Alimursaliyev

Mattermost versions 11.10.x <= 11.10.0, 11.7.x <= 11.7.9, 11.9.x <= 11.9.1, 11.8.x <= 11.8.5 fail to limit the size of remote image responses buffered in memory during local image proxy direct fetches, which allows a remote attacker to cause memory exhaustion on the server via a crafted oversized image response.. Mattermost Advisory ID: MMSA-2026-00726

**Name of the Vulnerable Software and Affected Versions** Mattermost versions 11.7.0 through 11.7.10 Mattermost versions 11.8.0 through 11.8.5 Mattermost versions 11.9.0 through 11.9.1 Mattermost versions 11.10.0 through 11.10.1 **Description** An authenticated user can cause a denial of service by exhausting server memory. This occurs because the software fails to enforce a request body size limit during Cross-Site Request Forgery (CSRF) validation—a security mechanism used to prevent unauthorized commands from being transmitted from a user that the web application trusts—when processing requests sent to a plugin endpoint. **Recommendations** Update Mattermost versions 11.7.0 through 11.7.10 to a version newer than 11.7.10. Update Mattermost versions 11.8.0 through 11.8.5 to a version newer than 11.8.5. Update Mattermost versions 11.9.0 through 11.9.1 to a version newer than 11.9.1. Update Mattermost versions 11.10.0 through 11.10.1 to a version newer than 11.10.1.

**Name of the Vulnerable Software and Affected Versions** Mattermost version 11.9.0 Mattermost version 11.8.4 Mattermost version 11.7.7 Mattermost version 10.11.22 **Description** An issue exists where the software fails to validate the type of `fields.properties` during block creation. This allows an authenticated user with editor access to a board to crash the Boards plugin worker, resulting in a denial of service. This occurs when a child block is created with a non-object value assigned to `fields.properties`. **Recommendations** Update Mattermost version 11.9.0 to a newer version. Update Mattermost version 11.8.4 to a newer version. Update Mattermost version 11.7.7 to a newer version. Update Mattermost version 10.11.22 to a newer version.

**Name of the Vulnerable Software and Affected Versions** Mattermost version 11.9.0 Mattermost version 11.8.4 Mattermost version 11.7.7 Mattermost version 10.11.22 **Description** An issue exists where the system fails to limit the amount of memory allocated during the decoding of uploaded image files. An authenticated user can exploit this by uploading a specially crafted image as a profile picture, channel file attachment, team icon, or custom brand image, leading to excessive server memory consumption and a potential denial of service. **Recommendations** Update Mattermost version 11.9.0 to a newer version. Update Mattermost version 11.8.4 to a newer version. Update Mattermost version 11.7.7 to a newer version. Update Mattermost version 10.11.22 to a newer version.

**Name of the Vulnerable Software and Affected Versions** Mattermost version 11.9.0 Mattermost version 11.8.4 Mattermost version 11.7.7 Mattermost version 10.11.22 **Description** An issue exists where the system fails to validate if a property field belongs to the specified run before updating its value. This allows an authenticated user with run property-management access to crash the Playbooks plugin by sending a REST request that references a property field belonging to a different run. **Recommendations** Update Mattermost version 11.9.0 to a newer version. Update Mattermost version 11.8.4 to a newer version. Update Mattermost version 11.7.7 to a newer version. Update Mattermost version 10.11.22 to a newer version.

**Name of the Vulnerable Software and Affected Versions** Mattermost versions prior to 11.9 **Description** The MS Calendar plugin fails to recover from handler panics. This allows an authenticated user to crash the plugin process by sending a post-action request containing an unexpected field type. **Recommendations** Update to version 11.9 or later.

**اسم البرنامج المعرض للخطر والإصدارات المتأثرة** إصدارات Mattermost من 11.7.0 إلى 11.7.6 إصدارات Mattermost من 10.11.0 إلى 10.11.21 إصدارات Mattermost من 11.8.0 إلى 11.8.3 **الوصف** توجد مشكلة تتمثل في فشل البرنامج في التحقق من صحة أنواع حقول أوامر WebSocket. وهذا يسمح لمستخدم تمت مصادقته بتعطيل عملية المكون الإضافي، مما يؤدي إلى رفض الخدمة لجميع مستخدمي Boards. يتم تشغيل هذه الثغرة عن طريق إرسال رسالة `custom focalboard SUBSCRIBE TEAM` تحتوي على متغير `teamId` غير نصي. **التوصيات** قم بتحديث إصدارات Mattermost من 11.7.0 إلى 11.7.6 إلى إصدار أحدث من 11.7.6. قم بتحديث إصدارات Mattermost من 10.11.0 إلى 10.11.21 إلى إصدار أحدث من 10.11.21. قم بتحديث إصدارات Mattermost من 11.8.0 إلى 11.8.3 إلى إصدار أحدث من 11.8.3.

**اسم البرنامج المعرض للخطر والإصدارات المتأثرة** إصدارات Mattermost من 11.6.x حتى 11.6.4 إصدارات Mattermost من 11.7.x حتى 11.7.2 **الوصف** يفشل البرنامج في التحقق من حالة تنشيط حساب الضيف أثناء عملية إنشاء الجلسة في مسار تسجيل الدخول باستخدام رمز «magic-link». وهذا يسمح لمستخدم ضيف تم تعطيل حسابه بالحصول على جلسة عمل كاملة الوظائف إذا كان يمتلك رمز «magic-link» تم إصداره قبل تعطيل الحساب. **التوصيات** تحديث إصدارات Mattermost من 11.6.x إلى إصدار أحدث من 11.6.4. تحديث إصدارات Mattermost من 11.7.x إلى إصدار أحدث من 11.7.2.