CVE-2019-20841: Mattermost Server

High severity, CVSS 8.8. EPSS: 0.4% chance of exploitation in the next 30 days.

An issue was discovered in Mattermost Server before 5.18.0, 5.17.2, 5.16.4, 5.15.4, and 5.9.7. CSRF can sometimes occur via a crafted web site for account takeover attacks.

Affected products

• Mattermost Mattermost Server: before 5.9.7 (fixed in 5.9.7); from 5.15.0, before 5.15.4 (fixed in 5.15.4); from 5.16.0, before 5.16.4 (fixed in 5.16.4); from 5.17.0, before 5.17.2 (fixed in 5.17.2); version 5.18.0 only

Published 2020-06-19. Last modified 2026-06-17.