.htmlhttps://patchthecve.com/cve/CVE-2026-86348.htmlWed, 14 Oct 2026 19:28:53 +0000MEDIUM 4.3: Mattermost versions <=11.9 11.0.9 11.4.8 11.7.7 10.22.11.0 fail to recover from handler panics, which allows an authenticated user to crash the plugin via a post-action request with an unexpected field type.. Mattermost Advisory ID: MMSA-2026-00701https://patchthecve.com/cve/CVE-2026-82920.htmlhttps://patchthecve.com/cve/CVE-2026-82920.htmlWed, 07 Oct 2026 18:04:00 +0000MEDIUM 5.5: Mattermost versions 11.9.x <= 11.9.0, 11.8.x <= 11.8.4, 11.7.x <= 11.7.7 fail to enforce authorization boundaries on the access control policy update endpoint which allows a channel or team administrator to detach a system-assigned ABAC parent policy via a crafted PUT /api/v4/access_control_policieshttps://patchthecve.com/cve/CVE-2026-9812.htmlhttps://patchthecve.com/cve/CVE-2026-9812.htmlTue, 06 Oct 2026 17:55:57 +0000MEDIUM 6.5: Mattermost versions 11.9.x <= 11.9.0, 11.8.x <= 11.8.4, 11.7.x <= 11.7.7, 10.11.x <= 10.11.22 fail to validate that a property field belongs to the specified run before updating its value which allows an authenticated user with run property-management access to crash the Playbooks plugin via a REST https://patchthecve.com/cve/CVE-2026-8821.htmlhttps://patchthecve.com/cve/CVE-2026-8821.htmlWed, 07 Oct 2026 15:43:05 +0000HIGH 7.1: Mattermost versions 11.9.x <= 11.9.0, 11.8.x <= 11.8.4, 11.7.x <= 11.7.7, 10.11.x <= 10.11.22 fail to validate channel member-management permission during playbook run creation, allowing an authenticated channel member to add an arbitrary user to a restricted channel via the run owner field.. Matterhttps://patchthecve.com/cve/CVE-2026-5132.htmlhttps://patchthecve.com/cve/CVE-2026-5132.htmlWed, 07 Oct 2026 15:43:56 +0000MEDIUM 6.5: Mattermost versions 11.9.x <= 11.9.0, 11.8.x <= 11.8.4, 11.7.x <= 11.7.7, 10.11.x <= 10.11.22 fail to limit size of unpacked SDP messages compressed with zlib, which allows attacker to deny service or crash server via sending many SDP messages that unpack to large size.. Mattermost Advisory ID: MMSAhttps://patchthecve.com/cve/CVE-2026-15814.htmlhttps://patchthecve.com/cve/CVE-2026-15814.htmlWed, 07 Oct 2026 16:02:31 +0000MEDIUM 6.5: Mattermost versions 11.9.x <= 11.9.0, 11.8.x <= 11.8.4, 11.7.x <= 11.7.7, 10.11.x <= 10.11.22 fail to limit the amount of memory allocated when decoding uploaded image files which allows an authenticated user to cause excessive server memory consumption and potential denial of service via uploading https://patchthecve.com/cve/CVE-2026-14344.htmlhttps://patchthecve.com/cve/CVE-2026-14344.htmlWed, 07 Oct 2026 16:07:36 +0000MEDIUM 4.3: Mattermost versions 11.9.x <= 11.9.0, 11.8.x <= 11.8.4, 11.7.x <= 11.7.7, 10.11.x <= 10.11.22 fail to enforce the board-creation permission which allows an unauthorized authenticated user to create boards via the board duplicate, boards-and-blocks, and archive-import endpoints.. Mattermost Advisory https://patchthecve.com/cve/CVE-2026-14259.htmlhttps://patchthecve.com/cve/CVE-2026-14259.htmlWed, 07 Oct 2026 16:08:13 +0000MEDIUM 4.3: Mattermost versions 11.9.x <= 11.9.0, 11.8.x <= 11.8.4, 11.7.x <= 11.7.7, 10.11.x <= 10.11.22 fail to enforce board creation permissions when importing archive files which allows an authenticated