Live › vulnerability › CVE-2026-19867
Go to dashboardMattermost does not cap the number or size of mention keys a user stores in their notification settings, and it does not bound the keyword matching run on each post. An authenticated user can store an oversized mention key list on their own profile and drive up CPU and post-processing latency for other members of shared channels.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Self-hosted or managed Mattermost servers on the affected 11.7 to 11.10 release lines are exposed. Any authenticated user can trigger it through their own notification settings, so the risk is greatest on servers with open sign-up or many shared channels. Servers already on a fixed release, or on a version outside the listed ranges, can skip it.
No product ranges from the sources yet.
mmctl version or the System Console) and compare it against the affected ranges: 11.10.0 and earlier in 11.10.x, 11.9.1 and earlier in 11.9.x, 11.8.5 and earlier in 11.8.x, 11.7.10 and earlier in 11.7.x.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Mattermost versions 11.10.x <= 11.10.0, 11.9.x <= 11.9.1, 11.8.x <= 11.8.5, 11.7.x <= 11.7.10 fail to cap the number and size of mention keys stored in a user's notification properties, and to bound the quadratic multibyte-keyword matching performed for each post, which allows an authenticated user to degrade post-processing latency and consume excessive CPU on behalf of other members of any channel they share via storing an oversized notify_props.mention_keys list on their own profile.. Mattermost Advisory ID: MMSA-2026-00773
This page as .md · .json · in your agent: get_signal("CVE-2026-19867")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.