CVE-2026-95666

CVE-2026-95666 affects Mattermost versions 11.9.x ≤ 11.9.1 , 11.8.x ≤ 11.8.5 , 11.7.x ≤ 11.7.10 , and 11.10.x ≤ 11.10.1 . The bulk reactions endpoint (POST /api/v4/posts/ids/reactions) fails to limit the length of the post ID array it accepts, allowing an authenticated user to cause excessive dat...

CVE-2026-95666 Unbounded post ID array in the bulk reactions endpoint allows denial of service

Mattermost versions 11.9.x = 11.9.1, 11.8.x = 11.8.5, 11.7.x = 11.7.10, 11.10.x = 11.10.1 fail to limit the length of the post ID array accepted by the bulk reactions endpoint which allows an authenticated user to cause excessive database load via a crafted request to POST...

PT-2026-96724

Name of the Vulnerable Software and Affected Versions Mattermost versions 11.7.0 through 11.7.10 Mattermost versions 11.8.0 through 11.8.5 Mattermost versions 11.9.0 through 11.9.1 Mattermost versions 11.10.0 through 11.10.1 Description An authenticated user can cause excessive database load by...

CVE-2026-95666: Allocation of Resources Without Limits or Throttling

Mattermost versions 11.9.x = 11.9.1, 11.8.x = 11.8.5, 11.7.x = 11.7.10, 11.10.x = 11.10.1 fail to limit the length of the post ID array accepted by the bulk reactions endpoint which allows an authenticated user to cause excessive database load via a crafted request to POST...