Mattermost: Three Medium-Severity Flaws in Plugin, OAuth, and Reaction Handling Disclosed Together
Three medium-severity vulnerabilities affecting Mattermost versions 11.7.x through 11.10.x were disclosed on September 22, 2026, impacting plugin requests, OAuth endpoints, and bulk reactions.
Key findings
- Three medium-severity vulnerabilities in Mattermost disclosed on September 22, 2026.
- CVE-2026-96260: Denial of Service via un-enforced request body size limit in plugin requests.
- CVE-2026-96259: System Admin can abuse OAuth endpoint to access internal network addresses.
- CVE-2026-95666: Excessive database load via crafted request to bulk reactions endpoint.
- All vulnerabilities affect Mattermost versions 11.7.x through 11.10.x, with specific patches available.
On September 22, 2026, a batch of three medium-severity vulnerabilities was disclosed for Mattermost, a team collaboration platform. These vulnerabilities, disclosed within a 7-hour window, highlight potential weaknesses in how the platform handles plugin requests, OAuth endpoints, and bulk reactions. The disclosures collectively impact several recent versions of Mattermost, including 11.7.x, 11.8.x, 11.9.x, and 11.10.x, with specific affected versions ranging up to 11.7.10, 11.8.5, 11.9.1, and 11.10.1.
One of the disclosed vulnerabilities, CVE-2026-96260, is a denial-of-service (DoS) flaw. It arises from Mattermost's failure to enforce a request body size limit during the CSRF validation of plugin requests. This oversight allows an authenticated user to send a large request body to a plugin endpoint, potentially exhausting server memory and leading to a denial of service.
Another vulnerability, CVE-2026-96259, affects the OAuth endpoint. The Mattermost platform did not apply an internal-connection filter to these requests. This misconfiguration could permit a System Administrator to compel the server to issue requests to internal network addresses and subsequently read the responses using an OAuth token.
The third vulnerability, CVE-2026-95666, relates to the bulk reactions endpoint. Mattermost failed to limit the length of the post ID array accepted by this endpoint. Consequently, an authenticated user can trigger excessive database load by sending a crafted request to the /api/v4/posts/ids/reactions endpoint.
All three vulnerabilities share the same set of affected versions: Mattermost versions 11.7.x up to 11.7.10, 11.8.x up to 11.8.5, 11.9.x up to 11.9.1, and 11.10.x up to 11.10.1. Users are advised to update to patched versions to mitigate these risks.
This coordinated disclosure of three medium-severity issues underscores the importance of regular security audits for collaboration platforms like Mattermost. Users should ensure their instances are updated to the latest available versions to protect against potential exploitation of these vulnerabilities. The timely patching of these issues is crucial for maintaining the integrity and availability of the Mattermost service.