# Mattermost in April 2026: incidents, uptime and changes

> Mattermost in April 2026: 0 incidents on its status page (0 major or critical), 100% free of major or critical incidents (vendor-reported), 8 CVEs. From Rewindex’s archive of Mattermost’s status, pricing and policy pages.

Canonical: https://rewindex.com/company/mattermost/2026/04
Last updated: 2026-10-23T22:10:00Z

- Incidents posted: 0 (major/critical: 0) · Maintenance: 0
- By vendor impact label: none
- Uptime (vendor-reported): 100% free of major/critical incidents, 100% free of any incident; outage time 0 min, incident time 0 min
- Price changes: 0 · Pricing/legal/trust page changes: 0 · Deprecations: 0 · CVEs: 8
- Previous month: [March 2026](https://rewindex.com/company/mattermost/2026/03.md) · Next: [May 2026](https://rewindex.com/company/mattermost/2026/05.md) · [All months](https://rewindex.com/company/mattermost/reports.md) · [Mattermost](https://rewindex.com/company/mattermost.md)

_Uptime: Derived from the incidents the vendor posted on its own status page, not measured by us. A minute counts as an outage minute when a major or critical incident (as the vendor labelled it) was open; incident minutes include minor ones too. Maintenance and incidents marked "no impact" are left out, overlapping incidents are merged, a resolved incident counts for at most 7 days, and one still open with no resolution counts for at most 24 hours._

## All incidents

_No incidents posted this month._

## CVEs published

- [CVE-2026-25773](https://rewindex.com/cve/CVE-2026-25773.md) Focalboard Second-Order SQL Injection in category reorder endpoint allows data exfiltration (unsupported product, no fix) (CVSS 8.1), published 2026-04-03
- [CVE-2026-28736](https://rewindex.com/cve/CVE-2026-28736.md) Focalboard IDOR in file content endpoint allows cross-user file access (unsupported product, no fix) (CVSS 4.3), published 2026-04-03
- [CVE-2026-3524](https://rewindex.com/cve/CVE-2026-3524.md) Authorization Bypass in Mattermost Legal Hold Plugin Due to Missing Return After Permission Check (CVSS 8.3), published 2026-04-06
- [CVE-2026-21388](https://rewindex.com/cve/CVE-2026-21388.md) Unbounded Request Body Read in MS Teams Plugin {{/lifecycle}} Webhook Endpoint (CVSS 3.7), published 2026-04-09
- [CVE-2026-24661](https://rewindex.com/cve/CVE-2026-24661.md) Unbounded Request Body Read in MS Teams Plugin {{/changes}} Webhook Endpoint (CVSS 3.7), published 2026-04-09
- [CVE-2026-27769](https://rewindex.com/cve/CVE-2026-27769.md) Connected Workspaces: Malicious remote server can manipulate arbitrary user's status (CVSS 2.7), published 2026-04-15
- [CVE-2026-28741](https://rewindex.com/cve/CVE-2026-28741.md) CSRF Protection Bypass Allows Updating a User's Authentication Method (CVSS 6.8), published 2026-04-15
- [CVE-2026-3590](https://rewindex.com/cve/CVE-2026-3590.md) Race Condition in Guest Magic Link Authentication Allows Token Reuse (CVSS 6.5), published 2026-04-15

## Cite this

Mattermost posted 0 status incidents in April 2026 (0 major or critical); 0 price changes and 0 notable page changes observed.

- Canonical URL: https://rewindex.com/company/mattermost/2026/04
- Citation: Mattermost, “Mattermost in April 2026” (2026-04-01 00:00 UTC). Archived by Rewindex: https://rewindex.com/company/mattermost/2026/04 (CC BY 4.0).
- Markdown link: `[Mattermost: Mattermost in April 2026 (2026-04-01)](https://rewindex.com/company/mattermost/2026/04)`


---
Canonical: https://rewindex.com/company/mattermost/2026/04 · Markdown: https://rewindex.com/company/mattermost/2026/04.md · Data licensed CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/) · Generated 2026-11-04T13:29:16.222Z