Vulnerability · Published Sep 22, 2026 · Assigned by Mattermost

CVE-2026-95666Unbounded post ID array in the bulk reactions endpoint allows denial of service

Medium 4.3

In plain English

A medium-severity resource allocation without limits in Mattermost from Mattermost. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 31% of all known vulnerabilities).

Severity (CVSS 3.1)4.3Medium

Exploit odds (30 days)0.4%top 69.3% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

Mattermost versions 11.9.x <= 11.9.1, 11.8.x <= 11.8.5, 11.7.x <= 11.7.10, 11.10.x <= 11.10.1 fail to limit the length of the post ID array accepted by the bulk reactions endpoint which allows an authenticated user to cause excessive database load via a crafted request to {{POST /api/v4/posts/ids/reactions}}.. Mattermost Advisory ID: MMSA-2026-00771

Affected products (as reported)

Vendor	Product	Versions
Mattermost	Mattermost	11.9.0 – through 11.9.111.8.0 – through 11.8.511.7.0 – through 11.7.1011.10.0 – through 11.10.1

Weakness: CWE-770 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L

References

MMSA-2026-00771 vendor-advisory