CVE-2026-16251Medium· 6.5▾ SunlitMattermost versions 11.10.x <= 11.10.0, 11.7.x <= 11.7.9, 11.9.x <= 11.9.1, 11.8.x <= 11.8.5 fail to limit the size of remote image responses buffered in memory during local image proxy direct fetches, which allows a remote attacker to c…
▾ Sunlit zone — Low / medium · no exploitation signal
impact 35.8 · likelihood 0 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Stakeholder-Specific Vulnerability Categorization from CISA's ADP record at CVE.org: whether exploitation is observed, whether an attack can be automated, and how much of the system is at stake. The CVSS score shown above comes from the assigning CNA record, not NVD.
Mattermost versions 11.10.x <= 11.10.0, 11.7.x <= 11.7.9, 11.9.x <= 11.9.1, 11.8.x <= 11.8.5 fail to limit the size of remote image responses buffered in memory during local image proxy direct fetches, which allows a remote attacker to cause memory exhaustion on the server via a crafted oversized image response.. Mattermost Advisory ID: MMSA-2026-00726
Mattermost >= 11.10.0 <= 11.10.0Mattermost >= 11.7.0 <= 11.7.9Mattermost >= 11.9.0 <= 11.9.1Mattermost >= 11.8.0 <= 11.8.5Update Mattermost to versions 11.11.0, 11.10.1, 11.7.10, 11.9.2, 11.8.6 or higher.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-19867Medium· 4.3Uncapped mention keys in user notification properties allow CPU exhaustion during post processing
CVE-2026-19541Medium· 6.5Outgoing OAuth connection client secret exposure during connection validation
CVE-2026-19601Medium· 4.9Disclosure of AD/LDAP bind password via Test Connection
CVE-2026-18551Medium· 6.5Mattermost guest account privilege escalation via member roles API
CVE-2026-19621Medium· 6.5Mattermost leaks interactive-message integration secrets to non-admin users via post-deletion events and thread reads
CVE-2026-18795Medium· 6.4Missing server side validation allowed user to quarantine a DM and GM post