shouldiuse.io

Categories

VERDICT

Mattermost.com Review

Depends

Should I use Mattermost.com?

Accelerate your mission critical workflow by integrating people, processes, tools and AI infrastructure on a resilient and adaptable platform. - mattermost.com

· 1 month ago

Buy if you're a regulated, defense, or government team that must self-host chat and has ops staff to run it. Skip it if you just want easy team chat — use Slack, Discord, or Zulip instead.

Confidence

Medium. Based on ~50 public sources including G2, Trustpilot, Reddit, Google Play, CVE databases, and vendor pages.

Ratings

  • Value for money
  • Ease of use
  • Feature depth
  • Support qualityNo support quality evidence found
  • Security posture

Pricing

Free (self-hosted)

Entry

ModelNot disclosed
Monthly feesNot disclosed
HardwareNot disclosed
Free tierYes
ProfessionalSee mattermost.com/pricing
EnterpriseContact sales

Best for

  • Defense and government contractors
  • Regulated industries needing self-hosting
  • DevOps and engineering teams
  • Air-gapped or sovereign deployments

Not for

  • Small teams that just want a group chat
  • Companies with no sysadmin or DevOps staff
  • Anyone expecting a durable free tier
  • Mobile-first teams

Gotchas - check before you buy

high

Entry edition locks message history after 10,000 messages — older messages sit behind paid plans.

medium

Free option was pulled from the pricing page; downgrade paths from paid editions are murky.

medium

Third-party breakdowns flag hidden costs behind the headline pricing.

medium

Self-hosting means you own upgrades, backups, and patching every new CVE.

Pros and cons

Pros

  • Open-source and self-hosted; data stays on your infrastructure
  • Rated 4.3/5 on G2 across 369 reviews
  • Integrates Jira, ServiceNow, GitLab, PagerDuty out of the box
  • Public bug bounty and regular dependency vulnerability scans
  • Purpose-built for sovereign and air-gapped environments

Cons

  • Trustpilot score sits at just 2.9
  • Mobile app users report it is 'extremely slow'
  • Free option removed from the public pricing page
  • Recent CVEs include a server auth bypass
  • Community sees v10 as the end of free open-source Mattermost

Sources & method

- 10 sources - Active security program with bug bounty and routine scans, but several recent CVEs are disclosed, including an auth bypass.

official x3review x4security x2news x1
  • CVE-2026-6339 — Mattermost Server auth bypass, Authentication bypass vulnerability disclosed May 2026.
  • CVE-2025-24490 — SQL injection, Part of multiple critical vulnerabilities flagged in Mattermost Collaboration, February 2025.
  • CVE-2025-58075, NVD assessment not yet published as of October 2025.
  • CERT-FR advisory on Mattermost Server, French national CERT (ANSSI) published a vulnerability notice citing data integrity risk.

Key stats

  • Value for money: 2/5

    Rating

  • Free (self-hosted)

    Starting price

  • 10

    Sources

  • Analyzed

  • Value for money: 2/5. 10k-message caps, hidden costs, shrinking free tier
  • Ease of use: 2/5. Self-hosting burden; mobile app called extremely slow
  • Feature depth: 4/5. Integrates Jira, GitLab, ServiceNow, PagerDuty; plugin platform
  • Support quality. No support quality evidence found
  • Security posture: 3/5. Public bug bounty, but recent critical CVEs
  • 4.3/5 G2 rating 369 reviews
  • 2.9/5 Trustpilot Average TrustScore
  • $70M Total funding incl. $50M Series B, 2019
  • $33.1M Est. ARR 2024 estimate

Pricing

Entry

Free (self-hosted)

  • Channel-based messaging
  • 10,000-message history cap

Professional

See mattermost.com/pricing

  • Advanced messaging features
  • Per-seat licensing

Enterprise

Not disclosed

  • Compliance and government options
  • Custom contracts

Security

Active security program with bug bounty and routine scans, but several recent CVEs are disclosed, including an auth bypass.

  • CVE-2026-6339 — Mattermost Server auth bypassAuthentication bypass vulnerability disclosed May 2026.⁸
  • CVE-2025-24490 — SQL injectionPart of multiple critical vulnerabilities flagged in Mattermost Collaboration, February 2025.⁹
  • CVE-2025-58075NVD assessment not yet published as of October 2025.
  • CERT-FR advisory on Mattermost ServerFrench national CERT (ANSSI) published a vulnerability notice citing data integrity risk.

What users say

Engineers praise the self-hosted threading model while users report slow mobile apps, message-history paywalls, and shrinking free features.

“Extremely slow.”
Google Play review
“Is v10 the practical end of "Free and Open Source Mattermost"”
Reddit, r/Mattermost
“Mattermost disqualifying itself from further self hosted usage”
Reddit, r/Mattermost

Companies that use it

  • Fairphone
  • Schäferbarthold
  • Data For Good
Full analysis

Based on ~50 public sources including G2, Trustpilot, Reddit, Google Play, CVE databases, and vendor pages.

Enterprise self-hosted Slack alternative for regulated teams — heavy ops burden, shrinking free tier, mixed reviews.

Methodology

Based on ~50 public sources including G2, Trustpilot, Reddit, Google Play, CVE databases, and vendor pages.

Read how a report is made.

Sources

  1. Mattermost Pricingmattermost.com
    official
  2. Mattermost on GitHub (open source)github.com
    official
  3. Mattermost Security Updatesmattermost.com
    official
  4. Mattermost reviews on G2g2.com
    review
  5. Mattermost on Trustpilottrustpilot.com
    review
  6. Mattermost on Google Playplay.google.com
    review
  7. Reddit, r/Mattermost on v10 open-source changesreddit.com
    review
  8. CVE-2026-6339 auth bypass (SentinelOne)sentinelone.com
    security
  9. Multiple Critical Vulnerabilities in Mattermost (Censys)censys.com
    security
  10. Mattermost funding and ARR (GetLatka)getlatka.com
    news

Add this review to your site

This check for Mattermost.com says Depends.

Put the badge on your site.

Visitors see the independent review.

The link points here, and search engines follow it.

This is the badge visitors see on your site.

Depends Mattermost.com Independent review on Should I Use It

Paste one snippet. Keep the link as it is. A nofollow tag stops search engines from following it.

Rate this review

Anonymous. You can change your vote.

Loading votes…

Comments

One queue. No nested comments. Give a display name first. Limit: 200 words per comment and 7 comments per day. You can edit or delete yours.

Save a name to write a comment.

0 / 200 words

No comments yet.