Mattermost versions 11.9.x <= 11.9.1, 11.8.x <= 11.8.5, 11.7.x <= 11.7.10, 11.10.x <= 11.10.1 fail to limit the length of the post ID array accepted by the bulk reactions endpoint which allows an authenticated user to cause excessive database load via a crafted request to {{POST /api/v4/posts/ids/reactions}}.. Mattermost Advisory ID: MMSA-2026-00771

According to its self-reported version number, the Mattermost Server application running on the remote host is 11.8.x prior to 11.8.6. It is, therefore, affected by multiple vulnerabilities:

- An issue where the bulk reactions endpoint accepted an unbounded post ID array, allowing an authenticated user to degrade availability (CVE-2026-95666).

- An issue where a request to a plugin route could be read without a size limit, allowing an authenticated user to exhaust server memory (CVE-2026-96260).

- An issue where the OAuth sign-in flow could issue requests to internal addresses configured by a System Administrator (CVE-2026-96259).

Note that the scanner has not tested for these issues but has instead relied only on the application's self-reported version number.

According to its self-reported version number, the Mattermost Server application running on the remote host is 11.9.x prior to 11.9.2. It is, therefore, affected by multiple vulnerabilities:

- An issue where the bulk reactions endpoint accepted an unbounded post ID array, allowing an authenticated user to degrade availability (CVE-2026-95666).

- An issue where a request to a plugin route could be read without a size limit, allowing an authenticated user to exhaust server memory (CVE-2026-96260).

- An issue where the OAuth sign-in flow could issue requests to internal addresses configured by a System Administrator (CVE-2026-96259).

Note that the scanner has not tested for these issues but has instead relied only on the application's self-reported version number.

According to its self-reported version number, the Mattermost Server application running on the remote host is 11.10.x prior to 11.10.2. It is, therefore, affected by multiple vulnerabilities:

- An issue where the bulk reactions endpoint accepted an unbounded post ID array, allowing an authenticated user to degrade availability (CVE-2026-95666).

- An issue where a request to a plugin route could be read without a size limit, allowing an authenticated user to exhaust server memory (CVE-2026-96260).

- An issue where the OAuth sign-in flow could issue requests to internal addresses configured by a System Administrator (CVE-2026-96259).

Note that the scanner has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of Mattermost Server installed on the remote host is affected by multiple vulnerabilities as referenced in the MMSA-2026-00771, MMSA-2026-00775, MMSA-2026-00776 advisories.

  - Mattermost versions 11.9.x <= 11.9.1, 11.8.x <= 11.8.5, 11.7.x <= 11.7.10, 11.10.x <= 11.10.1 fail to     enforce a request body size limit during CSRF validation of plugin requests which allows an     authenticated user to exhaust server memory and cause a denial of service via a large request body sent     to a plugin endpoint. Mattermost Advisory ID: MMSA-2026-00775. (CVE-2026-96260)

  - Mattermost versions 11.9.x <= 11.9.1, 11.8.x <= 11.8.5, 11.7.x <= 11.7.10, 11.10.x <= 11.10.1 fail to     apply the internal-connection filter to OAuth endpoint requests, which allows a System Administrator to     make the server issue requests to internal network addresses and read the responses via the configured     OAuth token and userinfo endpoints. Mattermost Advisory ID: MMSA-2026-00776. (CVE-2026-96259)

  - Mattermost versions 11.9.x <= 11.9.1, 11.8.x <= 11.8.5, 11.7.x <= 11.7.10, 11.10.x <= 11.10.1 fail to     limit the length of the post ID array accepted by the bulk reactions endpoint which allows an     authenticated user to cause excessive database load via a crafted request to POST     /api/v4/posts/ids/reactions. Mattermost Advisory ID: MMSA-2026-00771. (CVE-2026-95666)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Type	Severity
115686	Mattermost Server 11.8.x < 11.8.6 Multiple Vulnerabilities	Web App Scanning	Component Vulnerability	Version Based	medium
115685	Mattermost Server 11.9.x < 11.9.2 Multiple Vulnerabilities	Web App Scanning	Component Vulnerability	Version Based	medium
115684	Mattermost Server 11.10.x < 11.10.2 Multiple Vulnerabilities	Web App Scanning	Component Vulnerability	Version Based	medium
350090	Mattermost Server 11.7.x < 11.7.11 / 11.8.x < 11.8.6 / 11.9.x < 11.9.2 / 11.10.x < 11.10.2 Multiple Vulnerabilities (MMSA-2026-00771, MMSA-2026-00775, MMSA-2026-00776)	Nessus	CGI abuses	Remote	medium

Detections

Analytics

CVE-2026-95666

medium

Tenable Plugins

medium

medium

medium

medium