# Mattermost in July 2026: incidents, uptime and changes

> Mattermost in July 2026: 0 incidents on its status page (0 major or critical), 100% free of major or critical incidents (vendor-reported), 15 CVEs. From Rewindex’s archive of Mattermost’s status, pricing and policy pages.

Canonical: https://rewindex.com/company/mattermost/2026/07
Last updated: 2026-10-15T13:32:07Z

- Incidents posted: 0 (major/critical: 0) · Maintenance: 1
- By vendor impact label: none
- Uptime (vendor-reported): 100% free of major/critical incidents, 100% free of any incident; outage time 0 min, incident time 0 min
- Price changes: 0 · Pricing/legal/trust page changes: 0 · Deprecations: 0 · CVEs: 15
- Previous month: [June 2026](https://rewindex.com/company/mattermost/2026/06.md) · Next: [August 2026](https://rewindex.com/company/mattermost/2026/08.md) · [All months](https://rewindex.com/company/mattermost/reports.md) · [Mattermost](https://rewindex.com/company/mattermost.md)

_Uptime: Derived from the incidents the vendor posted on its own status page, not measured by us. A minute counts as an outage minute when a major or critical incident (as the vendor labelled it) was open; incident minutes include minor ones too. Maintenance and incidents marked "no impact" are left out, overlapping incidents are merged, a resolved incident counts for at most 7 days, and one still open with no resolution counts for at most 24 hours._

## All incidents

_No incidents posted this month._

## CVEs published

- [CVE-2026-9571](https://rewindex.com/cve/CVE-2026-9571.md) Deactivated user accounts can continue to obtain valid OAuth access tokens via refresh token grant in Mattermost (CVSS 5.9), published 2026-07-13
- [CVE-2026-10103](https://rewindex.com/cve/CVE-2026-10103.md) Authenticated remote cluster can modify or delete posts it does not own in Mattermost Connected Workspaces shared channels (CVSS 4.3), published 2026-07-13
- [CVE-2026-9708](https://rewindex.com/cve/CVE-2026-9708.md) Incoming webhook user attribution via unvalidated webhook owner (CVSS 4.9), published 2026-07-13
- [CVE-2026-10085](https://rewindex.com/cve/CVE-2026-10085.md) Ordinary group/direct message member can enable group\_constrained and remove all channel participants (CVSS 5.4), published 2026-07-13
- [CVE-2026-10106](https://rewindex.com/cve/CVE-2026-10106.md) Unauthorized users can trigger interactive post actions in private channels via action cookie channel mismatch in Mattermost (CVSS 6.5), published 2026-07-13
- [CVE-2026-6850](https://rewindex.com/cve/CVE-2026-6850.md) Crafted message attachment causes client-side denial of service via markdown parser regex backtracking in Mattermost (CVSS 6.5), published 2026-07-13
- [CVE-2026-9597](https://rewindex.com/cve/CVE-2026-9597.md) Deactivated guest accounts can authenticate via magic-link token in Mattermost REST API login endpoint (CVSS 5.4), published 2026-07-13
- [CVE-2026-9824](https://rewindex.com/cve/CVE-2026-9824.md) Remote cluster metadata enumeration via /share-channel autocomplete (CVSS 4.3), published 2026-07-13
- [CVE-2026-9820](https://rewindex.com/cve/CVE-2026-9820.md) Mattermost schemes teams endpoint exposes private team invite IDs (CVSS 3.8), published 2026-07-13
- [CVE-2026-6541](https://rewindex.com/cve/CVE-2026-6541.md) Unscoped updates to other playbooks' metric configuration (CVSS 4.3), published 2026-07-13
- [CVE-2026-9602](https://rewindex.com/cve/CVE-2026-9602.md) Mattermost Desktop App crashes when malformed arguments are provided to some exposed IPC methods (CVSS 5.7), published 2026-07-17
- [CVE-2026-8075](https://rewindex.com/cve/CVE-2026-8075.md) Posting a malicious markdown image crashes the Mattermost Desktop App (CVSS 6.5), published 2026-07-17
- [CVE-2026-10600](https://rewindex.com/cve/CVE-2026-10600.md) Denial of service via unbounded document content extraction in Mattermost Server (CVSS 4.3), published 2026-07-27
- [CVE-2026-10819](https://rewindex.com/cve/CVE-2026-10819.md) Mattermost Server Denial of Service via Animated GIF Emoji Upload (CVSS 6.5), published 2026-07-27
- [CVE-2026-7521](https://rewindex.com/cve/CVE-2026-7521.md) SAML certificate deletion allows path traversal to delete arbitrary files outside the config directory (CVSS 5.5), published 2026-07-28

## Maintenance

| Incident | Impact (vendor label) | Started (UTC) | Resolved (UTC) | Duration | Status |
| --- | --- | --- | --- | --- | --- |
| [\[Scheduled\] Customer databases maintenance](https://rewindex.com/company/mattermost/incidents/6kcs4g9n1229.md) | maintenance | 2026-07-25 08:00 UTC | 2026-07-25 10:00 UTC | 2.0 h | resolved |

## Cite this

Mattermost posted 0 status incidents in July 2026 (0 major or critical); 0 price changes and 0 notable page changes observed.

- Canonical URL: https://rewindex.com/company/mattermost/2026/07
- Citation: Mattermost, “Mattermost in July 2026” (2026-07-01 00:00 UTC). Archived by Rewindex: https://rewindex.com/company/mattermost/2026/07 (CC BY 4.0).
- Markdown link: `[Mattermost: Mattermost in July 2026 (2026-07-01)](https://rewindex.com/company/mattermost/2026/07)`


---
Canonical: https://rewindex.com/company/mattermost/2026/07 · Markdown: https://rewindex.com/company/mattermost/2026/07.md · Data licensed CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/) · Generated 2026-11-05T14:51:02.600Z