CompaniesMattermostMonthly reportsJune 2026
Mattermost in June 2026: incidents, uptime and changes
0incidents posted
0labelled major or critical
100%free of major/critical
100%free of any incident
0price changes
0notable page changes
Vendor-reported outage time 0 min, incident time 0 min. Derived from the incidents the vendor posted on its own status page, not measured by us. A minute counts as an outage minute when a major or critical incident (as the vendor labelled it) was open; incident minutes include minor ones too. Maintenance and incidents marked "no impact" are left out, overlapping incidents are merged, a resolved incident counts for at most 7 days, and one still open with no resolution counts for at most 24 hours. Last 90 days.
Incidents 0
Mattermost posted no incidents in June 2026.
CVEs published
- CVE-2026-3433 Mattermost fails to scope role_updated websocket events to authorized team and channel members (CVSS 4.3)
- CVE-2026-6739 Mattermost: Delegated admins could patch protected default system roles (CVSS 6.7)
- CVE-2026-7184 Mattermost Remote Cluster PATCH API Leaks Authentication Tokens (CVSS 6.5)
- CVE-2026-6689 *Missing* {{invite_user}} *permission check on team creation allows unprivileged users to set open-invite and allowed-domains team settings* (CVSS 4.3)
- CVE-2026-6046 Plugin bot username conflict allows user account to be used as bot identity in Mattermost Server (CVSS 5.3)
- CVE-2026-7387 Mattermost group syncable endpoints allow privilege escalation via scheme_admin (CVSS 8.8)
- CVE-2026-6961 CVE-2026-6961: Path traversal via unsanitized FileInfo.Name in Mattermost federation sync (CVSS 7.6)
- CVE-2026-6517 Mattermost Desktop App fails to restrict the allow list of domains which NTLM credentials are passed (CVSS 6.3)
- CVE-2026-8683 Overly long URLs crash the Mattermost Desktop App (CVSS 6.5)
- CVE-2026-5139 GitLab Plugin Allows Non-Admin Users to Modify Default Instance Configuration (CVSS 5.4)
- CVE-2026-9162 Global session revocation does not invalidate active WebSocket connections (CVSS 4.3)
- CVE-2026-8074 Improper Permission Check Allows User Manager to Deactivate Bot Accounts (CVSS 3.8)
- CVE-2026-6673 Mattermost Jira plugin had unauthenticated {{/ac/installed}} lifecycle callback during pending Jira Cloud install (CVSS 6.4)
- CVE-2026-6062 IDOR in Jira plugin subscription edit endpoint (CVSS 6.4)
- CVE-2026-8823 User Manager can demote bot accounts to guest without bot-management permission (CVSS 3.8)
- CVE-2026-2299 Improper Access Control in Mattermost Google Drive Plugin File Creation Endpoint (CVSS 4.2)
- CVE-2026-13426 Client4 fails to validate path parameters (CVSS 5.4)
- CVE-2026-3472 Markdown image rendering bypass in AI bot tool result posts in Mattermost (CVSS 3.5)
- CVE-2026-9699 Mattermost Agents plugin logs unsanitized OpenAI API keys on authentication errors (CVSS 6.8)
- CVE-2026-4339 SSRF via unvalidated attachment URLs in Mattermost Agents plugin MCP server (CVSS 6.5)
Cite this
Mattermost posted 0 status incidents in June 2026 (0 major or critical); 0 price changes and 0 notable page changes observed.
- Title
- Mattermost in June 2026
- Vendor
- Mattermost
- Date
- URL
- https://rewindex.com/company/mattermost/2026/06