What is the CVSS score of CVE-2026-6850?

CVE-2026-6850 has a CVSS 3.1 base score of 6.5 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H. EPSS exploitation probability: 0.2%.

Mattermost CVE-2026-6850

EUVD-2026-43313 MEDIUM

Inefficient Regular Expression Complexity (ReDoS) (CWE-1333)

2026-07-13 Mattermost

GHSA-c8hv-77r5-h5f7

Denial Of Service Mattermost

6.5

CVSS 3.1 · Vendor: Mattermost

Severity by source

Vendor (Mattermost) PRIMARY

6.5 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

vuln.today AI

6.5 MEDIUM

Network-delivered post requires a low-privilege authenticated account (PR:L, AV:N); no confidentiality or integrity impact; availability is high as all channel members' clients are simultaneously affected.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (Mattermost).

CVSS VectorVendor: Mattermost

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 13, 2026 - 09:04 vuln.today

DescriptionCVE.org

Mattermost versions 11.7.x <= 11.7.2, 11.6.x <= 11.6.4, 10.11.x <= 10.11.19 fail to validate the length and content of message attachment field values, which allows an authenticated attacker to cause a denial of service for all users in a channel via a post containing a specially crafted payload that triggers catastrophic backtracking in the client-side markdown parser.. Mattermost Advisory ID: MMSA-2026-00658

AnalysisAI

Catastrophic regex backtracking in Mattermost's client-side markdown parser can be triggered by an authenticated user posting a specially crafted message attachment, causing a denial-of-service condition for every user rendering that channel. Affected builds span versions 11.7.x through 11.7.2, 11.6.x through 11.6.4, and 10.11.x through 10.11.19. …

Unlock full vulnerability intelligence

Risk assessment & exploitation conditions
Attack chain visualization
Remediation with exact patch versions
Threat intelligence from 22 sources
Personal watchlist & email alerts

Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access

Obtain authenticated Mattermost user account

Delivery

Craft message attachment with ReDoS payload in field values

Exploit

Post malicious message to target channel

Execution

Victim clients automatically render attachment via markdown parser

Persist

Catastrophic regex backtracking consumes client CPU

Impact

Channel-wide client denial of service for all members

Access

Obtain authenticated Mattermost user account

Delivery

Craft message attachment with ReDoS payload in field values

Exploit

Post malicious message to target channel

Execution

Victim clients automatically render attachment via markdown parser

Persist

Catastrophic regex backtracking consumes client CPU

Impact

Channel-wide client denial of service for all members

Vulnerability AssessmentAI

Exploitation	Exploitation requires a valid authenticated Mattermost user account, confirmed by CVSS PR:L; unauthenticated or anonymous access is not sufficient. … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment	The vendor-assigned CVSS 3.1 score of 6.5 (Medium) with vector AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H is consistent with the described behavior. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario	An authenticated Mattermost user with posting access to a busy channel crafts a message attachment whose field values contain a string designed to trigger worst-case backtracking in the client-side markdown parser - a well-understood technique for ReDoS given that common markdown regex patterns are publicly documented. Upon posting, every client actively viewing the channel automatically renders the attachment, causing their markdown parsers to enter near-infinite processing loops, effectively freezing or crashing the Mattermost desktop or web client for all affected users. …
Remediation	Upgrade to a patched Mattermost release as documented in vendor advisory MMSA-2026-00658, available at https://mattermost.com/security-updates. … Detailed patch versions, workarounds, and compensating controls in full report.