CompaniesMattermostMonthly reportsMarch 2026
Mattermost in March 2026: incidents, uptime and changes
0incidents posted
0labelled major or critical
100%free of major/critical
100%free of any incident
0price changes
0notable page changes
Vendor-reported outage time 0 min, incident time 0 min. Derived from the incidents the vendor posted on its own status page, not measured by us. A minute counts as an outage minute when a major or critical incident (as the vendor labelled it) was open; incident minutes include minor ones too. Maintenance and incidents marked "no impact" are left out, overlapping incidents are merged, a resolved incident counts for at most 7 days, and one still open with no resolution counts for at most 24 hours. Last 90 days.
Incidents 0
Mattermost posted no incidents in March 2026.
CVEs published
- CVE-2026-1628 Mattermost allows external websites to open within the app, exposing preload functionality to non-trusted sites. (CVSS 4.6)
- CVE-2026-2456 Denial of Service via Unbounded Memory Allocation in Integration Actions (CVSS 5.3)
- CVE-2026-2476 MS Teams plugin sensitive config values not properly masked in support packets (CVSS 7.6)
- CVE-2026-2463 Unauthorized access to invite ID during team creation (CVSS 4.3)
- CVE-2026-2461 Missing authorization check allows unauthorized modification of other users' comments on a board (CVSS 4.3)
- CVE-2026-2457 WebSocket Message Spoofing via Permalink Embed Manipulation (CVSS 4.3)
- CVE-2026-2458 Unauthorized channel enumeration in private teams after member removal (CVSS 4.3)
- CVE-2026-26246 Memory Exhaustion via Malformed PSD File Upload (CVSS 4.3)
- CVE-2026-2578 Information Disclosure via WebSocket Event When Deleting Unrevealed Burn on Read Posts (CVSS 4.3)
- CVE-2026-2462 Admin RCE via Malicious Plugin Upload on CI Test Instances (CVSS 6.6)
- CVE-2026-24458 DoS attack via login attempts with multi-megabyte passwords (CVSS 7.5)
- CVE-2026-25783 Denial of service via malformed User-Agent header in getBrowserVersion (CVSS 4.3)
- CVE-2026-4265 Guest user can upload files without permission across teams (CVSS 4.3)
- CVE-2026-25780 Memory Exhaustion via Malformed DOC File Upload (CVSS 4.3)
- CVE-2026-21386 Private channel enumeration via /mute slash command (CVSS 4.3)
- CVE-2026-2455 SSRF bypass via IPv4-mapped IPv6 literals (CVSS 4.3)
- CVE-2026-22545 Password Change Bypass via Auth Switch Endpoint (CVSS 3.1)
- CVE-2026-24692 Guest users can bypass read permissions via search API (CVSS 4.3)
- CVE-2026-26304 Permission Bypass in Playbook Run Creation (CVSS 4.3)
- CVE-2026-2454 DoS in Calls plugin via malformed msgpack in websocket request. (CVSS 5.8)
- CVE-2026-26230 Team Admin Privilege Escalation to Demote Members to Guest (CVSS 3.8)
- CVE-2026-1629 Permalink Preview Information Disclosure After Permission Revocation (CVSS 4.3)
- CVE-2026-26233 Denial of Service via HTTP/2 single packet attack on login endpoint (CVSS 4.3)
- CVE-2026-27656 Account Takeover via Substring Matching in OpenID Connect Authentication (CVSS 5.7)
- CVE-2026-20719 DoS via URL Previews Rendering Malicious SVGs (CVSS 4.3)
- CVE-2026-27659 CSRF vulnerability in UpdateAccessControlPolicyActiveStatus endpoint (CVSS 4.6)
- CVE-2026-4274 Insufficient authorization in shared channel membership sync grants team-level access instead of channel-level access (CVSS 5.4)
- CVE-2026-3108 Terminal Escape Injection in mmctl Report Posts Command (CVSS 8.0)
- CVE-2026-3113 mmctl export download command doesn’t restrict permissions to created file to file owner (CVSS 5.0)
- CVE-2026-3116 Improper Input Validation in Zoom Plugin Webhook Handler (CVSS 4.9)
- CVE-2026-3114 Zip Bomb Denial of Service via Unrestricted Archive Decompression (CVSS 6.5)
- CVE-2026-3115 Guest users can view group member IDs without respecting view restrictions (CVSS 4.3)
- CVE-2026-3109 Missing timestamp validation in Zoom webhook handler (CVSS 2.2)
- CVE-2026-3112 Arbitrary File Read via Advanced Logging Support Packet (CVSS 6.8)
Cite this
Mattermost posted 0 status incidents in March 2026 (0 major or critical); 0 price changes and 0 notable page changes observed.
- Title
- Mattermost in March 2026
- Vendor
- Mattermost
- Date
- URL
- https://rewindex.com/company/mattermost/2026/03