non-guest team member to create Open or Private boards despite administrator restrictions via importing https://patchthecve.com/cve/CVE-2026-13417.htmlhttps://patchthecve.com/cve/CVE-2026-13417.htmlWed, 07 Oct 2026 16:17:21 +0000MEDIUM 4.3: Mattermost versions 11.9.x <= 11.9.0, 11.8.x <= 11.8.4, 11.7.x <= 11.7.7, 10.11.x <= 10.11.22 fail to validate the type of `fields.properties` on block creation which allows an authenticated user with editor access to a board to crash the Boards plugin worker and trigger a denial of service via a chhttps://patchthecve.com/cve/CVE-2026-12882.htmlhttps://patchthecve.com/cve/CVE-2026-12882.htmlWed, 07 Oct 2026 16:23:29 +0000MEDIUM 4.3: Mattermost versions 11.9.x <= 11.9.0, 11.8.x <= 11.8.4, 11.7.x <= 11.7.7, 10.11.x <= 10.11.22 fail to parse Markdown autolinks with unmatched trailing closing parentheses in linear time, which allows an authenticated user with permission to create posts to cause excessive server CPU consumption and https://patchthecve.com/cve/CVE-2026-11993.htmlhttps://patchthecve.com/cve/CVE-2026-11993.htmlWed, 07 Oct 2026 16:23:58 +0000MEDIUM 4.3: Mattermost versions 11.9.x <= 11.9.0, 11.8.x <= 11.8.4, 11.7.x <= 11.7.7, 10.11.x <= 10.11.22 fail to properly enforce the limit of concurrent files being processed and handled failed files, which allows a user with permission to upload files to spawn more goroutines than intended and block the indehttps://patchthecve.com/cve/CVE-2026-10556.htmlhttps://patchthecve.com/cve/CVE-2026-10556.htmlWed, 07 Oct 2026 16:25:31 +0000MEDIUM 5.3: Mattermost versions 11.9.x <= 11.9.0, 11.8.x <= 11.8.4, 11.7.x <= 11.7.7, 10.11.x <= 10.11.22 fail to validate null entries in Microsoft Graph webhook notification payloads, which allows an unauthenticated attacker to crash the Microsoft Calendar plugin process and deny calendar integration service https://patchthecve.com/cve/CVE-2026-10542.htmlhttps://patchthecve.com/cve/CVE-2026-10542.htmlWed, 07 Oct 2026 16:32:30 +0000MEDIUM 5.0: Mattermost versions 11.9.x <= 11.9.0, 11.8.x <= 11.8.4, 11.7.x <= 11.7.7, 10.11.x <= 10.11.22 fail to validate channel action ownership which allows channel managers to update actions in other channels via the channel action update endpoint.. Mattermost Advisory ID: MMSA-2026-00692https://patchthecve.com/cve/CVE-2026-9693.htmlhttps://patchthecve.com/cve/CVE-2026-9693.htmlWed, 19 Aug 2026 13:14:34 +0000LOW 3.5: Mattermost versions 10.11.x <= 10.11.20, 11.7.x <= 11.7.5 Mattermost fails to remove thread membership records when a user is removed from or leaves a team, which allows a previously removed user who is later re-invited to the team to view private channel thread root post content and metadata via thhttps://patchthecve.com/cve/CVE-2026-9859.htmlhttps://patchthecve.com/cve/CVE-2026-9859.htmlWed, 19 Aug 2026 13:28:57 +0000MEDIUM 6.5: Mattermost versions 11.7.x <= 11.7.6, 10.11.x <= 10.11.21, 11.8.x <= 11.8.3 fail to enforce PermissionManageBoardRoles on the channelId field of the batch endpoint, which allows an authenticated board editor to relink any board they can edit to an arbitrary channel via a crafted PATCH request. Mattehttps://patchthecve.com/cve/CVE-2026-9816.htmlhttps://patchthecve.com/cve/CVE-2026-9816.htmlWed, 19 Aug 2026 13:29:28 +0000HIGH 8.3: Mattermost versions 