CVE-2026-95666CWE-770denial-of-service

CVE-2026-95666

Medium · published September 22, 2026

CVSS v3.1
4.3
EPSS
0%
Percentile
29.4
In the wild
Unconfirmed
What it is

Mattermost versions 11.9.x <= 11.9.1, 11.8.x <= 11.8.5, 11.7.x <= 11.7.10, 11.10.x <= 11.10.1 fail to limit the length of the post ID array accepted by the bulk reactions endpoint which allows an authenticated user to cause excessive database load via a crafted request to {{POST /api/v4/posts/ids/reactions}}.. Mattermost Advisory ID: MMSA-2026-00771

The record
Technical detail
CVSS v3.1
4.3 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L
CVSS v4.0
Not supplied
EPSS
0.00367 · 29.4th percentile
Weakness
CWE-770 · Allocation of Resources Without Limits or Throttling
Published
2026-09-22T18:17Z
Affected products (4)
ProductVersionsFixed in
mattermost/mattermost_server≥ 11.7.0, < 11.7.1111.7.11
mattermost/mattermost_server≥ 11.8.0, < 11.8.611.8.6
mattermost/mattermost_server≥ 11.9.0, < 11.9.211.9.2
mattermost/mattermost_server≥ 11.10.0, < 11.10.211.10.2
References (1)
https://mattermost.com/security-updates · [email protected]
EPSS history
Timeline
  • 24 SEP 03:25Z
    EPSS moved — → 0%
    epss
  • 22 SEP 13:11Z
    Unbounded post ID array in the bulk reactions endpoint allows denial of service
    cvelistv5