Vulnerability · Published Jul 27, 2026 · Assigned by Mattermost

CVE-2026-10600Denial of service via unbounded document content extraction in Mattermost Server

Medium 4.3

In plain English

A medium-severity resource allocation without limits in Mattermost from Mattermost. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 31% of all known vulnerabilities).

Severity (CVSS 3.1)4.3Medium

Exploit odds (30 days)0.4%top 69.3% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

Mattermost versions 11.8.x <= 11.8.0, 11.7.x <= 11.7.3, 11.6.x <= 11.6.5, 10.11.x <= 10.11.20 fail to bound the time and resource consumption of server-side document content extraction which allows an authenticated user with file-upload permission to degrade file uploads for all users on the server via repeatedly uploading small documents that are cheap to upload but expensive to extract, saturating the shared extraction worker pool.. Mattermost Advisory ID: MMSA-2026-00694

Affected products (as reported)

Vendor	Product	Versions
Mattermost	Mattermost	11.8.0 – through 11.8.011.7.0 – through 11.7.311.6.0 – through 11.6.510.11.0 – through 10.11.20

Weakness: CWE-770 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L

References

MMSA-2026-00694 vendor-advisory