11.7.x <= 11.7.6, 10.11.x <= 10.11.21, 11.8.x <= 11.8.3 fail to validate BoardMember.Scheme* fields server-side on insert and archive-import paths which allows a board editor or non-guest team member to grant board admin to arbitrary users via POST /api/v2/boards/{boardID}/memberhttps://patchthecve.com/cve/CVE-2026-10080.htmlhttps://patchthecve.com/cve/CVE-2026-10080.htmlTue, 18 Aug 2026 16:19:17 +0000MEDIUM 6.5: Mattermost versions 11.7.x <= 11.7.6, 10.11.x <= 10.11.21, 11.8.x <= 11.8.3 fails to validate WebSocket command field types which allows an authenticated user to crash the plugin process and deny service to all Boards users via a custom_focalboard_SUBSCRIBE_TEAM message with a non-string teamId.. Mahttps://patchthecve.com/cve/CVE-2026-16048.htmlhttps://patchthecve.com/cve/CVE-2026-16048.htmlTue, 18 Aug 2026 20:42:05 +0000MEDIUM 6.3: Mattermost versions 11.8.x <= 11.8.2, 11.7.x <= 11.7.6, 10.11.x <= 10.11.21 fail to restrict channel member role assignment to channel-scoped roles which allows a channel administrator to gain additional channel permissions via the channel member roles API.. Mattermost Advisory ID: MMSA-2026-00697https://patchthecve.com/cve/CVE-2026-16047.htmlhttps://patchthecve.com/cve/CVE-2026-16047.htmlTue, 18 Aug 2026 20:41:36 +0000MEDIUM 4.3: Mattermost versions 11.7.x <= 11.7.6, 10.11.x <= 10.11.21, 11.8.x <= 11.8.3 fail to validate that users have read access to a channel before linking a board to it, which allows an authenticated attacker to discover the membership of private channels on the same team via creating, patching, importinghttps://patchthecve.com/cve/CVE-2026-16046.htmlhttps://patchthecve.com/cve/CVE-2026-16046.htmlTue, 18 Aug 2026 20:34:52 +0000MEDIUM 4.3: Mattermost versions 11.7.x <= 11.7.6, 10.11.x <= 10.11.21 fail to enforce run-state validation on write operations for finished playbook runs which allows a run participant to modify status, checklists, retrospective content, ownership, and participants on completed runs via REST and GraphQL API reqhttps://patchthecve.com/cve/CVE-2026-16045.htmlhttps://patchthecve.com/cve/CVE-2026-16045.htmlTue, 18 Aug 2026 20:32:18 +0000MEDIUM 4.3: Mattermost versions 11.7.x <= 11.7.6, 10.11.x <= 10.11.21 Mattermost failed to restrict OAuth deauthorization and personal access token management endpoints to direct user sessions, which allowed an OAuth app with a delegated user token to revoke the user's authorizations or tokens for other integrahttps://patchthecve.com/cve/CVE-2026-16044.htmlhttps://patchthecve.com/cve/CVE-2026-16044.htmlTue, 18 Aug 2026 20:27:55 +0000MEDIUM 5.4: Mattermost versions 11.7.x <= 11.7.6, 10.11.x <= 10.11.21 fail to prevent guest users from receiving Board Admin privileges during board archive import which allows a board member to escalate a guest user to Board Admin via importing a crafted .boardarchive file. Mattermost Advisory ID: MMSA-2026-00https://patchthecve.com/cve/CVE-2026-15754.htmlhttps://patchthecve.com/cve/CVE-2026-15754.htmlTue, 18 Aug 2026 20:24:58 +0000MEDIUM 4.2: Mattermost versions 11.7.x <= 11.7.6, 11.8.x <= 11.8.3 The access control policy unassign endpoint fails to re-validate that each target channel still belongs to the requesting admin's team, which allows an authenticated team administrator to remove ABAC (attribute-based access control) policy assighttps://patchthecve.com/cve/CVE-2026-10527.htmlhttps://patchthecve.com/cve/CVE-2026-10527.htmlTue, 18 Aug 2026 20:21:57 +0000MEDIUM 6.3: Mattermost versions 11.7.x <= 11.7.6, 10.11.x <= 10.11.21, 11.8.x <= 11.8.3 fails to reconcile SchemeAdmin flags with a user's current role which allows a user demoted to System Guest to retain Board Admin privileges and perform admin-only operations via the Boards REST API or UI.. Mattermost Advisohttps://patchthecve.com/cve/CVE-2026-14298.htmlhttps://patchthecve.com/cve/CVE-2026-14298.htmlMon, 14 Sep 2026 11:17:03 +0000MEDIUM 6.5: Mattermost versions 11.9.x <= 11.9.0, 11.8.x <= 11.8.4, 11.7.x <= 11.7.7, 10.11.x <= 10.11.22 fail to limit decompressed content size and enforce the configured maximum file size in the Boards archive import handler, which allows an authenticated user to cause memory exhaustion or unbounded disk conhttps://patchthecve.com/cve/CVE-2026-7521.htmlhttps://patchthecve.com/cve/CVE-2026-7521.htmlWed, 29 Jul 2026 15:06:39 +0000MEDIUM 5.5: Mattermost versions 11.8.x <= 11.8.0, 11.7.x <= 11.7.3, 11.6.x <= 11.6.5, 10.11.x <= 10.11.20 fail to verify file deletion path which allows an admin with SAML system-console write permissions to delete arbitrary files outside the config directory from the server via the remove file endpoint.. Mattehttps://patchthecve.com/cve/CVE-2026-10819.htmlhttps://patchthecve.com/cve/CVE-2026-10819.htmlMon, 03 Aug 2026 15:23:50 +0000MEDIUM 6.5: Mattermost versions 11.6.x <= 11.6.5, 10.11.x <= 10.11.20, 11.8.x <= 11.8.1, 11.7.x <= 11.7.4 fail to limit the number of frames and enforce the file size cap on animated GIF uploads, which allows an authenticated attacker to cause a denial of service via a crafted animated GIF uploaded as a custom https://patchthecve.com/cve/CVE-2026-10600.htmlhttps://patchthecve.com/cve/CVE-2026-10600.htmlMon, 03 Aug 2026 15:24:46 +0000MEDIUM 4.3: Mattermost versions 11.8.x <= 11.8.0, 11.7.x <= 11.7.3, 11.6.x <= 11.6.5, 10.11.x <= 10.11.20 fail to bound the time and resource consumption of server-side document content extraction which allows an authenticated user with file-upload permission to degrade file uploads for all users on the server https://patchthecve.com/cve/CVE-2026-9824.htmlhttps://patchthecve.com/cve/CVE-2026-9824.htmlMon, 13 Jul 2026 20:38:00 +0000MEDIUM 4.3: Mattermost versions 11.7.x <= 11.7.2, 11.6.x <= 11.6.4, 10.11.x <= 10.11.19 fail to check the manage_shared_channels permission in the /share-channel autocomplete handler, which allows an authenticated user without that permission to enumerate configured remote cluster connection metadata via slash https://patchthecve.com/cve/CVE-2026-9820.htmlhttps://patchthecve.com/cve/CVE-2026-9820.htmlMon, 13 Jul 2026 20:38:36 +0000LOW 3.8: Mattermost versions 11.7.x <= 11.7.2, 10.11.x <= 10.11.19 fail to sanitize team objects returned by the scheme teams endpoint, which allows a user with the User Manager role to obtain invite links for private teams and use them to join or share access to those teams via the scheme teams API endpointhttps://patchthecve.com/cve/CVE-2026-6541.htmlhttps://patchthecve.com/cve/CVE-2026-6541.htmlMon, 13 Jul 2026 20:39:12 +0000MEDIUM 4.3: Mattermost versions 11.7.x <= 11.7.1, 11.6.x <= 11.6.4, 