CVE-2026-22880Medium· 6.1▾ SunlitMattermost Mobile Apps versions <=2.37 11.4 2.0.37 11.0.4 11.1.3 11.3.2 10.11.11.0 fail to properly validate the SSO authentication callback origin which allows an attacker controlling a malicious Mattermost server to steal user credenti…
▾ Sunlit zone — Low / medium · no exploitation signal
impact 33.6 · likelihood 0 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Exploit-prediction probability, daily snapshots since Aug 6.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via NVD
Last analysed / modified upstream
0.1%
Mattermost Mobile Apps versions <=2.37 11.4 2.0.37 11.0.4 11.1.3 11.3.2 10.11.11.0 fail to properly validate the SSO authentication callback origin which allows an attacker controlling a malicious Mattermost server to steal user credentials for a legitimate Mattermost server via relaying the SSO code exchange flow through the mobile application. Mattermost Advisory ID: MMSA-2025-00564
mattermost_mobile < 2.37.1Upgrade past the affected range:
mattermost_mobile 2.37.1Connected by shared product, vendor, weakness, or advisory.
CVE-2025-62190Medium· 4.3Mattermost versions 11.0.x <= 11.0.4, 10.12.x <= 10.12.2, 10.11.x <= 10.11.6 and Mattermost Calls versions <=1.10.0 fail to implement CSRF protection on the Calls widget page which allows an authenticated attacker to initiate calls and i…
CVE-2026-93846Low· 3.8Team admin can escalate a team member's permissions via the team member roles endpoint
CVE-2026-93847Low· 3.5Improper post type validation on scheduled post endpoints
CVE-2026-93850Medium· 6.5Unbounded memory consumption during PDF text extraction
CVE-2026-93848Low· 2.7Mattermost OpenID discovery endpoint request bypasses outbound connection filtering, allowing SSRF by a System Administrator
CVE-2026-93849Medium· 6.5Mattermost allows authenticated users to trigger excessive memory allocation via crafted msgpack binary WebSocket frames