Vendor · Vulnerability hub

Mattermost vulnerabilities

Mattermost is an open-source, self-hosted messaging and collaboration platform used in security operations, incident response, and regulated industries. CVEs here cover authentication, authorization, and data-handling flaws in the server, client, and integrated plugins.

We track 1 Mattermost CVE; none is on CISA's KEV catalog yet.

1 article 1 CVE RSS JSON

CVEs tracked: 1
On CISA KEV: 0
Ransomware use: 0
Rated critical: 0

Latest Mattermost coverage

Our reporting filed under Mattermost, plus any story that cites one of its CVEs.

~/articles/2026-09-17-mattermost-cve-2026-14344-board-auth-bypass

mattermost

Mattermost CVE-2026-14344: Board Permission Check Skipped

CVE-2026-14344 lets any authenticated Mattermost user create boards regardless of role assignments. Four active release branches affected; upgrade per the security advisory.

Sep 17read →

Other Mattermost CVEs we track

CVE / Vulnerability	Severity	CVSS	EPSS	Added to KEV
CVE-2026-14344 Mattermost Boards Board-Creation Permission Not Enforcedwrite-up	[ MEDIUM ]	4.3	0.3%	—

Not on CISA KEV as of our last sync. Severity and CVSS as stated by NVD or the vendor; EPSS from FIRST.org.

Machine-readable: /api/v1/vendors/mattermost.json.

Every CVE row links to its record with the CISA required action, catalog coverage and primary sources. We describe impact and remediation only; no exploit code. See the full KEV tracker, the vendor scorecard, or all vendors.