CVE-2026-13417

Name of the Vulnerable Software and Affected Versions Mattermost version 11.9.0 Mattermost version 11.8.4 Mattermost version 11.7.7 Mattermost version 10.11.22

Description An issue exists where the software fails to validate the type of fields.properties during block creation. This allows an authenticated user with editor access to a board to crash the Boards plugin worker, resulting in a denial of service. This occurs when a child block is created with a non-object value assigned to fields.properties.

Recommendations Update Mattermost version 11.9.0 to a newer version. Update Mattermost version 11.8.4 to a newer version. Update Mattermost version 11.7.7 to a newer version. Update Mattermost version 10.11.22 to a newer version.