EUVD-2026-84378
GHSA-h2qv-vjc9-5g55
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessAuthenticate to Mattermost API
-
DeliveryCraft POST /api/v4/posts/ids/reactions with huge ID array
-
ExploitServer runs unbounded bulk DB query
-
ExecutionRepeat to sustain load
-
ImpactDatabase performance degradation for all users
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A06:2025 - Insecure Design
ASVS 5.0
V2 - Validation and Business Logic Resource allocation limits
MITRE ATT&CK
1 technique across 1 tactic: Impact The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Requires a valid authenticated Mattermost account with API access (PR:L) that can reach the bulk reactions endpoint POST /api/v4/posts/ids/reactions. The core condition is the missing server-side length cap on the post ID array in that endpoint (CWE-770), which is present by default in the affected versions (11.7.x ≤ 11.7.10, 11.8.x ≤ 11.8.5, 11.9.x ≤ 11.9.1, 11.10.x ≤ 11.10.1) - no non-default configuration is needed. Limiting factors: the attacker must already hold credentials, impact is confined to availability/database load (no data exposure or modification), and severity is bounded (A:L), so a single request causes only transient load rather than a persistent outage. |
| Impact | This is a low-to-moderate operational risk, not a critical priority. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L, base 4.3) is internally consistent with the description: network-reachable, low complexity, but requiring a valid authenticated account (PR:L) and producing only limited availability impact (A:L) with no confidentiality or integrity loss. There is no EPSS score, no CISA KEV listing, and no public POC provided, so exploitation status is: no public exploit identified at time of analysis. The single vendor advisory (Mattermost MMSA-2026-00771) is the only source; there is no independent corroboration or SSVC decision data. The signals are mutually consistent - a self-reported resource-consumption bug with modest impact - so there is no CVSS-vs-real-risk contradiction to flag, but the low A:L rating means worst case is degraded database performance rather than full outage, and the PR:L requirement limits exposure to users who can already authenticate. Verdict: legitimate to patch on a normal maintenance cadence, not an emergency. |
| Exploit ScenarioDerived | An authenticated Mattermost user (any account with API access) sends a POST request to /api/v4/posts/ids/reactions containing an oversized array of post IDs, which the server processes without a length limit, forcing an expensive bulk database query. Repeating such crafted requests drives excessive database load and can degrade performance for other users. No public exploit code has been identified, but the low attack complexity (AC:L) and simple JSON payload make it trivially reproducible for anyone with valid credentials. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 22, 2026
Authenticated Mattermost users can drive excessive database load by submitting an oversized post ID array to the bulk reactions endpoint POST /api/v4/posts/ids/reactions, because Mattermost does not enforce a server-side length cap on that array (CWE-770). The flaw affects 11.7.x through 11.7.10, 11.8.x through 11.8.5, 11.9.x through 11.9.1, and 11.10.x through 11.10.1, requires only a valid account with API access (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L, 4.3), and has availability-only impact, meaning a single crafted request causes transient load rather than a persistent outage. There is no public exploit identified at time of analysis and no CISA KEV listing, so this is a low-to-moderate operational risk rather than a critical priority.
