# Mattermost in June 2026: incidents, uptime and changes

> Mattermost in June 2026: 0 incidents on its status page (0 major or critical), 100% free of major or critical incidents (vendor-reported), 20 CVEs. From Rewindex’s archive of Mattermost’s status, pricing and policy pages.

Canonical: https://rewindex.com/company/mattermost/2026/06
Last updated: 2026-10-25T22:10:00Z

- Incidents posted: 0 (major/critical: 0) · Maintenance: 0
- By vendor impact label: none
- Uptime (vendor-reported): 100% free of major/critical incidents, 100% free of any incident; outage time 0 min, incident time 0 min
- Price changes: 0 · Pricing/legal/trust page changes: 0 · Deprecations: 0 · CVEs: 20
- Previous month: [May 2026](https://rewindex.com/company/mattermost/2026/05.md) · Next: [July 2026](https://rewindex.com/company/mattermost/2026/07.md) · [All months](https://rewindex.com/company/mattermost/reports.md) · [Mattermost](https://rewindex.com/company/mattermost.md)

_Uptime: Derived from the incidents the vendor posted on its own status page, not measured by us. A minute counts as an outage minute when a major or critical incident (as the vendor labelled it) was open; incident minutes include minor ones too. Maintenance and incidents marked "no impact" are left out, overlapping incidents are merged, a resolved incident counts for at most 7 days, and one still open with no resolution counts for at most 24 hours._

## All incidents

_No incidents posted this month._

## CVEs published

- [CVE-2026-3433](https://rewindex.com/cve/CVE-2026-3433.md) Mattermost fails to scope role\_updated websocket events to authorized team and channel members (CVSS 4.3), published 2026-06-12
- [CVE-2026-6739](https://rewindex.com/cve/CVE-2026-6739.md) Mattermost: Delegated admins could patch protected default system roles (CVSS 6.7), published 2026-06-12
- [CVE-2026-7184](https://rewindex.com/cve/CVE-2026-7184.md) Mattermost Remote Cluster PATCH API Leaks Authentication Tokens (CVSS 6.5), published 2026-06-12
- [CVE-2026-6689](https://rewindex.com/cve/CVE-2026-6689.md) \*Missing\* {{invite\_user}} \*permission check on team creation allows unprivileged users to set open-invite and allowed-domains team settings\* (CVSS 4.3), published 2026-06-12
- [CVE-2026-6046](https://rewindex.com/cve/CVE-2026-6046.md) Plugin bot username conflict allows user account to be used as bot identity in Mattermost Server (CVSS 5.3), published 2026-06-12
- [CVE-2026-7387](https://rewindex.com/cve/CVE-2026-7387.md) Mattermost group syncable endpoints allow privilege escalation via scheme\_admin (CVSS 8.8), published 2026-06-12
- [CVE-2026-6961](https://rewindex.com/cve/CVE-2026-6961.md) CVE-2026-6961: Path traversal via unsanitized FileInfo.Name in Mattermost federation sync (CVSS 7.6), published 2026-06-12
- [CVE-2026-6517](https://rewindex.com/cve/CVE-2026-6517.md) Mattermost Desktop App fails to restrict the allow list of domains which NTLM credentials are passed (CVSS 6.3), published 2026-06-15
- [CVE-2026-8683](https://rewindex.com/cve/CVE-2026-8683.md) Overly long URLs crash the Mattermost Desktop App (CVSS 6.5), published 2026-06-15
- [CVE-2026-5139](https://rewindex.com/cve/CVE-2026-5139.md) GitLab Plugin Allows Non-Admin Users to Modify Default Instance Configuration (CVSS 5.4), published 2026-06-22
- [CVE-2026-9162](https://rewindex.com/cve/CVE-2026-9162.md) Global session revocation does not invalidate active WebSocket connections (CVSS 4.3), published 2026-06-22
- [CVE-2026-8074](https://rewindex.com/cve/CVE-2026-8074.md) Improper Permission Check Allows User Manager to Deactivate Bot Accounts (CVSS 3.8), published 2026-06-22
- [CVE-2026-6673](https://rewindex.com/cve/CVE-2026-6673.md) Mattermost Jira plugin had unauthenticated {{/ac/installed}} lifecycle callback during pending Jira Cloud install (CVSS 6.4), published 2026-06-22
- [CVE-2026-6062](https://rewindex.com/cve/CVE-2026-6062.md) IDOR in Jira plugin subscription edit endpoint (CVSS 6.4), published 2026-06-22
- [CVE-2026-8823](https://rewindex.com/cve/CVE-2026-8823.md) User Manager can demote bot accounts to guest without bot-management permission (CVSS 3.8), published 2026-06-22
- [CVE-2026-2299](https://rewindex.com/cve/CVE-2026-2299.md) Improper Access Control in Mattermost Google Drive Plugin File Creation Endpoint (CVSS 4.2), published 2026-06-25
- [CVE-2026-13426](https://rewindex.com/cve/CVE-2026-13426.md) Client4 fails to validate path parameters (CVSS 5.4), published 2026-06-26
- [CVE-2026-3472](https://rewindex.com/cve/CVE-2026-3472.md) Markdown image rendering bypass in AI bot tool result posts in Mattermost (CVSS 3.5), published 2026-06-26
- [CVE-2026-9699](https://rewindex.com/cve/CVE-2026-9699.md) Mattermost Agents plugin logs unsanitized OpenAI API keys on authentication errors (CVSS 6.8), published 2026-06-26
- [CVE-2026-4339](https://rewindex.com/cve/CVE-2026-4339.md) SSRF via unvalidated attachment URLs in Mattermost Agents plugin MCP server (CVSS 6.5), published 2026-06-26

## Cite this

Mattermost posted 0 status incidents in June 2026 (0 major or critical); 0 price changes and 0 notable page changes observed.

- Canonical URL: https://rewindex.com/company/mattermost/2026/06
- Citation: Mattermost, “Mattermost in June 2026” (2026-06-01 00:00 UTC). Archived by Rewindex: https://rewindex.com/company/mattermost/2026/06 (CC BY 4.0).
- Markdown link: `[Mattermost: Mattermost in June 2026 (2026-06-01)](https://rewindex.com/company/mattermost/2026/06)`


---
Canonical: https://rewindex.com/company/mattermost/2026/06 · Markdown: https://rewindex.com/company/mattermost/2026/06.md · Data licensed CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/) · Generated 2026-11-05T15:30:52.925Z