Alimursaliyev

Mattermost versions <=11.9 11.1.9 11.5.8 11.10.7.0 fail to validate Zoom chat line length before slicing which allows an authenticated attacker to crash the Agents plugin via summarizing a Zoom chat transcription containing short continuation lines. Mattermost Advisory ID: MMSA-2026-00723

An authenticated user can cause a denial of service by uploading a specially crafted PDF file. The issue occurs because the software fails to limit the volume of text extracted from the PDF, allowing a compressed content stream to expand into an excessively large amount of text, which exhausts server memory.

An issue exists where the software fails to validate null elements when decoding playbook import conditions. This allows an authenticated attacker to cause an instance-wide crash of the Playbooks plugin by sending a crafted import request that contains a null condition.

The local image proxy fails to limit the size of remote image responses buffered in memory during direct fetches. This allows a remote attacker to cause memory exhaustion on the server by providing a crafted oversized image response.

An authenticated user can cause a denial of service by exhausting server memory. This occurs because the software fails to enforce a request body size limit during Cross-Site Request Forgery (CSRF) validation—a security mechanism used to prevent unauthorized commands from being transmitted from a user that the web application trusts—when processing requests sent to a plugin endpoint.

An issue exists where the software fails to validate the type of `fields.properties` during block creation. This allows an authenticated user with editor access to a board to crash the Boards plugin worker, resulting in a denial of service. This occurs when a child block is created with a non-object value assigned to `fields.properties`.

An issue exists where the system fails to limit the amount of memory allocated during the decoding of uploaded image files. An authenticated user can exploit this by uploading a specially crafted image as a profile picture, channel file attachment, team icon, or custom brand image, leading to excessive server memory consumption and a potential denial of service.

An issue exists where the system fails to validate if a property field belongs to the specified run before updating its value. This allows an authenticated user with run property-management access to crash the Playbooks plugin by sending a REST request that references a property field belonging to a different run.

The MS Calendar plugin fails to recover from handler panics. This allows an authenticated user to crash the plugin process by sending a post-action request containing an unexpected field type.

An issue exists where the software fails to validate WebSocket command field types. This allows an authenticated user to crash the plugin process, resulting in a denial of service for all Boards users. The flaw is triggered by sending a `custom focalboard SUBSCRIBE TEAM` message containing a non-string `teamId` variable.

The software fails to verify the activation status of a guest account during the session creation process in the magic-link token login path. This allows a deactivated guest user to obtain a fully functional session if they possess a magic-link token that was issued before the account was deactivated.