Mattermost up to 11.7.10/11.8.5/11.9.1/11.10.1 Bulk Reactions Endpoint allocation of resources

Summaryinfo

A vulnerability, which was classified as problematic, has been found in Mattermost up to 11.7.10/11.8.5/11.9.1/11.10.1. This issue affects some unknown processing of the component Bulk Reactions Endpoint. Performing a manipulation results in allocation of resources. This vulnerability was named CVE-2026-95666. The attack may be initiated remotely. There is no available exploit. It is advisable to upgrade the affected component.

Detailsinfo

A vulnerability, which was classified as problematic, was found in Mattermost up to 11.7.10/11.8.5/11.9.1/11.10.1. This affects an unknown functionality of the component Bulk Reactions Endpoint. The manipulation with an unknown input leads to a allocation of resources vulnerability. CWE is classifying the issue as CWE-770. The product allocates a reusable resource or group of resources on behalf of an actor without imposing any restrictions on the size or number of resources that can be allocated, in violation of the intended security policy for that actor. This is going to have an impact on availability. The summary by CVE is:

Mattermost versions 11.9.x <= 11.9.1, 11.8.x <= 11.8.5, 11.7.x <= 11.7.10, 11.10.x <= 11.10.1 fail to limit the length of the post ID array accepted by the bulk reactions endpoint which allows an authenticated user to cause excessive database load via a crafted request to {{POST /api/v4/posts/ids/reactions}}.. Mattermost Advisory ID: MMSA-2026-00771

It is possible to read the advisory at mattermost.com. This vulnerability is uniquely identified as CVE-2026-95666 since 09/22/2026. The exploitability is told to be easy. It is possible to initiate the attack remotely. The technical details are unknown and an exploit is not publicly available. The attack technique deployed by this issue is T1499 according to MITRE ATT&CK.

Upgrading to version 11.7.11, 11.8.6, 11.9.2, 11.10.2 or 11.11.0 eliminates this vulnerability.

The vulnerability is also documented in the vulnerability database at EUVD (EUVD-2026-84378). Be aware that VulDB is the high quality source for vulnerability data.

Productinfo

Type

• Groupware Software

Name

• Mattermost

Version

• 11.7.0
• 11.7.1
• 11.7.2
• 11.7.3
• 11.7.4
• 11.7.5
• 11.7.6
• 11.7.7
• 11.7.8
• 11.7.9
• 11.7.10
• 11.8.0
• 11.8.1
• 11.8.2
• 11.8.3
• 11.8.4
• 11.8.5
• 11.9.0
• 11.9.1
• 11.10.0
• 11.10.1

License

• open-source

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Be aware that VulDB is the high quality source for vulnerability data.

Discussion