# Mattermost in September 2026: incidents, uptime and changes

> Mattermost in September 2026: 0 incidents on its status page (0 major or critical), 100% free of major or critical incidents (vendor-reported), 22 CVEs. From Rewindex’s archive of Mattermost’s status, pricing and policy pages.

Canonical: https://rewindex.com/company/mattermost/2026/09
Last updated: 2026-10-14T19:28:53Z

- Incidents posted: 0 (major/critical: 0) · Maintenance: 0
- By vendor impact label: none
- Uptime (vendor-reported): 100% free of major/critical incidents, 100% free of any incident; outage time 0 min, incident time 0 min
- Price changes: 0 · Pricing/legal/trust page changes: 0 · Deprecations: 0 · CVEs: 22
- Previous month: [August 2026](https://rewindex.com/company/mattermost/2026/08.md) · Next: [October 2026](https://rewindex.com/company/mattermost/2026/10.md) · [All months](https://rewindex.com/company/mattermost/reports.md) · [Mattermost](https://rewindex.com/company/mattermost.md)

_Uptime: Derived from the incidents the vendor posted on its own status page, not measured by us. A minute counts as an outage minute when a major or critical incident (as the vendor labelled it) was open; incident minutes include minor ones too. Maintenance and incidents marked "no impact" are left out, overlapping incidents are merged, a resolved incident counts for at most 7 days, and one still open with no resolution counts for at most 24 hours._

## All incidents

_No incidents posted this month._

## CVEs published

- [CVE-2026-14259](https://rewindex.com/cve/CVE-2026-14259.md) Board archive import bypasses team board creation permissions (CVSS 4.3), published 2026-09-14
- [CVE-2026-11993](https://rewindex.com/cve/CVE-2026-11993.md) Fix authenticated members disabling file content indexing server-wide via extraction pool exhaustion (CVSS 4.3), published 2026-09-14
- [CVE-2026-12882](https://rewindex.com/cve/CVE-2026-12882.md) Mattermost Markdown autolink parsing denial of service (CVSS 4.3), published 2026-09-14
- [CVE-2026-14344](https://rewindex.com/cve/CVE-2026-14344.md) Inconsistent authorization checks in Mattermost Boards endpoints (CVSS 4.3), published 2026-09-14
- [CVE-2026-10542](https://rewindex.com/cve/CVE-2026-10542.md) Playbooks channel action update validation issue (CVSS 5.0), published 2026-09-14
- [CVE-2026-15814](https://rewindex.com/cve/CVE-2026-15814.md) Uploading a crafted image causes excessive memory allocation in the Mattermost Server (CVSS 6.5), published 2026-09-14
- [CVE-2026-5132](https://rewindex.com/cve/CVE-2026-5132.md) Unbounded zlib decompression in Calls SDP WebSocket messages (CVSS 6.5), published 2026-09-14
- [CVE-2026-8821](https://rewindex.com/cve/CVE-2026-8821.md) Playbooks run owner channel membership permission bypass (CVSS 7.1), published 2026-09-14
- [CVE-2026-9812](https://rewindex.com/cve/CVE-2026-9812.md) Missing property field ownership validation in Playbooks run property update endpoint (CVSS 6.5), published 2026-09-14
- [CVE-2026-13417](https://rewindex.com/cve/CVE-2026-13417.md) Boards plugin denial of service via unvalidated block fields.properties (CVSS 4.3), published 2026-09-14
- [CVE-2026-10556](https://rewindex.com/cve/CVE-2026-10556.md) Unauthenticated webhook request with null notification entry could crash the Microsoft Calendar plugin. (CVSS 5.3), published 2026-09-14
- [CVE-2026-86349](https://rewindex.com/cve/CVE-2026-86349.md) Mattermost Server Algorithmic DoS via Unbounded Markdown Block Nesting (CVSS 4.3), published 2026-09-14
- [CVE-2026-86348](https://rewindex.com/cve/CVE-2026-86348.md) MS Calendar plugin: unrecovered handler panics from malformed post-action requests could crash the plugin process (CVSS 4.3), published 2026-09-14
- [CVE-2026-82920](https://rewindex.com/cve/CVE-2026-82920.md) Mattermost ABAC parent policy bypass via policy update endpoint (CVSS 5.5), published 2026-09-14
- [CVE-2026-12985](https://rewindex.com/cve/CVE-2026-12985.md) Mattermost DCR redirect URI allowlist bypass via improper URL component validation (CVSS 6.8), published 2026-09-14
- [CVE-2026-91181](https://rewindex.com/cve/CVE-2026-91181.md) Data Retention Teams Endpoint Leaks Private Team Invite ID (CVSS 6.5), published 2026-09-14
- [CVE-2026-75025](https://rewindex.com/cve/CVE-2026-75025.md) Mattermost Desktop local network access from server-rendered content (CVSS 4.7), published 2026-09-16
- [CVE-2026-75588](https://rewindex.com/cve/CVE-2026-75588.md) Mattermost Desktop App plugin popout scheme validation bypass (CVSS 2.6), published 2026-09-17
- [CVE-2026-12284](https://rewindex.com/cve/CVE-2026-12284.md) Mattermost Desktop App Missing IPC Sender Validation in Calls Leave Handler (CVSS 3.8), published 2026-09-17
- [CVE-2026-95666](https://rewindex.com/cve/CVE-2026-95666.md) Unbounded post ID array in the bulk reactions endpoint allows denial of service (CVSS 4.3), published 2026-09-22
- [CVE-2026-96259](https://rewindex.com/cve/CVE-2026-96259.md) Mattermost server-side request forgery via OAuth endpoints configurable by a System Administrator (CVSS 5.5), published 2026-09-22
- [CVE-2026-96260](https://rewindex.com/cve/CVE-2026-96260.md) Mattermost server missing request body size limit on plugin routes allows denial of service by an authenticated user (CVSS 6.5), published 2026-09-22

## Cite this

Mattermost posted 0 status incidents in September 2026 (0 major or critical); 0 price changes and 0 notable page changes observed.

- Canonical URL: https://rewindex.com/company/mattermost/2026/09
- Citation: Mattermost, “Mattermost in September 2026” (2026-09-01 00:00 UTC). Archived by Rewindex: https://rewindex.com/company/mattermost/2026/09 (CC BY 4.0).
- Markdown link: `[Mattermost: Mattermost in September 2026 (2026-09-01)](https://rewindex.com/company/mattermost/2026/09)`


---
Canonical: https://rewindex.com/company/mattermost/2026/09 · Markdown: https://rewindex.com/company/mattermost/2026/09.md · Data licensed CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/) · Generated 2026-11-05T13:34:38.066Z