CVE-2021-37859: Mattermost

Medium severity, CVSS 6.1. EPSS: 3.3% chance of exploitation in the next 30 days.

Fixed a bypass for a reflected cross-site scripting vulnerability affecting OAuth-enabled instances of Mattermost.

Affected products

• Mattermost Mattermost: from 5.32.0, before 5.34.5 (fixed in 5.34.5); from 5.35.0, before 5.35.4 (fixed in 5.35.4); from 5.36.0, before 5.36.1 (fixed in 5.36.1)

Published 2021-08-05. Last modified 2026-06-17.