# Mattermost in March 2026: incidents, uptime and changes

> Mattermost in March 2026: 0 incidents on its status page (0 major or critical), 100% free of major or critical incidents (vendor-reported), 34 CVEs. From Rewindex’s archive of Mattermost’s status, pricing and policy pages.

Canonical: https://rewindex.com/company/mattermost/2026/03
Last updated: 2026-06-17T10:56:20Z

- Incidents posted: 0 (major/critical: 0) · Maintenance: 0
- By vendor impact label: none
- Uptime (vendor-reported): 100% free of major/critical incidents, 100% free of any incident; outage time 0 min, incident time 0 min
- Price changes: 0 · Pricing/legal/trust page changes: 0 · Deprecations: 0 · CVEs: 34
- Previous month: [February 2026](https://rewindex.com/company/mattermost/2026/02.md) · Next: [April 2026](https://rewindex.com/company/mattermost/2026/04.md) · [All months](https://rewindex.com/company/mattermost/reports.md) · [Mattermost](https://rewindex.com/company/mattermost.md)

_Uptime: Derived from the incidents the vendor posted on its own status page, not measured by us. A minute counts as an outage minute when a major or critical incident (as the vendor labelled it) was open; incident minutes include minor ones too. Maintenance and incidents marked "no impact" are left out, overlapping incidents are merged, a resolved incident counts for at most 7 days, and one still open with no resolution counts for at most 24 hours._

