CVE-2026-19867 Mattermost CVE debrief

Who should care

Mattermost administrators, security teams, and IT personnel responsible for maintaining and securing Mattermost installations should assess exposure and prioritize mitigation. This includes operators, platform administrators, vulnerability management teams, and security personnel who need to verify and mitigate this vulnerability in Mattermost installations, particularly in environments where authenticated users have access to channels.

Why it matters

CVE-2026-19867 is a medium-severity vulnerability in Mattermost that allows authenticated users to launch a DoS attack, degrading performance and consuming excessive CPU resources. Defenders should prioritize verifying and mitigating this vulnerability in Mattermost installations, particularly in environments where authenticated users have access to channels.

• Degraded post-processing latency
• Excessive CPU consumption on behalf of other channel members
• Potential for denial-of-service (DoS) attacks

Technical summary

The vulnerability exists in Mattermost versions 11.10.x <= 11.10.0, 11.9.x <= 11.9.1, 11.8.x <= 11.8.5, 11.7.x <= 11.7.10. An authenticated user can store an oversized notify_props.mention_keys list on their profile, which can cause excessive CPU consumption and degrade post-processing latency for other members of any channel they share. This can lead to a denial-of-service (DoS) attack, degrading performance and consuming excessive CPU resources. Defenders should prioritize verifying and mitigating this vulnerability in Mattermost installations, particularly in environments where authenticated users have access to channels.

Defensive priority

Defenders should prioritize verifying and mitigating this vulnerability in Mattermost installations, particularly in environments where authenticated users have access to channels.

Recommended defensive actions

• Verify Mattermost installation versions and check for updates
• Restrict authenticated user access to channels
• Monitor system resources for excessive CPU consumption
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The CVE record and Mattermost advisory provide details on the vulnerability, but do not specify the exact versions affected or provide a remediation plan. Further investigation is required to determine the impact and mitigation strategies.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.