CompaniesMattermostMonthly reportsJuly 2026
Mattermost in July 2026: incidents, uptime and changes
0incidents posted
0labelled major or critical
100%free of major/critical
100%free of any incident
0price changes
0notable page changes
Vendor-reported outage time 0 min, incident time 0 min. Derived from the incidents the vendor posted on its own status page, not measured by us. A minute counts as an outage minute when a major or critical incident (as the vendor labelled it) was open; incident minutes include minor ones too. Maintenance and incidents marked "no impact" are left out, overlapping incidents are merged, a resolved incident counts for at most 7 days, and one still open with no resolution counts for at most 24 hours. Last 90 days.
Incidents 0
Mattermost posted no incidents in July 2026.
CVEs published
- CVE-2026-9571 Deactivated user accounts can continue to obtain valid OAuth access tokens via refresh token grant in Mattermost (CVSS 5.9)
- CVE-2026-10103 Authenticated remote cluster can modify or delete posts it does not own in Mattermost Connected Workspaces shared channels (CVSS 4.3)
- CVE-2026-9708 Incoming webhook user attribution via unvalidated webhook owner (CVSS 4.9)
- CVE-2026-10085 Ordinary group/direct message member can enable group_constrained and remove all channel participants (CVSS 5.4)
- CVE-2026-10106 Unauthorized users can trigger interactive post actions in private channels via action cookie channel mismatch in Mattermost (CVSS 6.5)
- CVE-2026-6850 Crafted message attachment causes client-side denial of service via markdown parser regex backtracking in Mattermost (CVSS 6.5)
- CVE-2026-9597 Deactivated guest accounts can authenticate via magic-link token in Mattermost REST API login endpoint (CVSS 5.4)
- CVE-2026-9824 Remote cluster metadata enumeration via /share-channel autocomplete (CVSS 4.3)
- CVE-2026-9820 Mattermost schemes teams endpoint exposes private team invite IDs (CVSS 3.8)
- CVE-2026-6541 Unscoped updates to other playbooks' metric configuration (CVSS 4.3)
- CVE-2026-9602 Mattermost Desktop App crashes when malformed arguments are provided to some exposed IPC methods (CVSS 5.7)
- CVE-2026-8075 Posting a malicious markdown image crashes the Mattermost Desktop App (CVSS 6.5)
- CVE-2026-10600 Denial of service via unbounded document content extraction in Mattermost Server (CVSS 4.3)
- CVE-2026-10819 Mattermost Server Denial of Service via Animated GIF Emoji Upload (CVSS 6.5)
- CVE-2026-7521 SAML certificate deletion allows path traversal to delete arbitrary files outside the config directory (CVSS 5.5)
Maintenance 1
Show scheduled maintenance
Cite this
Mattermost posted 0 status incidents in July 2026 (0 major or critical); 0 price changes and 0 notable page changes observed.
- Title
- Mattermost in July 2026
- Vendor
- Mattermost
- Date
- URL
- https://rewindex.com/company/mattermost/2026/07