CVE-2026-96260

Published: Sep 22, 2026Modified: Oct 7, 2026

6.5

Vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Exploitability: 2.8 / Impact: 3.6

Source: responsibledisclosure@mattermost.com (Secondary)

Description

Mattermost versions 11.9.x <= 11.9.1, 11.8.x <= 11.8.5, 11.7.x <= 11.7.10, 11.10.x <= 11.10.1 fail to enforce a request body size limit during CSRF validation of plugin requests which allows an authenticated user to exhaust server memory and cause a denial of service via a large request body sent to a plugin endpoint.. Mattermost Advisory ID: MMSA-2026-00775

Affected (4)

Products: Mattermost: Mattermost Server

Mattermost

1 product

Mattermost Server

Configuration A

4 vulnerable

Vulnerable Software	Affected Versions
Mattermost Mattermost Server	11.10.0 ≤ version < 11.10.2
Mattermost Mattermost Server	11.7.0 ≤ version < 11.7.11
Mattermost Mattermost Server	11.8.0 ≤ version < 11.8.6
Mattermost Mattermost Server	11.9.0 ≤ version < 11.9.2

Related CWEs

CWE-789

Memory Allocation with Excessive Size Value

The product allocates memory based on an untrusted, large size value, but it does not ensure that the size is within expected limits, allowing arbitrary amounts of memory to be allocated.

References (1)

https://mattermost.com/security-updates

Source: responsibledisclosure@mattermost.com

Vendor Advisory

Timeline

No history available yet.