Mattermost, Inc. — recent CVEs https://vulnogram.org/ Most recent CVEs assigned by Mattermost, Inc. (mattermost). https://vulnogram.org/seaview/icons/mattermost.png Mattermost, Inc. — recent CVEs https://vulnogram.org/ Wed, 21 Oct 2026 07:00:06 GMT CVE-2026-18799 · 4.3 MEDIUM — Mattermost Server fails to restrict Slack import account binding, allowing team admins to forge posts as existing users https://vulnogram.org/CVE-2026-18799 https://vulnogram.org/CVE-2026-18799 Mattermost versions 11.10.x <= 11.10.0, 11.7.x <= 11.7.9, 11.9.x <= 11.9.1, 11.8.x <= 11.8.5 fail to restrict Slack import account binding to system administrator-initiated imports which allows an authenticated attacker with team admin privileges to… Medium Fri, 16 Oct 2026 07:16:19 GMT CVE-2026-16251 · 6.5 MEDIUM — Mattermost local image proxy allows server memory exhaustion via unbounded image response buffering https://vulnogram.org/CVE-2026-16251 https://vulnogram.org/CVE-2026-16251 Mattermost versions 11.10.x <= 11.10.0, 11.7.x <= 11.7.9, 11.9.x <= 11.9.1, 11.8.x <= 11.8.5 fail to limit the size of remote image responses buffered in memory during local image proxy direct fetches, which allows a remote attacker to cause memory e… Medium Fri, 16 Oct 2026 07:14:59 GMT CVE-2026-18256 · 4.3 MEDIUM — Private team metadata disclosure via the team search API https://vulnogram.org/CVE-2026-18256 https://vulnogram.org/CVE-2026-18256 Mattermost versions 11.10.x <= 11.10.0, 11.7.x <= 11.7.9, 11.9.x <= 11.9.1, 11.8.x <= 11.8.5 fail to properly restrict private teams from public team search results, which allows an authenticated user without permission to list private teams to discl… Medium Fri, 16 Oct 2026 07:13:43 GMT CVE-2026-18223 · 5 MEDIUM — Mattermost invitation tokens not bound to invited email address allowing unauthorized team and private channel access https://vulnogram.org/CVE-2026-18223 https://vulnogram.org/CVE-2026-18223 Mattermost versions 11.10.x <= 11.10.0, 11.7.x <= 11.7.9, 11.9.x <= 11.9.1, 11.8.x <= 11.8.5 fail to validate the invited recipient's email address when redeeming team and guest invitation tokens, which allows an authenticated attacker to join a team… Medium Fri, 16 Oct 2026 07:12:39 GMT CVE-2026-19076 · 4.4 MEDIUM — Mattermost fails to reject OAuth application sessions in account type switch, allowing account takeover via bearer token https://vulnogram.org/CVE-2026-19076 https://vulnogram.org/CVE-2026-19076 Mattermost versions 11.10.x <= 11.10.0, 11.7.x <= 11.7.9, 11.9.x <= 11.9.1, 11.8.x <= 11.8.5 fail to reject OAuth application sessions in the account type switch endpoint, which allows an attacker with a valid OAuth bearer token for a target user to… Medium Fri, 16 Oct 2026 07:11:29 GMT CVE-2026-18560 · 4.3 MEDIUM — Improper order of authorisations in Mattermost GetFile API leads to an authenticated user to determine a post’s quarantined status https://vulnogram.org/CVE-2026-18560 https://vulnogram.org/CVE-2026-18560 Mattermost versions 11.10.x <= 11.10.0, 11.7.x <= 11.7.9, 11.9.x <= 11.9.1, 11.8.x <= 11.8.5 fail to validate user’s permissions before other validations which allows non-content reviewers to infer a post’s flagged status via direct API call.. Matter… Medium Fri, 16 Oct 2026 07:10:12 GMT CVE-2026-16453 · 7.1 HIGH — Mattermost SAML RelayState forgery allows unauthorized team membership https://vulnogram.org/CVE-2026-16453 https://vulnogram.org/CVE-2026-16453 Mattermost versions 