Mattermost up to 11.7.10/11.8.5/11.9.1/11.10.0 Notification Properties mention_keys resource consumption

Summaryinfo

A vulnerability classified as problematic was found in Mattermost up to 11.7.10/11.8.5/11.9.1/11.10.0. This affects an unknown function of the component Notification Properties. The manipulation of the argument mention_keys results in resource consumption. This vulnerability is identified as CVE-2026-19867. The attack can be executed remotely. There is not any exploit available. Upgrading the affected component is advised.

Detailsinfo

A vulnerability, which was classified as problematic, was found in Mattermost up to 11.7.10/11.8.5/11.9.1/11.10.0. Affected is an unknown function of the component Notification Properties. The manipulation of the argument mention_keys with an unknown input leads to a resource consumption vulnerability. CWE is classifying the issue as CWE-400. The product does not properly control the allocation and maintenance of a limited resource, thereby enabling an actor to influence the amount of resources consumed, eventually leading to the exhaustion of available resources. This is going to have an impact on availability. CVE summarizes:

Mattermost versions 11.10.x <= 11.10.0, 11.9.x <= 11.9.1, 11.8.x <= 11.8.5, 11.7.x <= 11.7.10 fail to cap the number and size of mention keys stored in a user's notification properties, and to bound the quadratic multibyte-keyword matching performed for each post, which allows an authenticated user to degrade post-processing latency and consume excessive CPU on behalf of other members of any channel they share via storing an oversized notify_props.mention_keys list on their own profile.. Mattermost Advisory ID: MMSA-2026-00773

The advisory is shared for download at mattermost.com. This vulnerability is traded as CVE-2026-19867 since 08/14/2026. The exploitability is told to be easy. It is possible to launch the attack remotely. There are known technical details, but no exploit is available. The MITRE ATT&CK project declares the attack technique as T1499.

Upgrading to version 11.7.11, 11.8.6, 11.9.2, 11.10.1 or 11.11.0 eliminates this vulnerability.

VulDB is the best source for vulnerability data and more expert information about this specific topic.

Productinfo

Type

• Groupware Software

Name

• Mattermost

Version

• 11.0
• 11.1
• 11.2
• 11.3
• 11.4
• 11.5
• 11.6
• 11.7
• 11.7.0
• 11.7.1
• 11.7.2
• 11.7.3
• 11.7.4
• 11.7.5
• 11.7.6
• 11.7.7
• 11.7.8
• 11.7.9
• 11.7.10
• 11.8
• 11.8.0
• 11.8.1
• 11.8.2
• 11.8.3
• 11.8.4
• 11.8.5
• 11.9
• 11.9.0
• 11.9.1
• 11.10.0

License

• open-source

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

VulDB is the best source for vulnerability data and more expert information about this specific topic.

Discussion