CVE-2026-19867Medium· 4.3▾ SunlitMattermost versions 11.10.x <= 11.10.0, 11.9.x <= 11.9.1, 11.8.x <= 11.8.5, 11.7.x <= 11.7.10 fail to cap the number and size of mention keys stored in a user's notification properties, and to bound the quadratic multibyte-keyword matchi…
▾ Sunlit zone — Low / medium · no exploitation signal
impact 23.7 · likelihood 0 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Stakeholder-Specific Vulnerability Categorization from CISA's ADP record at CVE.org: whether exploitation is observed, whether an attack can be automated, and how much of the system is at stake. The CVSS score shown above comes from the assigning CNA record, not NVD.
Mattermost versions 11.10.x <= 11.10.0, 11.9.x <= 11.9.1, 11.8.x <= 11.8.5, 11.7.x <= 11.7.10 fail to cap the number and size of mention keys stored in a user's notification properties, and to bound the quadratic multibyte-keyword matching performed for each post, which allows an authenticated user to degrade post-processing latency and consume excessive CPU on behalf of other members of any channel they share via storing an oversized notify_props.mention_keys list on their own profile.. Mattermost Advisory ID: MMSA-2026-00773
Mattermost >= 11.10.0 <= 11.10.0Mattermost >= 11.9.0 <= 11.9.1Mattermost >= 11.8.0 <= 11.8.5Mattermost >= 11.7.0 <= 11.7.10Update Mattermost to versions 11.11.0, 11.10.1, 11.9.2, 11.8.6, 11.7.11 or higher.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-16251Medium· 6.5Mattermost local image proxy allows server memory exhaustion via unbounded image response buffering
CVE-2026-19541Medium· 6.5Outgoing OAuth connection client secret exposure during connection validation
CVE-2026-19601Medium· 4.9Disclosure of AD/LDAP bind password via Test Connection
CVE-2026-18551Medium· 6.5Mattermost guest account privilege escalation via member roles API
CVE-2026-19621Medium· 6.5Mattermost leaks interactive-message integration secrets to non-admin users via post-deletion events and thread reads
CVE-2026-18795Medium· 6.4Missing server side validation allowed user to quarantine a DM and GM post