11.10.x <= 11.10.0, 11.7.x <= 11.7.9, 11.9.x <= 11.9.1, 11.8.x <= 11.8.5 fail to verify the integrity of the SAML RelayState POST parameter which allows an authenticated SAML user to join any team, including invite-only teams, via… High Fri, 16 Oct 2026 07:08:48 GMT CVE-2026-19600 · 4.5 MEDIUM — Mattermost logs plaintext authentication tokens in debug-level server logs on failed auth attempts https://vulnogram.org/CVE-2026-19600 https://vulnogram.org/CVE-2026-19600 Mattermost versions 11.9.x <= 11.9.1, 11.8.x <= 11.8.5, 11.7.x <= 11.7.10, 11.10.x <= 11.10.1 fail to sanitize authentication tokens before writing them to server log entries, which allows an attacker with access to server logs to obtain valid sessio… Medium Fri, 16 Oct 2026 07:07:17 GMT CVE-2026-19621 · 6.5 MEDIUM — Mattermost leaks interactive-message integration secrets to non-admin users via post-deletion events and thread reads https://vulnogram.org/CVE-2026-19621 https://vulnogram.org/CVE-2026-19621 Mattermost versions 11.10.x <= 11.10.0, 11.7.x <= 11.7.9, 11.9.x <= 11.9.1, 11.8.x <= 11.8.5 fail to strip action integration secrets from post payloads before broadcasting post-deletion web socket events and returning thread API responses, which all… Medium Fri, 16 Oct 2026 07:06:00 GMT CVE-2026-19603 · 4.3 MEDIUM — Private channel ID disclosure via user status endpoints https://vulnogram.org/CVE-2026-19603 https://vulnogram.org/CVE-2026-19603 Mattermost versions 11.9.x <= 11.9.1, 11.8.x <= 11.8.5, 11.7.x <= 11.7.10, 11.10.x <= 11.10.1 fail to sanitize the active channel field returned by the user status API endpoints, which allows an authenticated user to learn the channel ID of a private… Medium Fri, 16 Oct 2026 07:02:38 GMT CVE-2026-18795 · 6.4 MEDIUM — Missing server side validation allowed user to quarantine a DM and GM post https://vulnogram.org/CVE-2026-18795 https://vulnogram.org/CVE-2026-18795 Mattermost versions 11.10.x <= 11.10.0, 11.7.x <= 11.7.9, 11.9.x <= 11.9.1, 11.8.x <= 11.8.5 fail to enforce DM/GM check on server side which allows an authenticated user to quarantine a post belonging to DM or GM via direct API call.. Mattermost Adv… Medium Fri, 16 Oct 2026 07:01:22 GMT CVE-2026-19867 · 4.3 MEDIUM — Uncapped mention keys in user notification properties allow CPU exhaustion during post processing https://vulnogram.org/CVE-2026-19867 https://vulnogram.org/CVE-2026-19867 Mattermost versions 11.10.x <= 11.10.0, 11.9.x <= 11.9.1, 11.8.x <= 11.8.5, 11.7.x <= 11.7.10 fail to cap the number and size of mention keys stored in a user's notification properties, and to bound the quadratic multibyte-keyword matching performed… Medium Fri, 16 Oct 2026 07:00:12 GMT CVE-2026-19601 · 4.9 MEDIUM — Disclosure of AD/LDAP bind password via Test Connection https://vulnogram.org/CVE-2026-19601 https://vulnogram.org/CVE-2026-19601 Mattermost versions 11.9.x <= 11.9.1, 11.8.x <= 11.8.5, 11.7.x <= 11.7.10, 11.10.x <= 11.10.1 fail to invalidate the stored AD/LDAP bind password when other connection settings (such as the server address) are changed, which allows a System Console a… Medium Fri, 16 Oct 2026 06:58:33 GMT CVE-2026-18551 · 6.5 MEDIUM — Mattermost guest account privilege escalation via member roles API https://vulnogram.org/CVE-2026-18551 https://vulnogram.org/CVE-2026-18551 Mattermost versions 11.10.x <= 11.10.0, 11.7.x <= 11.7.9, 11.9.x <= 11.9.1, 11.8.x <= 11.8.5 fail to validate the combination of guest and