Vulnerability · Published Oct 16, 2026 · Assigned by Mattermost

CVE-2026-19867Uncapped mention keys in user notification properties allow CPU exhaustion during post processing

Medium 4.3

In plain English

A medium-severity resource allocation without limits in Mattermost from Mattermost. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 12% of all known vulnerabilities).

Severity (CVSS 3.1)4.3Medium

Exploit odds (30 days)0.2%top 87.8% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

Mattermost versions 11.10.x <= 11.10.0, 11.9.x <= 11.9.1, 11.8.x <= 11.8.5, 11.7.x <= 11.7.10 fail to cap the number and size of mention keys stored in a user's notification properties, and to bound the quadratic multibyte-keyword matching performed for each post, which allows an authenticated user to degrade post-processing latency and consume excessive CPU on behalf of other members of any channel they share via storing an oversized notify_props.mention_keys list on their own profile.. Mattermost Advisory ID: MMSA-2026-00773

Affected products (as reported)

Vendor	Product	Versions
Mattermost	Mattermost	11.10.0 – through 11.10.011.9.0 – through 11.9.111.8.0 – through 11.8.511.7.0 – through 11.7.10

Weakness: CWE-770 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L

References

MMSA-2026-00773 vendor-advisory