CompaniesMattermostMonthly reportsSeptember 2026
Mattermost in September 2026: incidents, uptime and changes
0incidents posted
0labelled major or critical
100%free of major/critical
100%free of any incident
0price changes
0notable page changes
Vendor-reported outage time 0 min, incident time 0 min. Derived from the incidents the vendor posted on its own status page, not measured by us. A minute counts as an outage minute when a major or critical incident (as the vendor labelled it) was open; incident minutes include minor ones too. Maintenance and incidents marked "no impact" are left out, overlapping incidents are merged, a resolved incident counts for at most 7 days, and one still open with no resolution counts for at most 24 hours. Last 90 days.
Incidents 0
Mattermost posted no incidents in September 2026.
CVEs published
- CVE-2026-14259 Board archive import bypasses team board creation permissions (CVSS 4.3)
- CVE-2026-11993 Fix authenticated members disabling file content indexing server-wide via extraction pool exhaustion (CVSS 4.3)
- CVE-2026-12882 Mattermost Markdown autolink parsing denial of service (CVSS 4.3)
- CVE-2026-14344 Inconsistent authorization checks in Mattermost Boards endpoints (CVSS 4.3)
- CVE-2026-10542 Playbooks channel action update validation issue (CVSS 5.0)
- CVE-2026-15814 Uploading a crafted image causes excessive memory allocation in the Mattermost Server (CVSS 6.5)
- CVE-2026-5132 Unbounded zlib decompression in Calls SDP WebSocket messages (CVSS 6.5)
- CVE-2026-8821 Playbooks run owner channel membership permission bypass (CVSS 7.1)
- CVE-2026-9812 Missing property field ownership validation in Playbooks run property update endpoint (CVSS 6.5)
- CVE-2026-13417 Boards plugin denial of service via unvalidated block fields.properties (CVSS 4.3)
- CVE-2026-10556 Unauthenticated webhook request with null notification entry could crash the Microsoft Calendar plugin. (CVSS 5.3)
- CVE-2026-86349 Mattermost Server Algorithmic DoS via Unbounded Markdown Block Nesting (CVSS 4.3)
- CVE-2026-86348 MS Calendar plugin: unrecovered handler panics from malformed post-action requests could crash the plugin process (CVSS 4.3)
- CVE-2026-82920 Mattermost ABAC parent policy bypass via policy update endpoint (CVSS 5.5)
- CVE-2026-12985 Mattermost DCR redirect URI allowlist bypass via improper URL component validation (CVSS 6.8)
- CVE-2026-91181 Data Retention Teams Endpoint Leaks Private Team Invite ID (CVSS 6.5)
- CVE-2026-75025 Mattermost Desktop local network access from server-rendered content (CVSS 4.7)
- CVE-2026-75588 Mattermost Desktop App plugin popout scheme validation bypass (CVSS 2.6)
- CVE-2026-12284 Mattermost Desktop App Missing IPC Sender Validation in Calls Leave Handler (CVSS 3.8)
- CVE-2026-95666 Unbounded post ID array in the bulk reactions endpoint allows denial of service (CVSS 4.3)
- CVE-2026-96259 Mattermost server-side request forgery via OAuth endpoints configurable by a System Administrator (CVSS 5.5)
- CVE-2026-96260 Mattermost server missing request body size limit on plugin routes allows denial of service by an authenticated user (CVSS 6.5)
Cite this
Mattermost posted 0 status incidents in September 2026 (0 major or critical); 0 price changes and 0 notable page changes observed.
- Title
- Mattermost in September 2026
- Vendor
- Mattermost
- Date
- URL
- https://rewindex.com/company/mattermost/2026/09