CVE-2026-95666: Unbounded post ID array in the bulk reactions endpoint allows denial of service
Mattermost versions 11.9.x <= 11.9.1, 11.8.x <= 11.8.5, 11.7.x <= 11.7.10, 11.10.x <= 11.10.1 fail to limit the length of the post ID array accepted by the bulk reactions endpoint which allows an authenticated user to cause excessive database load via a crafted request to {{POST /api/v4/posts/ids/reactions}}.. Mattermost Advisory ID: MMSA-2026-00771
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Mattermostto a version that resolves this vulnerability.Fixed in 11.11.0 - Upgrade
Upgrade
Mattermostto a version that resolves this vulnerability.Fixed in 11.9.2 - Upgrade
Upgrade
Mattermostto a version that resolves this vulnerability.Fixed in 11.8.6 - Upgrade
Upgrade
Mattermostto a version that resolves this vulnerability.Fixed in 11.7.11 - Upgrade
Upgrade
Mattermostto a version that resolves this vulnerability.Fixed in 11.10.2
Event History
Frequently Asked Questions
Who can exploit this issue?
An authenticated Mattermost user can exploit it. The vulnerable endpoint is network-accessible, and no user interaction is required.
What is required to trigger the denial of service?
The attacker needs to send a crafted POST request to /api/v4/posts/ids/reactions containing an excessively long post ID array. Exploitation causes excessive database load and affects availability rather than confidentiality or integrity.
Which deployments should be checked?
Check Mattermost 11.9.x through 11.9.1, 11.8.x through 11.8.5, 11.7.x through 11.7.10, and 11.10.x through 11.10.1. The provided information does not identify a configuration prerequisite beyond access by an authenticated user.