CVE-2026-19867: Mattermost Denial of Service Vulnerability

CVE-2026-19867 Overview

CVE-2026-19867 affects multiple versions of Mattermost, a collaboration platform for enterprise messaging. The vulnerability allows an authenticated user to degrade post-processing latency and consume excessive CPU on behalf of other channel members. The flaw stems from Mattermost failing to cap the number and size of mention keys stored in a user's notification properties. It also fails to bound the quadratic multibyte-keyword matching performed for each post. Mattermost tracks this issue as advisory MMSA-2026-00773 and classifies it under CWE-770: Allocation of Resources Without Limits or Throttling.

Critical Impact
An authenticated user can store an oversized notify_props.mention_keys list on their own profile, causing CPU exhaustion for every member of any channel they share.

Affected Products

Mattermost 11.10.x versions <= 11.10.0
Mattermost 11.9.x versions <= 11.9.1
Mattermost 11.8.x versions <= 11.8.5 and 11.7.x versions <= 11.7.10

Discovery Timeline

2026-10-16 - CVE-2026-19867 published to NVD
2026-10-16 - Last updated in NVD database

Technical Details for CVE-2026-19867

Vulnerability Analysis

Mattermost performs server-side keyword matching to detect user mentions in every posted message. For each post, the server iterates through the mention keys defined in the notify_props.mention_keys field of each channel member. The matching routine uses a multibyte-aware algorithm with quadratic time complexity relative to keyword length and count. The server does not enforce an upper bound on either the number of entries or the size of each entry in a user's mention keys list. An authenticated user can therefore inflate their own notification preferences until post-processing becomes CPU-bound.

Because the matching runs for every member of a shared channel, the computational cost scales with channel activity rather than with the attacker's own usage. A single malicious profile can impose sustained CPU load on the server whenever another user posts in a shared channel.

Root Cause

The root cause is missing input validation and resource throttling on the notify_props.mention_keys field, consistent with CWE-770. The matching function also exhibits quadratic complexity when processing multibyte keywords. The combination allows an algorithmic complexity attack driven by user-controlled profile data.

Attack Vector

Exploitation requires network access and valid, low-privileged credentials on the Mattermost instance. The attacker updates their own user profile to store an oversized notify_props.mention_keys list. The attacker then joins or remains in channels where legitimate posting activity occurs. Each post processed by the server triggers the quadratic matching routine against the inflated keyword set, degrading availability for other channel members. See the Mattermost Security Updates advisory for additional technical context.

Detection Methods for CVE-2026-19867

Indicators of Compromise

User profiles containing an unusually large notify_props.mention_keys list, particularly entries with long multibyte keyword values.
Sustained CPU spikes on Mattermost application servers correlated with normal posting activity in specific channels.
Increased latency on /api/v4/posts endpoints and related post-processing paths.

Detection Strategies

Audit the Users table for mention key fields exceeding a reasonable baseline, for example more than 50 entries or individual entries longer than 100 bytes.
Monitor Mattermost application logs for slow post-processing warnings and goroutine saturation.
Correlate CPU utilization metrics with user profile modification events in the audit log.

Monitoring Recommendations

Enable Mattermost audit logging and ship events to a centralized SIEM for review of profile update actions.
Alert on repeated PUT /api/v4/users/{user_id}/patch calls that modify notification properties.
Track per-channel post latency as a performance signal for availability degradation.

How to Mitigate CVE-2026-19867

Immediate Actions Required

Upgrade Mattermost to a fixed release that remediates MMSA-2026-00773 as documented on the Mattermost Security Updates page.
Identify and reset notify_props.mention_keys for any accounts exhibiting oversized values before upgrading.
Review authenticated user accounts and remove or restrict accounts that are not required for business operations.

Patch Information

Mattermost has released fixed versions addressing advisory MMSA-2026-00773. Administrators should consult the vendor Mattermost Security Updates page for the exact patched versions corresponding to the 11.7.x, 11.8.x, 11.9.x, and 11.10.x branches and apply upgrades through standard Mattermost deployment procedures.

Workarounds

Enforce administrative limits on user profile modifications where feasible and audit mention key fields on a scheduled basis.
Place a reverse proxy or web application firewall rule in front of the Mattermost API to inspect and limit the payload size of profile update requests.
Monitor server CPU and post-processing latency so that abusive accounts can be identified and remediated quickly.

bash

# Example database query to identify oversized mention_keys entries
# Review results before taking remediation action
psql -d mattermost -c "SELECT id, username, length(notifyprops) AS props_len \
  FROM users \
  WHERE notifyprops LIKE '%mention_keys%' \
  ORDER BY props_len DESC \
  LIMIT 25;"