CVE-2026-93850Medium· 6.5▾ SunlitMattermost versions 11.9.x <= 11.9.1, 11.8.x <= 11.8.5, 11.7.x <= 11.7.10, 11.10.x <= 11.10.1 fail to bind the volume of text extracted from an uploaded PDF which allows an authenticated user to exhaust server memory and cause a denial o…
▾ Sunlit zone — Low / medium · no exploitation signal
impact 35.8 · likelihood 0 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Stakeholder-Specific Vulnerability Categorization from CISA's ADP record at CVE.org: whether exploitation is observed, whether an attack can be automated, and how much of the system is at stake. The CVSS score shown above comes from the assigning CNA record, not NVD.
Mattermost versions 11.9.x <= 11.9.1, 11.8.x <= 11.8.5, 11.7.x <= 11.7.10, 11.10.x <= 11.10.1 fail to bind the volume of text extracted from an uploaded PDF which allows an authenticated user to exhaust server memory and cause a denial of service via a crafted PDF whose compressed content stream expands into a very large amount of text.. Mattermost Advisory ID: MMSA-2026-00769
Mattermost >= 11.9.0 <= 11.9.1Mattermost >= 11.8.0 <= 11.8.5Mattermost >= 11.7.0 <= 11.7.10Mattermost >= 11.10.0 <= 11.10.1Update Mattermost to versions 11.11.0, 11.9.2, 11.8.6, 11.7.11, 11.10.2 or higher.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-14298Medium· 6.5Boards archive import endpoint allows resource exhaustion via zip bomb and file size limit bypass in Mattermost
CVE-2026-93846Low· 3.8Team admin can escalate a team member's permissions via the team member roles endpoint
CVE-2026-93847Low· 3.5Improper post type validation on scheduled post endpoints
CVE-2026-93848Low· 2.7Mattermost OpenID discovery endpoint request bypasses outbound connection filtering, allowing SSRF by a System Administrator
CVE-2026-93849Medium· 6.5Mattermost allows authenticated users to trigger excessive memory allocation via crafted msgpack binary WebSocket frames
CVE-2026-116516Medium· 6.5Insufficient length validation when parsing Zoom chat transcriptions