admin scheme roles which allows an authenticated attacker to escalate a guest account to team or channel admin… Medium Fri, 16 Oct 2026 06:56:51 GMT CVE-2026-19541 · 6.5 MEDIUM — Outgoing OAuth connection client secret exposure during connection validation https://vulnogram.org/CVE-2026-19541 https://vulnogram.org/CVE-2026-19541 Mattermost versions 11.9.x <= 11.9.1, 11.8.x <= 11.8.5, 11.7.x <= 11.7.10, 11.10.x <= 11.10.1 fail to require re-entry of the stored client secret when validating an outgoing OAuth connection, which allows an authenticated user with permission to man… Medium Fri, 16 Oct 2026 06:54:57 GMT CVE-2026-96260 · 6.5 MEDIUM — Mattermost server missing request body size limit on plugin routes allows denial of service by an authenticated user https://vulnogram.org/CVE-2026-96260 https://vulnogram.org/CVE-2026-96260 Mattermost versions 11.9.x <= 11.9.1, 11.8.x <= 11.8.5, 11.7.x <= 11.7.10, 11.10.x <= 11.10.1 fail to enforce a request body size limit during CSRF validation of plugin requests which allows an authenticated user to exhaust server memory and cause a… Medium Tue, 22 Sep 2026 20:34:49 GMT CVE-2026-96259 · 5.5 MEDIUM — Mattermost server-side request forgery via OAuth endpoints configurable by a System Administrator https://vulnogram.org/CVE-2026-96259 https://vulnogram.org/CVE-2026-96259 Mattermost versions 11.9.x <= 11.9.1, 11.8.x <= 11.8.5, 11.7.x <= 11.7.10, 11.10.x <= 11.10.1 fail to apply the internal-connection filter to OAuth endpoint requests, which allows a System Administrator to make the server issue requests to internal n… Medium Tue, 22 Sep 2026 20:34:20 GMT CVE-2026-95666 · 4.3 MEDIUM — Unbounded post ID array in the bulk reactions endpoint allows denial of service https://vulnogram.org/CVE-2026-95666 https://vulnogram.org/CVE-2026-95666 Mattermost versions 11.9.x <= 11.9.1, 11.8.x <= 11.8.5, 11.7.x <= 11.7.10, 11.10.x <= 11.10.1 fail to limit the length of the post ID array accepted by the bulk reactions endpoint which allows an authenticated user to cause excessive database load vi… Medium Tue, 22 Sep 2026 13:11:13 GMT CVE-2026-12284 · 3.8 LOW 🌩️ — Mattermost Desktop App Missing IPC Sender Validation in Calls Leave Handler https://vulnogram.org/CVE-2026-12284 https://vulnogram.org/CVE-2026-12284 Mattermost Desktop App versions <=6.2 6.2.2.0 fails to validate the IPC sender in the leaveCall handler which allows a malicious or compromised Mattermost server (or a user with script access to a connected server view) to disconnect an active call b… Low Network Exploitable Thu, 17 Sep 2026 15:11:52 GMT CVE-2026-75588 · 2.6 LOW — Mattermost Desktop App plugin popout scheme validation bypass https://vulnogram.org/CVE-2026-75588 https://vulnogram.org/CVE-2026-75588 Mattermost Desktop App versions <=6.2 6.2.2.0 fail to validate the URL scheme when checking whether a target URL is internal to the connected server, which allows a network-positioned attacker to load a plugin popout window over an insecure connectio… Low Thu, 17 Sep 2026 15:09:40 GMT CVE-2026-75025 · 4.7 MEDIUM 🌩️ — Mattermost Desktop local network access from server-rendered content https://vulnogram.org/CVE-2026-75025 https://vulnogram.org/CVE-2026-75025 Mattermost Desktop App versions <=6.2 6.2.2.0 Fixed an issue where Mattermost Desktop did not sufficiently restrict server-rendered content from accessing local or private network resources. Thanks to game0v3r for contributing to this