Vulnerability Details CVE-2026-19867
Mattermost versions 11.10.x <= 11.10.0, 11.9.x <= 11.9.1, 11.8.x <= 11.8.5, 11.7.x <= 11.7.10 fail to cap the number and size of mention keys stored in a user's notification properties, and to bound the quadratic multibyte-keyword matching performed for each post, which allows an authenticated user to degrade post-processing latency and consume excessive CPU on behalf of other members of any channel they share via storing an oversized notify_props.mention_keys list on their own profile.. Mattermost Advisory ID: MMSA-2026-00773
Exploit prediction scoring system (EPSS) score
EPSS Score 0.002
EPSS Ranking 11.5%
CVSS Severity
CVSS v3 Score 4.3
References
Products affected by CVE-2026-19867
-
cpe:2.3:a:mattermost:mattermost_server:11.10.0
-
cpe:2.3:a:mattermost:mattermost_server:11.7.0
-
cpe:2.3:a:mattermost:mattermost_server:11.7.1
-
cpe:2.3:a:mattermost:mattermost_server:11.7.10
-
cpe:2.3:a:mattermost:mattermost_server:11.7.2
-
cpe:2.3:a:mattermost:mattermost_server:11.7.3
-
cpe:2.3:a:mattermost:mattermost_server:11.7.4
-
cpe:2.3:a:mattermost:mattermost_server:11.7.5
-
cpe:2.3:a:mattermost:mattermost_server:11.7.6
-
cpe:2.3:a:mattermost:mattermost_server:11.7.7
-
cpe:2.3:a:mattermost:mattermost_server:11.7.8
-
cpe:2.3:a:mattermost:mattermost_server:11.7.9
-
cpe:2.3:a:mattermost:mattermost_server:11.8.0
-
cpe:2.3:a:mattermost:mattermost_server:11.8.1
-
cpe:2.3:a:mattermost:mattermost_server:11.8.2
-
cpe:2.3:a:mattermost:mattermost_server:11.8.3
-
cpe:2.3:a:mattermost:mattermost_server:11.8.4
-
cpe:2.3:a:mattermost:mattermost_server:11.8.5
-
cpe:2.3:a:mattermost:mattermost_server:11.9.0
-
cpe:2.3:a:mattermost:mattermost_server:11.9.1