10.11.x <= 10.11.19 fail to restrict metric configuration changes to the playbook being saved, which allows an authenticated user with team access to alter another user’s playbook metric settings via a crafted import or update request with a fohttps://patchthecve.com/cve/CVE-2026-9708.htmlhttps://patchthecve.com/cve/CVE-2026-9708.htmlMon, 13 Jul 2026 20:39:47 +0000MEDIUM 4.9: Mattermost versions 11.7.x <= 11.7.2, 11.6.x <= 11.6.4, 10.11.x <= 10.11.19 fail to validate that an assigned incoming webhook user has access to the target team or channel, which allows a requester with webhook management permissions to create posts or direct messages attributed to another user viahttps://patchthecve.com/cve/CVE-2026-9597.htmlhttps://patchthecve.com/cve/CVE-2026-9597.htmlMon, 13 Jul 2026 20:53:34 +0000MEDIUM 5.4: Mattermost versions 11.7.x <= 11.7.2, 11.6.x <= 11.6.4 fail to verify whether a guest account is deactivated before creating a session in the magic-link token login path, which allows a deactivated guest user to obtain a fully functional session via a magic-link token issued prior to deactivation.. https://patchthecve.com/cve/CVE-2026-9571.htmlhttps://patchthecve.com/cve/CVE-2026-9571.htmlWed, 15 Jul 2026 05:17:25 +0000MEDIUM 5.9: Mattermost versions 11.7.x <= 11.7.2, 11.6.x <= 11.6.4, 10.11.x <= 10.11.19 fail to invalidate OAuth refresh tokens upon user account deactivation, which allows a deactivated user or an attacker in possession of a valid refresh token to obtain new functional access tokens via the OAuth refresh tokenhttps://patchthecve.com/cve/CVE-2026-6850.htmlhttps://patchthecve.com/cve/CVE-2026-6850.htmlMon, 13 Jul 2026 21:42:01 +0000MEDIUM 6.5: Mattermost versions 11.7.x <= 11.7.2, 11.6.x <= 11.6.4, 10.11.x <= 10.11.19 fail to validate the length and content of message attachment field values, which allows an authenticated attacker to cause a denial of service for all users in a channel via a post containing a specially crafted payload thahttps://patchthecve.com/cve/CVE-2026-10106.htmlhttps://patchthecve.com/cve/CVE-2026-10106.htmlMon, 13 Jul 2026 21:42:24 +0000MEDIUM 6.5: Mattermost versions 11.7.x <= 11.7.2, 11.6.x <= 11.6.4, 10.11.x <= 10.11.19 fail to verify that the channel referenced in an action cookie matches the channel of the target post, which allows an authenticated user without access to a private channel to trigger interactive post actions on posts in thhttps://patchthecve.com/cve/CVE-2026-10103.htmlhttps://patchthecve.com/cve/CVE-2026-10103.htmlTue, 14 Jul 2026 15:16:54 +0000MEDIUM 4.3: Mattermost versions 11.7.x <= 11.7.2, 11.6.x <= 11.6.4, 10.11.x <= 10.11.19 fail to verify post ownership in the shared channel inbound sync handler, which allows an authenticated remote cluster to modify or delete posts authored by local users or other remotes via crafted sync messages referencing https://patchthecve.com/cve/CVE-2026-10085.htmlhttps://patchthecve.com/cve/CVE-2026-10085.htmlTue, 14 Jul 2026 13:19:08 +0000MEDIUM 5.4: Mattermost versions 11.7.x <= 11.7.2, 11.6.x <= 11.6.4, 10.11.x <= 10.11.19 fail to restrict the group_constrained channel flag to public and private channels that support group synchronization, which allows an ordinary group or direct message member to remove all participants from the conversation