improvement und… Medium Network Exploitable Wed, 16 Sep 2026 18:27:02 GMT CVE-2026-91181 · 6.5 MEDIUM — Data Retention Teams Endpoint Leaks Private Team Invite ID https://vulnogram.org/CVE-2026-91181 https://vulnogram.org/CVE-2026-91181 Mattermost versions 11.9.x <= 11.9.0, 11.8.x <= 11.8.4, 11.7.x <= 11.7.7, 10.11.x <= 10.11.22 Fail to sanitize Team objects returned by the data retention teams endpoint which allows an authenticated user holding only the read-only Data Retention Pol… Medium Mon, 14 Sep 2026 21:21:47 GMT CVE-2026-12985 · 6.8 MEDIUM 🌩️ — Mattermost DCR redirect URI allowlist bypass via improper URL component validation https://vulnogram.org/CVE-2026-12985 https://vulnogram.org/CVE-2026-12985 Mattermost versions 11.9.x <= 11.9.0, 11.8.x <= 11.8.4, 11.7.x <= 11.7.7 Mattermost failed to validate Dynamic Client Registration redirect URIs by URL component (matching glob patterns against the raw URI string instead) which allows a remote unauth… Medium Network Exploitable Mon, 14 Sep 2026 14:09:53 GMT CVE-2026-82920 · 5.5 MEDIUM — Mattermost ABAC parent policy bypass via policy update endpoint https://vulnogram.org/CVE-2026-82920 https://vulnogram.org/CVE-2026-82920 Mattermost versions 11.9.x <= 11.9.0, 11.8.x <= 11.8.4, 11.7.x <= 11.7.7 fail to enforce authorization boundaries on the access control policy update endpoint which allows a channel or team administrator to detach a system-assigned ABAC parent policy… Medium Mon, 14 Sep 2026 13:59:01 GMT CVE-2026-86348 · 4.3 MEDIUM — MS Calendar plugin: unrecovered handler panics from malformed post-action requests could crash the plugin process https://vulnogram.org/CVE-2026-86348 https://vulnogram.org/CVE-2026-86348 Mattermost versions <=11.9 11.0.9 11.4.8 11.7.7 10.22.11.0 fail to recover from handler panics, which allows an authenticated user to crash the plugin via a post-action request with an unexpected field type.. Mattermost Advisory ID: MMSA-2026-00701 Medium Mon, 14 Sep 2026 13:52:24 GMT CVE-2026-86349 · 4.3 MEDIUM — Mattermost Server Algorithmic DoS via Unbounded Markdown Block Nesting https://vulnogram.org/CVE-2026-86349 https://vulnogram.org/CVE-2026-86349 Mattermost versions 11.9.x <= 11.9.0, 11.8.x <= 11.8.4, 11.7.x <= 11.7.8, 10.11.x <= 10.11.22 fail to limit the nesting depth in the server-side Markdown parser which allows an authenticated attacker to cause a denial of service (CPU resource exhaust… Medium Mon, 14 Sep 2026 13:51:30 GMT CVE-2026-10556 · 5.3 MEDIUM 🌩️ — Unauthenticated webhook request with null notification entry could crash the Microsoft Calendar plugin. https://vulnogram.org/CVE-2026-10556 https://vulnogram.org/CVE-2026-10556 Mattermost versions 11.9.x <= 11.9.0, 11.8.x <= 11.8.4, 11.7.x <= 11.7.7, 10.11.x <= 10.11.22 fail to validate null entries in Microsoft Graph webhook notification payloads, which allows an unauthenticated attacker to crash the Microsoft Calendar plu… Medium Network Exploitable Mon, 14 Sep 2026 10:46:01 GMT CVE-2026-13417 · 4.3 MEDIUM — Boards plugin denial of service via unvalidated block fields.properties https://vulnogram.org/CVE-2026-13417 https://vulnogram.org/CVE-2026-13417 Mattermost versions 11.9.x <= 11.9.0, 11.8.x <= 11.8.4, 11.7.x <= 11.7.7, 10.11.x <= 10.11.22 fail to validate the type of `fields.properties` on block creation which allows an authenticated user with editor access to a board to crash the Boards plug… Medium Mon, 14 Sep 2026 10:44:59 GMT