Mattermost CVE-2026-19867

Requires an authenticated Mattermost account on an affected version (11.7.x ≤ 11.7.10, 11.8.x ≤ 11.8.5, 11.9.x ≤ 11.9.1, 11.10.x ≤ 11.10.0) and the ability to edit one's own user notification properties (notify_props.mention_keys) - standard self-service functionality, not an administrative or non-default setting. The concrete prerequisite is that the attacker shares at least one channel with the victims, since the quadratic multibyte-keyword matching runs per post for each member; impact is scoped to CPU/latency degradation (availability only, no data exposure). LIMITING FACTORS: valid authentication is required (PR:L, so not exploitable by anonymous users), impact is confined to degraded performance rather than a crash (A:L), and effect is bounded to members of channels the attacker shares.

This is a low-to-moderate priority issue despite being network-reachable. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L, base 4.3) is internally consistent with the description: an authenticated user (PR:L) can remotely (AV:N) and without user interaction (UI:N) trigger a resource-exhaustion condition with availability-only impact (A:L) and no confidentiality or integrity loss. The CWE-770 (uncontrolled resource allocation) classification and 'Denial Of Service' tag align with the described quadratic multibyte-keyword matching amplified by an unbounded notify_props.mention_keys list. No EPSS score, KEV listing, or POC is present in the provided data, so there is no public exploit identified at time of analysis and no evidence of active exploitation; the A:L (low, not high) rating indicates degraded performance rather than full outage. The main risk-limiting factors are the authentication requirement and the fact that impact is CPU degradation for channel members rather than a hard crash. MISSING DATA: no EPSS probability and no vendor severity beyond the CVSS base were supplied for cross-reference, and the referenced advisory URL (MMSA-2026-00773) is a generic security-updates landing page, not the specific advisory page - fix versions should be verified directly with Mattermost.

A legitimate authenticated Mattermost user edits their own notification preferences and stores an oversized notify_props.mention_keys list (many large multibyte keywords) on their profile. Because mention matching runs per post for every channel member and scales quadratically with keyword size/count, each message the attacker-controlled profile shares a channel with forces excessive CPU work, degrading post-processing latency for other members. No public exploit code is identified at time of analysis, but the attack requires only normal self-service profile editing and no special tooling.