## All incidents

_No incidents posted this month._

## CVEs published

- [CVE-2026-1628](https://rewindex.com/cve/CVE-2026-1628.md) Mattermost allows external websites to open within the app, exposing preload functionality to non-trusted sites. (CVSS 4.6), published 2026-03-02
- [CVE-2026-2456](https://rewindex.com/cve/CVE-2026-2456.md) Denial of Service via Unbounded Memory Allocation in Integration Actions (CVSS 5.3), published 2026-03-16
- [CVE-2026-2476](https://rewindex.com/cve/CVE-2026-2476.md) MS Teams plugin sensitive config values not properly masked in support packets (CVSS 7.6), published 2026-03-16
- [CVE-2026-2463](https://rewindex.com/cve/CVE-2026-2463.md) Unauthorized access to invite ID during team creation (CVSS 4.3), published 2026-03-16
- [CVE-2026-2461](https://rewindex.com/cve/CVE-2026-2461.md) Missing authorization check allows unauthorized modification of other users' comments on a board (CVSS 4.3), published 2026-03-16
- [CVE-2026-2457](https://rewindex.com/cve/CVE-2026-2457.md) WebSocket Message Spoofing via Permalink Embed Manipulation (CVSS 4.3), published 2026-03-16
- [CVE-2026-2458](https://rewindex.com/cve/CVE-2026-2458.md) Unauthorized channel enumeration in private teams after member removal (CVSS 4.3), published 2026-03-16
- [CVE-2026-26246](https://rewindex.com/cve/CVE-2026-26246.md) Memory Exhaustion via Malformed PSD File Upload (CVSS 4.3), published 2026-03-16
- [CVE-2026-2578](https://rewindex.com/cve/CVE-2026-2578.md) Information Disclosure via WebSocket Event When Deleting Unrevealed Burn on Read Posts (CVSS 4.3), published 2026-03-16
- [CVE-2026-2462](https://rewindex.com/cve/CVE-2026-2462.md) Admin RCE via Malicious Plugin Upload on CI Test Instances (CVSS 6.6), published 2026-03-16
- [CVE-2026-24458](https://rewindex.com/cve/CVE-2026-24458.md) DoS attack via login attempts with multi-megabyte passwords (CVSS 7.5), published 2026-03-16
- [CVE-2026-25783](https://rewindex.com/cve/CVE-2026-25783.md) Denial of service via malformed User-Agent header in getBrowserVersion (CVSS 4.3), published 2026-03-16
- [CVE-2026-4265](https://rewindex.com/cve/CVE-2026-4265.md) Guest user can upload files without permission across teams (CVSS 4.3), published 2026-03-16
- [CVE-2026-25780](https://rewindex.com/cve/CVE-2026-25780.md) Memory Exhaustion via Malformed DOC File Upload (CVSS 4.3), published 2026-03-16
- [CVE-2026-21386](https://rewindex.com/cve/CVE-2026-21386.md) Private channel enumeration via /mute slash command (CVSS 4.3), published 2026-03-16
- [CVE-2026-2455](https://rewindex.com/cve/CVE-2026-2455.md) SSRF bypass via IPv4-mapped IPv6 literals (CVSS 4.3), published 2026-03-16
- [CVE-2026-22545](https://rewindex.com/cve/CVE-2026-22545.md) Password Change Bypass via Auth Switch Endpoint (CVSS 3.1), published 2026-03-16
- [CVE-2026-24692](https://rewindex.com/cve/CVE-2026-24692.md) Guest users can bypass read permissions via search API (CVSS 4.3), published 2026-03-16
- [CVE-2026-26304](https://rewindex.com/cve/CVE-2026-26304.md) Permission Bypass in Playbook Run Creation (CVSS 4.3), published 2026-03-16
- [CVE-2026-2454](https://rewindex.com/cve/CVE-2026-2454.md) DoS in Calls plugin via malformed msgpack in websocket request. (CVSS 5.8), published 2026-03-16
- [CVE-2026-26230](https://rewindex.com/cve/CVE-2026-26230.md) Team Admin Privilege Escalation to Demote Members to Guest (CVSS 3.8), published 2026-03-16
- [CVE-2026-1629](https://rewindex.com/cve/CVE-2026-1629.md) Permalink Preview Information Disclosure After Permission Revocation (CVSS 4.3), published 2026-03-16
- [CVE-2026-26233](https://rewindex.com/cve/CVE-2026-26233.md) Denial of Service via HTTP/2 single packet attack on login endpoint (CVSS 4.3), published 2026-03-25
- [CVE-2026-27656](https://rewindex.com/cve/CVE-2026-27656.md) Account Takeover via Substring Matching in OpenID Connect Authentication (CVSS 5.7), published 2026-03-25
- [CVE-2026-20719](https://rewindex.com/cve/CVE-2026-20719.md) DoS via URL Previews Rendering Malicious SVGs (CVSS 4.3), published 2026-03-25
- [CVE-2026-27659](https://rewindex.com/cve/CVE-2026-27659.md) CSRF vulnerability in UpdateAccessControlPolicyActiveStatus endpoint (CVSS 4.6), published 2026-03-25
- [CVE-2026-4274](https://rewindex.com/cve/CVE-2026-4274.md) Insufficient authorization in shared channel membership sync grants team-level access instead of channel-level access (CVSS 5.4), published 2026-03-26
- [CVE-2026-3108](https://rewindex.com/cve/CVE-2026-3108.md) Terminal Escape Injection in mmctl Report Posts Command (CVSS 8.0), published 2026-03-26
- [CVE-2026-3113](https://rewindex.com/cve/CVE-2026-3113.md) mmctl export download command doesn’t restrict permissions to created file to file owner (CVSS 5.0), published 2026-03-26
- [CVE-2026-3116](https://rewindex.com/cve/CVE-2026-3116.md) Improper Input Validation in Zoom Plugin Webhook Handler (CVSS 4.9), published 2026-03-26
- [CVE-2026-3114](https://rewindex.com/cve/CVE-2026-3114.md) Zip Bomb Denial of Service via Unrestricted Archive Decompression (CVSS 6.5), published 2026-03-26
- [CVE-2026-3115](https://rewindex.com/cve/CVE-2026-3115.md) Guest users can view group member IDs without respecting view restrictions (CVSS 4.3), published 2026-03-26
- [CVE-2026-3109](https://rewindex.com/cve/CVE-2026-3109.md) Missing timestamp validation in Zoom webhook handler (CVSS 2.2), published 2026-03-26
- [CVE-2026-3112](https://rewindex.com/cve/CVE-2026-3112.md) Arbitrary File Read via Advanced Logging Support Packet (CVSS 6.8), published 2026-03-26

## Cite this

Mattermost posted 0 status incidents in March 2026 (0 major or critical); 0 price changes and 0 notable page changes observed.

- Canonical URL: https://rewindex.com/company/mattermost/2026/03
- Citation: Mattermost, “Mattermost in March 2026” (2026-03-01 00:00 UTC). Archived by Rewindex: https://rewindex.com/company/mattermost/2026/03 (CC BY 4.0).
- Markdown link: `[Mattermost: Mattermost in March 2026 (2026-03-01)](https://rewindex.com/company/mattermost/2026/03)`


---
Canonical: https://rewindex.com/company/mattermost/2026/03 · Markdown: https://rewindex.com/company/mattermost/2026/03.md · Data licensed CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/) · Generated 2026-11-05T14:33:52.572Z