CVE-2026-9812 · 6.5 MEDIUM — Missing property field ownership validation in Playbooks run property update endpoint https://vulnogram.org/CVE-2026-9812 https://vulnogram.org/CVE-2026-9812 Mattermost versions 11.9.x <= 11.9.0, 11.8.x <= 11.8.4, 11.7.x <= 11.7.7, 10.11.x <= 10.11.22 fail to validate that a property field belongs to the specified run before updating its value which allows an authenticated user with run property-managemen… Medium Mon, 14 Sep 2026 10:43:45 GMT CVE-2026-8821 · 7.1 HIGH — Playbooks run owner channel membership permission bypass https://vulnogram.org/CVE-2026-8821 https://vulnogram.org/CVE-2026-8821 Mattermost versions 11.9.x <= 11.9.0, 11.8.x <= 11.8.4, 11.7.x <= 11.7.7, 10.11.x <= 10.11.22 fail to validate channel member-management permission during playbook run creation, allowing an authenticated channel member to add an arbitrary user to a r… High Mon, 14 Sep 2026 10:42:42 GMT CVE-2026-5132 · 6.5 MEDIUM — Unbounded zlib decompression in Calls SDP WebSocket messages https://vulnogram.org/CVE-2026-5132 https://vulnogram.org/CVE-2026-5132 Mattermost versions 11.9.x <= 11.9.0, 11.8.x <= 11.8.4, 11.7.x <= 11.7.7, 10.11.x <= 10.11.22 fail to limit size of unpacked SDP messages compressed with zlib, which allows attacker to deny service or crash server via sending many SDP messages that u… Medium Mon, 14 Sep 2026 10:41:42 GMT CVE-2026-15814 · 6.5 MEDIUM — Uploading a crafted image causes excessive memory allocation in the Mattermost Server https://vulnogram.org/CVE-2026-15814 https://vulnogram.org/CVE-2026-15814 Mattermost versions 11.9.x <= 11.9.0, 11.8.x <= 11.8.4, 11.7.x <= 11.7.7, 10.11.x <= 10.11.22 fail to limit the amount of memory allocated when decoding uploaded image files which allows an authenticated user to cause excessive server memory consumpt… Medium Mon, 14 Sep 2026 10:39:45 GMT CVE-2026-10542 · 5 MEDIUM — Playbooks channel action update validation issue https://vulnogram.org/CVE-2026-10542 https://vulnogram.org/CVE-2026-10542 Mattermost versions 11.9.x <= 11.9.0, 11.8.x <= 11.8.4, 11.7.x <= 11.7.7, 10.11.x <= 10.11.22 fail to validate channel action ownership which allows channel managers to update actions in other channels via the channel action update endpoint.. Matterm… Medium Mon, 14 Sep 2026 10:37:32 GMT CVE-2026-14344 · 4.3 MEDIUM — Inconsistent authorization checks in Mattermost Boards endpoints https://vulnogram.org/CVE-2026-14344 https://vulnogram.org/CVE-2026-14344 Mattermost versions 11.9.x <= 11.9.0, 11.8.x <= 11.8.4, 11.7.x <= 11.7.7, 10.11.x <= 10.11.22 fail to enforce the board-creation permission which allows an unauthorized authenticated user to create boards via the board duplicate, boards-and-blocks, a… Medium Mon, 14 Sep 2026 10:33:54 GMT CVE-2026-12882 · 4.3 MEDIUM — Mattermost Markdown autolink parsing denial of service https://vulnogram.org/CVE-2026-12882 https://vulnogram.org/CVE-2026-12882 Mattermost versions 11.9.x <= 11.9.0, 11.8.x <= 11.8.4, 11.7.x <= 11.7.7, 10.11.x <= 10.11.22 fail to parse Markdown autolinks with unmatched trailing closing parentheses in linear time, which allows an authenticated user with permission to create po… Medium Mon, 14 Sep 2026 10:30:39 GMT CVE-2026-11993 · 4.3 MEDIUM — Fix authenticated members disabling file content indexing server-wide via extraction pool exhaustion https://vulnogram.org/CVE-2026-11993 https://vulnogram.org/CVE-2026-11993 Mattermost versions 11.9.x <= 11.9.0, 11.8.x <= 11.8.4, 11.7.x <= 11.7.7, 10.11.x <= 10.11.22 fail to properly enforce the limit of concurrent files being processed and handled failed files, which allows a user with permission to upload files to spaw… Medium Mon, 14 Sep 2026 10:29:19 GMT CVE-2026-14259 · 4.3 MEDIUM — Board archive import bypasses team board creation permissions https://vulnogram.org/CVE-2026-14259 https://vulnogram.org/CVE-2026-14259 Mattermost versions 11.9.x <= 11.9.0, 11.8.x <= 11.8.4, 11.7.x <= 11.7.7, 10.11.x <= 10.11.22 fail to enforce board creation permissions when importing archive files which allows an authenticated non-guest team member to create Open or Private boards… Medium Mon, 14 Sep 2026 10:26:41 GMT CVE-2026-75587 · 3.6 LOW — Plaintext pre-auth secret exposure via Desktop App diagnostics report https://vulnogram.org/CVE-2026-75587 https://vulnogram.org/CVE-2026-75587 Mattermost Desktop App versions <=6.2 6.2.2.0 fail to redact the pre-auth secret when generating a diagnostics report, which allows a local attacker with access to a user's diagnostics report or log files to obtain the plaintext pre-auth secret confi… Low Mon, 17 Aug 2026 22:09:49 GMT CVE-2026-9693 · 3.5 LOW — Mattermost thread memberships persist after team removal, exposing private channel thread metadata on re-invite https://vulnogram.org/CVE-2026-9693 https://vulnogram.org/CVE-2026-9693 Mattermost versions 10.11.x <= 10.11.20, 11.7.x <= 11.7.5 Mattermost fails to remove thread membership records when a user is removed from or leaves a team, which allows a previously removed user who is later re-invited to the team to view private ch… Low Mon, 17 Aug 2026 22:07:12 GMT CVE-2026-9859 · 6.5 MEDIUM — Mattermost Boards plugin didn’t enforce role-based authorization on board channel link allowing board editors to expose boards to arbitrary channels https://vulnogram.org/CVE-2026-9859 https://vulnogram.org/CVE-2026-9859 Mattermost versions 11.7.x <= 11.7.6, 10.11.x <= 10.11.21, 11.8.x <= 11.8.3 fail to enforce PermissionManageBoardRoles on the channelId field of the batch endpoint, which allows an authenticated board editor to relink any board they can edit to an ar… Medium Mon, 17 Aug 2026 22:06:26 GMT CVE-2026-9816 · 8.3 HIGH — Insufficient server-side validation of board member role fields permits privilege escalation https://vulnogram.org/CVE-2026-9816 https://vulnogram.org/CVE-2026-9816 Mattermost versions 11.7.x <= 11.7.6, 10.11.x <= 10.11.21, 11.8.x <= 11.8.3 fail to validate BoardMember.Scheme* fields server-side on insert and archive-import paths which allows a board editor or non-guest team member to grant board admin to arbitr… High Mon, 17 Aug 2026 22:05:24 GMT CVE-2026-10080 · 6.5 MEDIUM — Boards plugin panics on WebSocket command with non-string field types https://vulnogram.org/CVE-2026-10080 https://vulnogram.org/CVE-2026-10080 Mattermost versions 11.7.x <= 11.7.6, 10.11.x <= 10.11.21, 11.8.x <= 11.8.3 fails to validate WebSocket command field types which allows an authenticated user to crash the plugin process and deny service to all Boards users via a custom_focalboard_SU… Medium Mon, 17 Aug 2026 22:04:30 GMT CVE-2026-10527 · 6.3 MEDIUM — Boards plugin retains Board Admin rights for users demoted to System Guest https://vulnogram.org/CVE-2026-10527 https://vulnogram.org/CVE-2026-10527 Mattermost versions 11.7.x <= 11.7.6, 10.11.x <= 10.11.21, 11.8.x <= 11.8.3 fails to reconcile SchemeAdmin flags with a user's