# Mattermost in August 2026: incidents, uptime and changes

> Mattermost in August 2026: 0 incidents on its status page (0 major or critical), 100% free of major or critical incidents (vendor-reported), 14 CVEs. From Rewindex’s archive of Mattermost’s status, pricing and policy pages.

Canonical: https://rewindex.com/company/mattermost/2026/08
Last updated: 2026-09-14T11:17:03Z

- Incidents posted: 0 (major/critical: 0) · Maintenance: 0
- By vendor impact label: none
- Uptime (vendor-reported): 100% free of major/critical incidents, 100% free of any incident; outage time 0 min, incident time 0 min
- Price changes: 0 · Pricing/legal/trust page changes: 0 · Deprecations: 0 · CVEs: 14
- Previous month: [July 2026](https://rewindex.com/company/mattermost/2026/07.md) · Next: [September 2026](https://rewindex.com/company/mattermost/2026/09.md) · [All months](https://rewindex.com/company/mattermost/reports.md) · [Mattermost](https://rewindex.com/company/mattermost.md)

_Uptime: Derived from the incidents the vendor posted on its own status page, not measured by us. A minute counts as an outage minute when a major or critical incident (as the vendor labelled it) was open; incident minutes include minor ones too. Maintenance and incidents marked "no impact" are left out, overlapping incidents are merged, a resolved incident counts for at most 7 days, and one still open with no resolution counts for at most 24 hours._

## All incidents

_No incidents posted this month._

## CVEs published

- [CVE-2026-14298](https://rewindex.com/cve/CVE-2026-14298.md) Boards archive import endpoint allows resource exhaustion via zip bomb and file size limit bypass in Mattermost (CVSS 6.5), published 2026-08-13
- [CVE-2026-16048](https://rewindex.com/cve/CVE-2026-16048.md) Channel member roles accept out-of-scope roles (CVSS 6.3), published 2026-08-17
- [CVE-2026-16046](https://rewindex.com/cve/CVE-2026-16046.md) Missing run-state validation on finished playbook runs (CVSS 3.5), published 2026-08-17
- [CVE-2026-16047](https://rewindex.com/cve/CVE-2026-16047.md) Board channel linking without read channel permission validation (CVSS 4.3), published 2026-08-17
- [CVE-2026-16049](https://rewindex.com/cve/CVE-2026-16049.md) \_GitLab Plugin allows cross-channel post injection and phishing via missing channel permission checks in issue API endpoints\_ (CVSS 3.9), published 2026-08-17
- [CVE-2026-16045](https://rewindex.com/cve/CVE-2026-16045.md) Delegated OAuth tokens could revoke unrelated OAuth application authorizations (CVSS 2.7), published 2026-08-17
- [CVE-2026-16044](https://rewindex.com/cve/CVE-2026-16044.md) Insufficient validation of guest board admin privileges on archive import (CVSS 3.9), published 2026-08-17
- [CVE-2026-15754](https://rewindex.com/cve/CVE-2026-15754.md) Missing per-channel team-scope check in ABAC access control policy unassign allows cross-team policy removal (CVSS 4.2), published 2026-08-17
- [CVE-2026-10527](https://rewindex.com/cve/CVE-2026-10527.md) Boards plugin retains Board Admin rights for users demoted to System Guest (CVSS 6.3), published 2026-08-17
- [CVE-2026-10080](https://rewindex.com/cve/CVE-2026-10080.md) Boards plugin panics on WebSocket command with non-string field types (CVSS 6.5), published 2026-08-17
- [CVE-2026-9816](https://rewindex.com/cve/CVE-2026-9816.md) Insufficient server-side validation of board member role fields permits privilege escalation (CVSS 8.3), published 2026-08-17
- [CVE-2026-9859](https://rewindex.com/cve/CVE-2026-9859.md) Mattermost Boards plugin didn’t enforce role-based authorization on board channel link allowing board editors to expose boards to arbitrary channels (CVSS 6.5), published 2026-08-17
- [CVE-2026-9693](https://rewindex.com/cve/CVE-2026-9693.md) Mattermost thread memberships persist after team removal, exposing private channel thread metadata on re-invite (CVSS 3.5), published 2026-08-17
- [CVE-2026-75587](https://rewindex.com/cve/CVE-2026-75587.md) Plaintext pre-auth secret exposure via Desktop App diagnostics report (CVSS 3.6), published 2026-08-17

## Cite this

Mattermost posted 0 status incidents in August 2026 (0 major or critical); 0 price changes and 0 notable page changes observed.

- Canonical URL: https://rewindex.com/company/mattermost/2026/08
- Citation: Mattermost, “Mattermost in August 2026” (2026-08-01 00:00 UTC). Archived by Rewindex: https://rewindex.com/company/mattermost/2026/08 (CC BY 4.0).
- Markdown link: `[Mattermost: Mattermost in August 2026 (2026-08-01)](https://rewindex.com/company/mattermost/2026/08)`


---
Canonical: https://rewindex.com/company/mattermost/2026/08 · Markdown: https://rewindex.com/company/mattermost/2026/08.md · Data licensed CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/) · Generated 2026-11-05T15:56:54.020Z