Performance Degradation Vulnerability in Mattermost by Mattermost Inc.
CVE-2026-19867

4.3MEDIUM

Key Information:

Vendor

Mattermost
Status
Mattermost
Vendor
CVE Published:
16 October 2026

What is CVE-2026-19867?

Mattermost versions 11.10.0 and earlier in the 11.10.x, 11.9.x, 11.8.x, and 11.7.x series are susceptible to a vulnerability that fails to limit the number and size of mention keys stored in a user’s notification properties. This oversight allows an authenticated user to create an excessively large notify_props.mention_keys list, which can lead to inefficient post-processing and increased CPU consumption for other members in the same channel, potentially disrupting the overall performance of the Mattermost server.

Affected Version(s)

Mattermost 11.10.0

Mattermost 11.9.0 <= 11.9.1

Mattermost 11.8.0 <= 11.8.5

References

https://mattermost.com/security-updates
vendor-advisory

CVSS V3.1

Score:
4.3
Severity:
MEDIUM
Confidentiality:
None
Integrity:
None
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

CERT PL
.