RemediationAI
The provided data does not include an exact fixed version, so confirm the patched build for your release line in the Mattermost security advisory MMSA-2026-00771 at https://mattermost.com/security-updates and upgrade to that version; because the flaw is present by default in 11.7.x through 11.7.10, 11.8.x through 11.8.5, 11.9.x through 11.9.1, and 11.10.x through 11.10.1, upgrading is the only complete fix. If immediate upgrade is not possible, apply compensating controls that reduce the blast radius of the endpoint: configure a reverse proxy or WAF in front of Mattermost to cap request body size and reject or truncate JSON arrays above a sane element count for POST /api/v4/posts/ids/reactions, and rate-limit authenticated API traffic per user or token; the trade-off is that aggressive caps or low rate limits can break legitimate bulk reaction operations and cause 413/429 responses for heavy clients, so tune thresholds against observed normal traffic. Additionally, enable monitoring and alerting on database query latency and connection saturation tied to this endpoint so that abusive calls are detected quickly, accepting the operational cost of additional alerting noise. Note that because the endpoint requires authentication (PR:L), network-level blocking alone will not stop a determined user with valid credentials, so these measures should be treated as temporary mitigations rather than substitutes for patching.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The root cause is CWE-770 (Allocation of Resources Without Limits or Throttling) in the Mattermost server API. The affected feature is the bulk reactions endpoint POST /api/v4/posts/ids/reactions, which accepts a client-supplied JSON array of post IDs and processes them in a loop, resolving posts and writing or reading reaction records against the backend database. Because the server never validates or truncates the length of that array, an authenticated caller can send an arbitrarily large list of IDs, causing a disproportionately expensive database workload (many row lookups and reaction operations) for a single HTTP request. The CPE entry cpe:2.3:a:mattermost:mattermost:*:*:*:*:*:*:*:* identifies the Mattermost server product across the affected release lines. The CVSS vector AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L confirms the flaw is reachable over the network with low attack complexity, but requires a low-privileged authenticated account (PR:L) and no user interaction (UI:N); there is no confidentiality or integrity impact (C:N, I:N), and the availability impact is low (A:L), consistent with the assessment that a single request produces transient load rather than a sustained denial of service. No non-default configuration is required to reach the vulnerable code path, so every deployment of the listed versions exposes the endpoint to any authenticated user.
Know when Mattermost gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L
Network-reachable endpoint (AV:N) with trivial payload (AC:L) but requires an authenticated account (PR:L); only degraded availability via DB load, no confidentiality or integrity impact.
Primary rating from Vendor (Mattermost).
CVSS VectorVendor: Mattermost
DescriptionCVE.org
Mattermost versions 11.9.x <= 11.9.1, 11.8.x <= 11.8.5, 11.7.x <= 11.7.10, 11.10.x <= 11.10.1 fail to limit the length of the post ID array accepted by the bulk reactions endpoint which allows an authenticated user to cause excessive database load via a crafted request to {{POST /api/v4/posts/ids/reactions}}.. Mattermost Advisory ID: MMSA-2026-00771
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.
More in Mattermost
View allMattermost versions 10.4.x <= 10.4.1, 9.11.x <= 9.11.7, 10.3.x <= 10.3.2, 10.2.x <= 10.2.2 fail to properly validate boa
Denial of service in linkify-it (npm) through v5.0.0 lets remote unauthenticated attackers wedge a rendering worker by s
A denial-of-service vulnerability in Mattermost allows an authenticated user to crash the server via multiple large auto
Mattermost version 7.1.x and earlier fails to sufficiently process a specifically crafted GIF file when it is uploaded w
A remote code execution vulnerability (CVSS 9.9) that allows authenticated users. Critical severity with potential for s
Mattermost versions 10.4.x <= 10.4.1, 9.11.x <= 9.11.7, 10.3.x <= 10.3.2, 10.2.x <= 10.2.2 fail to properly validate inp
Privilege escalation to full administrative control in Mattermost self-hosted server (versions 11.6.0 and earlier in the
Mattermost versions 11.0.x <= 11.0.2, 10.12.x <= 10.12.1, 10.11.x <= 10.11.4, 10.5.x <= 10.5.12 fail to to verify that t
Mattermost versions 10.12.x <= 10.12.1, 10.11.x <= 10.11.4, 10.5.x <= 10.5.12, 11.0.x <= 11.0.3 fail to properly validat
Mattermost webapp fails to validate route parameters in/<TEAM_NAME>/channels/<CHANNEL_NAME> allowing an attacker to perf
Fleet is an open source osquery manager. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable,
Mattermost versions 10.4.x <= 10.4.1, 9.11.x <= 9.11.7, 10.3.x <= 10.3.2, 10.2.x <= 10.2.2 fail to use prepared statemen
Exploit-DB