CVE-2026-24661CWE-770

Unbounded Request Body Read in MS Teams Plugin {{/changes}} Webhook Endpoint

Low · published April 9, 2026

CVSS v3.1
3.7
EPSS
0%
Percentile
22.8
In the wild
Unconfirmed
What it is

Mattermost Plugins versions <=2.1.3.0 fail to limit the request body size on the {{/changes}} webhook endpoint which allows an authenticated attacker to cause memory exhaustion and denial of service via sending an oversized JSON payload. Mattermost Advisory ID: MMSA-2026-00611

The record
Technical detail
CVSS v3.1
3.7 · LOW
Vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L
CVSS v4.0
Not supplied
EPSS
0.00311 · 22.8th percentile
Weakness
CWE-770 · Allocation of Resources Without Limits or Throttling
Published
2026-04-09T10:12Z
EPSS history
Timeline
  • 09 APR 10:12Z
    Unbounded Request Body Read in MS Teams Plugin {{/changes}} Webhook Endpoint
    cvelistv5