current role which allows a user demoted to System Guest to retain Board Admin privileges and perform admin-only operations… Medium Mon, 17 Aug 2026 14:37:46 GMT CVE-2026-15754 · 4.2 MEDIUM — Missing per-channel team-scope check in ABAC access control policy unassign allows cross-team policy removal https://vulnogram.org/CVE-2026-15754 https://vulnogram.org/CVE-2026-15754 Mattermost versions 11.7.x <= 11.7.6, 11.8.x <= 11.8.3 The access control policy unassign endpoint fails to re-validate that each target channel still belongs to the requesting admin's team, which allows an authenticated team administrator to remove… Medium Mon, 17 Aug 2026 14:36:56 GMT CVE-2026-16044 · 3.9 LOW — Insufficient validation of guest board admin privileges on archive import https://vulnogram.org/CVE-2026-16044 https://vulnogram.org/CVE-2026-16044 Mattermost versions 11.7.x <= 11.7.6, 10.11.x <= 10.11.21 fail to prevent guest users from receiving Board Admin privileges during board archive import which allows a board member to escalate a guest user to Board Admin via importing a crafted .board… Low Mon, 17 Aug 2026 14:26:52 GMT CVE-2026-16045 · 2.7 LOW — Delegated OAuth tokens could revoke unrelated OAuth application authorizations https://vulnogram.org/CVE-2026-16045 https://vulnogram.org/CVE-2026-16045 Mattermost versions 11.7.x <= 11.7.6, 10.11.x <= 10.11.21 Mattermost failed to restrict OAuth deauthorization and personal access token management endpoints to direct user sessions, which allowed an OAuth app with a delegated user token to revoke the… Low Mon, 17 Aug 2026 14:26:22 GMT CVE-2026-16049 · 3.9 LOW — _GitLab Plugin allows cross-channel post injection and phishing via missing channel permission checks in issue API endpoints_ https://vulnogram.org/CVE-2026-16049 https://vulnogram.org/CVE-2026-16049 Mattermost Plugins versions <=11.8 10.20.11 11.5.7.0 _The Mattermost GitLab plugin fails to verify channel permissions when processing API requests with a caller-supplied_ {{post_id}}_, and fails to validate the_ {{web_url}} _parameter against the co… Low Mon, 17 Aug 2026 14:25:45 GMT CVE-2026-16047 · 4.3 MEDIUM — Board channel linking without read channel permission validation https://vulnogram.org/CVE-2026-16047 https://vulnogram.org/CVE-2026-16047 Mattermost versions 11.7.x <= 11.7.6, 10.11.x <= 10.11.21, 11.8.x <= 11.8.3 fail to validate that users have read access to a channel before linking a board to it, which allows an authenticated attacker to discover the membership of private channels… Medium Mon, 17 Aug 2026 14:25:08 GMT CVE-2026-16046 · 3.5 LOW — Missing run-state validation on finished playbook runs https://vulnogram.org/CVE-2026-16046 https://vulnogram.org/CVE-2026-16046 Mattermost versions 11.7.x <= 11.7.6, 10.11.x <= 10.11.21 fail to enforce run-state validation on write operations for finished playbook runs which allows a run participant to modify status, checklists, retrospective content, ownership, and participa… Low Mon, 17 Aug 2026 14:24:14 GMT CVE-2026-16048 · 6.3 MEDIUM — Channel member roles accept out-of-scope roles https://vulnogram.org/CVE-2026-16048 https://vulnogram.org/CVE-2026-16048 Mattermost versions 11.8.x <= 11.8.2, 11.7.x <= 11.7.6, 10.11.x <= 10.11.21 fail to restrict channel member role assignment to channel-scoped roles which allows a channel administrator to gain additional channel permissions via the channel member rol… Medium Mon, 17 Aug 2026 14:22:43 GMT