CVE-2019-20865: Mattermost Server

High severity, CVSS 8.8. EPSS: 0.5% chance of exploitation in the next 30 days.

An issue was discovered in Mattermost Server before 5.12.0, 5.11.1, 5.10.2, 5.9.2, and 4.10.10. The login page allows CSRF.

Affected products

• Mattermost Mattermost Server: before 4.10.10 (fixed in 4.10.10); from 5.9.0, before 5.9.2 (fixed in 5.9.2); from 5.10.0, before 5.10.2 (fixed in 5.10.2); from 5.11.0, before 5.11.1 (fixed in 5.11.1); version 5.12.0 only

Published 2020-06-19. Last modified 2026-06-17.