Mattermost CVE-2026-96260

Requires an authenticated Mattermost user account (PR:L) able to send requests to a plugin endpoint; no user interaction or elevated privileges are needed. The specific prerequisite is that the target instance runs an affected version (11.7.x ≤ 11.7.10, 11.8.x ≤ 11.8.5, 11.9.x ≤ 11.9.1, or 11.10.x ≤ 11.10.1) and exposes plugin request handling, where the CSRF-validation path fails to enforce a request-body size limit. Exploitation is limited by the authentication requirement and yields only denial of service (availability), not code execution or data access.

This is a moderate, availability-only issue whose real-world priority is limited by its prerequisites. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H, base 6.5) shows network reachability and low attack complexity, but PR:L means an attacker must hold a valid authenticated account, and impact is confined to availability (C:N/I:N) - no data disclosure or integrity loss. CWE-789 (uncontrolled/excessive memory allocation) matches the description: an oversized request body during CSRF validation of plugin endpoints exhausts server memory. No EPSS score, CISA KEV listing, or public POC is present in the provided data, so there is no evidence of active exploitation or automated weaponization; this reads as a real but not urgent hardening fix rather than an emergency. The signals are internally consistent (network DoS by an authenticated user), with the main caveat that A:H here means service degradation/crash, not permanent damage. No conflicts between the vector and description were identified.

An attacker who already holds a low-privilege authenticated Mattermost account sends an HTTP request with an extremely large body to a plugin endpoint. Because the CSRF-validation path does not cap the request body size, the server buffers the entire payload into memory, exhausting available RAM and degrading or crashing the service for all users. No public exploit code was identified at time of analysis, and the technique is trivial to reproduce given a valid session.