BugRater
Early access. The directory is still filling out, and every rating here comes from a researcher's reported experience.

Security releases

Mattermost

Mattermost Security Releases - October 2026

mattermost-2026-10 Oct 1, 2026 Source: Vendor

Mattermost security advisories for October 2026, compiled from CVE.org records.

Source of record The credited names below are quoted verbatim from the vendor's own advisory: https://www.cve.org/CVERecord?id=CVE-2026-18551
Are you credited here? Sign in to claim your line. It is yours immediately, with no review queue. The name the vendor printed stays next to your handle for anyone to check against the advisory above, and any member who thinks a claim is wrong can refute it.

Credited

15 lines
All 15 CVEs 15 Additional recognition 0 Unclaimed only
Showing 1–15 of 15
CVE-2026-18551 BR2026-0000-034096 Mattermost unclaimed
Mattermost versions 11.10.x <= 11.10.0, 11.7.x <= 11.7.9, 11.9.x <= 11.9.1, 11.8.x <= 11.8.5 fail to validate the combination of guest and admin scheme roles which allows an authenticated attacker ...
Credited as 0x7oda7123
CVE-2026-18795 BR2026-0000-034097 Mattermost unclaimed
Mattermost versions 11.10.x <= 11.10.0, 11.7.x <= 11.7.9, 11.9.x <= 11.9.1, 11.8.x <= 11.8.5 fail to enforce DM/GM check on server side which allows an authenticated user to quarantine a post belon...
Credited as Harshil Sharma
CVE-2026-19541 BR2026-0000-034098 Mattermost unclaimed
Mattermost versions 11.9.x <= 11.9.1, 11.8.x <= 11.8.5, 11.7.x <= 11.7.10, 11.10.x <= 11.10.1 fail to require re-entry of the stored client secret when validating an outgoing OAuth connection, whic...
Credited as Juho Forsén
CVE-2026-19601 BR2026-0000-034099 Mattermost unclaimed
Mattermost versions 11.9.x <= 11.9.1, 11.8.x <= 11.8.5, 11.7.x <= 11.7.10, 11.10.x <= 11.10.1 fail to invalidate the stored AD/LDAP bind password when other connection settings (such as the server ...
Credited as Juho Forsén
CVE-2026-19603 BR2026-0000-034100 Mattermost unclaimed
Mattermost versions 11.9.x <= 11.9.1, 11.8.x <= 11.8.5, 11.7.x <= 11.7.10, 11.10.x <= 11.10.1 fail to sanitize the active channel field returned by the user status API endpoints, which allows an au...
Credited as CERT PL
CVE-2026-19867 BR2026-0000-034101 Mattermost unclaimed
Mattermost versions 11.10.x <= 11.10.0, 11.9.x <= 11.9.1, 11.8.x <= 11.8.5, 11.7.x <= 11.7.10 fail to cap the number and size of mention keys stored in a user's notification properties, and to boun...
Credited as CERT PL
CVE-2026-16251 BR2026-0000-034106 Mattermost unclaimed
Mattermost versions 11.10.x <= 11.10.0, 11.7.x <= 11.7.9, 11.9.x <= 11.9.1, 11.8.x <= 11.8.5 fail to limit the size of remote image responses buffered in memory during local image proxy direct fetc...
Credited as alimursaliyev
CVE-2026-16453 BR2026-0000-034107 Mattermost unclaimed
Mattermost versions 11.10.x <= 11.10.0, 11.7.x <= 11.7.9, 11.9.x <= 11.9.1, 11.8.x <= 11.8.5 fail to verify the integrity of the SAML RelayState POST parameter which allows an authenticated SAML us...
Credited as Doyensec
CVE-2026-18223 BR2026-0000-034108 Mattermost unclaimed
Mattermost versions 11.10.x <= 11.10.0, 11.7.x <= 11.7.9, 11.9.x <= 11.9.1, 11.8.x <= 11.8.5 fail to validate the invited recipient's email address when redeeming team and guest invitation tokens, ...
Credited as CERT PL
CVE-2026-18256 BR2026-0000-034109 Mattermost unclaimed
Mattermost versions 11.10.x <= 11.10.0, 11.7.x <= 11.7.9, 11.9.x <= 11.9.1, 11.8.x <= 11.8.5 fail to properly restrict private teams from public team search results, which allows an authenticated u...
Credited as CERT PL
CVE-2026-18560 BR2026-0000-034110 Mattermost unclaimed
Mattermost versions 11.10.x <= 11.10.0, 11.7.x <= 11.7.9, 11.9.x <= 11.9.1, 11.8.x <= 11.8.5 fail to validate user’s permissions before other validations which allows non-content reviewers to infer...
Credited as adamsec-dev
CVE-2026-18799 BR2026-0000-034111 Mattermost unclaimed
Mattermost versions 11.10.x <= 11.10.0, 11.7.x <= 11.7.9, 11.9.x <= 11.9.1, 11.8.x <= 11.8.5 fail to restrict Slack import account binding to system administrator-initiated imports which allows an ...
Credited as Claude and Ada Logics
CVE-2026-19076 BR2026-0000-034112 Mattermost unclaimed
Mattermost versions 11.10.x <= 11.10.0, 11.7.x <= 11.7.9, 11.9.x <= 11.9.1, 11.8.x <= 11.8.5 fail to reject OAuth application sessions in the account type switch endpoint, which allows an attacker ...
Credited as CERT PL
CVE-2026-19600 BR2026-0000-034113 Mattermost unclaimed
Mattermost versions 11.9.x <= 11.9.1, 11.8.x <= 11.8.5, 11.7.x <= 11.7.10, 11.10.x <= 11.10.1 fail to sanitize authentication tokens before writing them to server log entries, which allows an attac...
Credited as CERT PL
CVE-2026-19621 BR2026-0000-034114 Mattermost unclaimed
Mattermost versions 11.10.x <= 11.10.0, 11.7.x <= 11.7.9, 11.9.x <= 11.9.1, 11.8.x <= 11.8.5 fail to strip action integration secrets from post payloads before broadcasting post-deletion web socket...
Credited as Edgar Bellot Micó