Mattermost in May 2026: incidents, uptime and changes

Incidents 0

Mattermost posted no incidents in May 2026.

CVEs published

• CVE-2026-4054 SVG content served through Mattermost image proxy despite Content-Type restrictions causes client-side denial of service (CVSS 4.3)
• CVE-2026-4053 post edit time limit is not enforced on some post update operations (CVSS 3.1)
• CVE-2026-6334 OAuth authorization code client binding not enforced during token redemption in Mattermost (CVSS 3.1)
• CVE-2026-28759 Insufficient authorization in shared channel membership sync allows remote cluster to remove users from arbitrary channels (CVSS 4.3)
• CVE-2026-2325 Improper Input Validation in MS Teams Meetings API Handler (CVSS 4.3)
• CVE-2026-3637 Mattermost fails to enforce create_post permission when editing posts (CVSS 4.3)
• CVE-2026-4273 Insufficient token rotation validation in remote cluster invite confirmation (CVSS 3.7)
• CVE-2026-3495 Unescaped variables during error page composition (CVSS 3.8)
• CVE-2026-6342 Group prefix matching bypass for subscriptions (CVSS 4.3)
• CVE-2026-6341 Incomplete group locking implementation (CVSS 4.3)
• CVE-2026-6340 Memory Exhaustion via Malicious 7zip File Upload (CVSS 4.3)
• CVE-2026-6339 Missing request origin validation on burn-on-read reveal endpoint (CVSS 4.3)
• CVE-2026-4286 Playbooks Plugin fails to validate team transfers, allowing unauthorized removal of member access via playbook update (CVSS 3.1)
• CVE-2026-3117 Instance and webhook GitLab plugin commands were able to be run by non-admin users (CVSS 6.5)
• CVE-2026-5163 Missing authorization check in AI message rewrite endpoint allows access to private thread content (CVSS 6.5)
• CVE-2026-6347 Mattermost Calls plugin exposes TURN server credentials in plaintext in support packets (CVSS 7.6)
• CVE-2026-6343 Mattermost Playbooks Plugin fails to enforce view permissions in list endpoints, allowing unauthorized access to public playbooks (CVSS 4.3)
• CVE-2026-28732 Slash command trigger-word update allowed command hijacking (CVSS 4.3)
• CVE-2026-6346 Sensitive credentials exposed in plaintext in Mattermost support packets (CVSS 8.7)
• CVE-2026-6345 Prevent password disclosure and force reset during Slack import (CVSS 6.5)
• CVE-2026-6333 SSRF via Host Header Spoofing in Custom Slash Commands (CVSS 3.5)
• CVE-2026-4643 Calling window.close() from server-side content causes crash in the Mattermost Desktop App (CVSS 3.5)
• CVE-2026-3471 Opening a window with {{javascript:alert()}} as URL causes crash in the Mattermost Desktop App (CVSS 6.5)
• CVE-2026-4055 Insufficient permission validation on cross-team playbook run creation (CVSS 4.3)
• CVE-2026-4858 Path traversal in integration action URL leading to arbitrary API execution via system admin’s auth token. (CVSS 8.0)
• CVE-2026-22880 Mobile SSO authentication flow allows credential theft via malicious server (CVSS 6.1)
• CVE-2026-5755 Denial of service via crafted TIFF file upload (CVSS 6.5)
• CVE-2026-5308 Missing request body size limits on Zoom plugin HTTP endpoints (CVSS 4.9)
• CVE-2026-5740 Unauthenticated WebSocket binary frame causes denial of service in Mattermost Server (CVSS 7.5)
• CVE-2026-3636 Sanitize team member data returned by API (CVSS 4.3)
• CVE-2026-4646 Insufficient input validation in GitHub plugin API causes denial of service (CVSS 4.3)
• CVE-2026-3473 Improper file ownership validation in the Boards API allows unauthorised file access (CVSS 5.9)
• CVE-2026-4635 Persistent notification timing attack causing server denial of service (CVSS 6.5)
• CVE-2026-28735 GitHub OAuth Scope Validation (CVSS 5.4)
• CVE-2026-4915 Server panic via outgoing webhook responses (CVSS 6.5)
• CVE-2026-6957 Path traversal in Mattermost Legal Hold plugin via unsanitized file name from federated peer allows arbitrary file write. (CVSS 8.0)